计算机安全中应该隐藏和开放什么：来自欺骗、战争艺术、法律和经济理论的教训
What Should be Hidden and Open in Computer Security: Lessons from Deception, the Art of War, Law, and Economic Theory
摘要：
“什么应该是隐藏和开放的计算机安全：从欺骗的教训，战争的艺术，法律和经济理论”彼得·P·斯维尔，乔治华盛顿大学。想象一个军事基地。它被防御以防可能的攻击。我们是否期望基地暴露诱杀装置和其他防御设施的位置？没有。但是对于许多计算机应用程序，软件开发人员需要透露大量关于代码的信息，以使其他系统所有者信任代码并知道如何使用它。本文将研究这些相互矛盾的直觉，并提出一个关于计算机安全中应该公开和隐藏的理论。本文的第一部分展示了实质性的开放性对于主要的计算机安全主题（如防火墙、打包软件和加密）是如何典型的。第二部分分析了导致计算机安全开放性和隐蔽性的因素。第三部分提出了一个经济分析的问题，什么应该是开放的计算机安全。不暴露陷阱的所有者就像垄断者，而开源软件供应商则处于竞争市场。这种经济方法使我们能够确定可能的市场失灵，在多大程度上开放计算机安全。第四部分考察了孙子和克劳塞维茨对隐藏和欺骗在军事战略中的作用的对比方法。因此，计算机安全、经济和军事战略方法都显示了与计算机安全中应该隐藏的内容相关的因素。第五部分然后将这一理论应用于一系列当前的法律和技术问题。
英文摘要：
"What Should be Hidden and Open in Computer Security: Lessons from Deception, the Art of War, Law, and Economic Theory" Peter P. Swire, George Washington University. Imagine a military base. It is defended against possible attack. Do we expect the base to reveal the location of booby traps and other defenses? No. But for many computer applications,a software developer will need to reveal a great deal about the code to get other system owners to trust the code and know how to operate with it. This article examines these conflicting intuitions and develops a theory about what should be open and hidden in computer security. Part I of the paper shows how substantial openness is typical for major computer security topics, such as firewalls, packaged software, and encryption. Part II shows what factors will lead to openness or hiddenness in computer security. Part III presents an economic analysis of the issue of what should be open in computer security. The owner who does not reveal the booby traps is like a monopolist, while the open-source software supplier is in a competitive market. This economic approach allows us to identify possible market failures in how much openness occurs for computer security. Part IV examines the contrasting approaches of Sun Tzu and Clausewitz to the role of hiddenness and deception in military strategy. The computer security, economic, and military strategy approaches thus each show factors relevant to what should be kept hidden in computer security. Part V then applies the theory to a range of current legal and technical issues.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
