Will we ever fix that last s/w (h/w) security vulnerability?

A recent talk bu Johanna Rutkowska sparked a discussion about whether the number of vulnerabilities is potentially infinte, or whether the cost and/or value of exploiting and/or fixing them them is slowly increasing (or decreasing) or (thanks to Markus Kuhn and others) it is cyclic, as phases of technological innovation wash up and down the shores of human society....

so my take - we spend ages in the OS community trying (as
per the talk) to nail down the smallest piece of the trusted tiny
center of the kernel (and talk to the hardware people about it very
closely - even modifying their designs), so that the attack surface is
minimized - including, as you say, improved tools and techniques 9type
safe software fuzzers, verifiers etc etc...

then some skunk works thing from the h/w comes along and changes the

whole game (in terms of complexity to start with, but also in terms of

massively opening up the attack space) _ usually its coz of some

geniuine user demand for something faster/cleverer (as per the talk,

add in GPUs, add in smarer NICs with offloading, add in multicore, add

in more instructions for graphics, even for security itself!)

another example of this can be seen on the net  - since well before

current scandels (back in 1990s) we've been trying to batten down the

hatches everywhere  with DNS, BGP and end-to-end crypto (and now

betterer DNSSEC, better certificate ideas, better router-router

systemic ways to prevent problems, better e2e crypto (c.f. tcpcrypt)

etc

and then some bozo comes along and re-jogs the entire mobile phone net

to be IP based (but with lots of little, devilish little changes)

then some mega-bozo comes and puts a rspi in every thing that has a

moving part, and connects that to the interweb (and builds a new stack

with COAP and IPv6 and lowpan/zigbee so we have no idea what new

sneaky things there are in there)...

then some dolt comes and builds million core data centers and modifies

the entire stack and routing system coz it doesn't scale to their

needs....so we don't know what new corner cases have now appeared on

the masive geodesic (no longer nice shiny smooth, hard  thing)

and we have to start a l l   o v e r   a g a i n

thrice.

It's like you build defences around your big city with walled gardens

and gated communities, and someone comes and builds a massive shanty

town right outside, a favella, which you need, coz, after all, someone

has to come and clean the floors and make your tea and take out the

trash...oops