5 ms·

"The tech crowd's acquiescence to the surveillance state is absolutely necessary for it to function as designed. " Well said! Since we have the toolset to und

"The tech crowd's acquiescence to the surveillance state is absolutely necessary for it to function as designed. " Well said! Since we have the toolset to understand what is happening, we must be the main source of outrage. When we come online and do our stuff, we represent our families, our friends, or coworkers. Everyone around us that do not have the same tools to understand/interpret the abuses and the propaganda. We like to think that everyone should understand what is going on, but this is impossible in a short/medium or even long term. People use the Internet like they use the building they live, or the house. They haven't built it and they don't understand, and don't need to understand how it was built or its internals. They are the users. They presume the architects/engineers involved where responsible, good people, that did a good job and wanted for them, future residents, to have a nice home. If you are an engineer building a Shopping Center, and you get to know how the company you work for is abusive towards its employees or how they are overpricing resources in a public contract or manipulating prices, or doing a dirty job using an unsafe structure or bad materials, it is you who should act. You can't expect someone else or everyone to act, to understand what you understand because you are in a position to understand. If you do not act, if you do not take a position, if you do not represent the ones that are unaware, you become the same as them. The only way we can make out of this bizarre situation is if everyone of us takes his role in society, whatever society, with his/her heart. Do it with love towards your neighbour. There is no other way. In tech, we are often quite cold because we deal with machines, but we are still flesh and bone behind screens, and our love should be directed to protecting the users.

JoeAltmaier 11y ago
It would sure help if we didn't have to act alone. If we were part of some larger organization (Engineers' Guild or some such) that would protect members with money or legal aid, when they took a moral stand. Even advise about the right path. Loving your neighbor is good; but income for my family will probably take precedence most of the time.
- cryoshon 11y ago
  So we need a union? I agree. How about something along the lines of the Guild of Engineers and Scientists? A broader base of smart people would be helpful, but I'm not sure if it'd dilute the effectiveness of speaking out.
  - JoeAltmaier 11y ago
    'Union' is a loaded word. I absolutely don't need a union trying to limit my wages or negotiate on my behalf with my employer. Until I get in trouble for taking a stand. Then I need them.
  - nosuchthing 11y ago
    Unions have become antiquated and corrupt.. A Guild/Collective for Tech Engineers, Scientists • Transparent decision making + expenditures (opt in/out services) • Challenges and certifications for members • Recruiter / job match type service
- akshatpradhan 11y ago
  I'd like to throw a story into the privacy discussion. Do you know what a full content packet capture is? It’s when you’re able to grab every piece of data transmitted over a network using a tool called tcpdump. You can use another tool to reassemble those collected data packets into complete applications, movie or music files, even video chats and phone calls. Safari Books defines full content data as, “the most flexible form of network-based information. It is a rich form of evidence offering detail and opportunities seldom found elsewhere. Once full content data has been acquired, analysts can derive session, alert, and statistical data if necessary.” As a joke, an instructor once told me that when they went onsite to do security investigations, they would do a full content dump; if someone was downloading videos at the time, my instructor would say, “Thanks for the movie, guys!” This is what the Utah Data Center is doing. All packets are collected using a tool like tcpdump, and then the Center reassembles them and categorizes the content into data cubes (e.g., movies, video calls, emails) that are easily findable with open source search engines such as Lucene and Solr. Is this taking security seriously? You bet! When you ask a security professional what they recommend is the most reasonable approach to protecting sensitive health records, they will say, “Its all about Penetration Tests, Risk Assessments, and IDS.” Mass Traffic Collection is currently one example that’s being taken very seriously as an approach to security. If a hosting provider like Akamai — which, runs 30% of the world’s web traffic — is able to reassemble your packets, and even archive them, is that what you want security to be? Probably not, but when a security professional says “let’s take security seriously”, to them it means just watch all the things. That may sound a bit paranoid but check out this pretty spooky Hacking Team Commercial[1] where they specifically say, “Is passive monitoring enough? You want to look through your target’s eyes.” I remember in 2006, after my IDS training, I was all for collecting every single packet (no matter what) because I was taught as a security professional, that was the only way I could do my job: watch everything, since we need to know everything about anything. If you watch everything, that’s inherently security, and the world is protected. That was my modus operandi for many years. This is why taking privacy and security seriously really means taking compliance seriously. Compliance lassos in “watch everything” while also providing validation and proof of security. If we’re doing good hygiene (e.g. Key rotation, Log review, Code review, Change control, etc. ) in our forts, there’s no reason to collect and watch everything. If compliance fails as an approach to security, IDS could expand to a massive data collection agent running on every company in the world. The recipe to collect everything already exists but that means only security is being taken seriously. I hope we start to take compliance seriously because I think that is the intersection for good privacy and good security. [1] https://www.youtube.com/watch?v=R63CRBNLE2o https://www.youtube.com/watch?v=R63CRBNLE2o
deleted 11y ago
[deleted]

JoeAltmaier 11y ago

It would sure help if we didn't have to act alone. If we were part of some larger organization (Engineers' Guild or some such) that would protect members with money or legal aid, when they took a moral stand. Even advise about the right path. Loving your neighbor is good; but income for my family will probably take precedence most of the time.

cryoshon 11y ago
So we need a union? I agree. How about something along the lines of the Guild of Engineers and Scientists? A broader base of smart people would be helpful, but I'm not sure if it'd dilute the effectiveness of speaking out.
- JoeAltmaier 11y ago
  'Union' is a loaded word. I absolutely don't need a union trying to limit my wages or negotiate on my behalf with my employer. Until I get in trouble for taking a stand. Then I need them.
- nosuchthing 11y ago
  Unions have become antiquated and corrupt.. A Guild/Collective for Tech Engineers, Scientists • Transparent decision making + expenditures (opt in/out services) • Challenges and certifications for members • Recruiter / job match type service
akshatpradhan 11y ago
I'd like to throw a story into the privacy discussion. Do you know what a full content packet capture is? It’s when you’re able to grab every piece of data transmitted over a network using a tool called tcpdump. You can use another tool to reassemble those collected data packets into complete applications, movie or music files, even video chats and phone calls. Safari Books defines full content data as, “the most flexible form of network-based information. It is a rich form of evidence offering detail and opportunities seldom found elsewhere. Once full content data has been acquired, analysts can derive session, alert, and statistical data if necessary.” As a joke, an instructor once told me that when they went onsite to do security investigations, they would do a full content dump; if someone was downloading videos at the time, my instructor would say, “Thanks for the movie, guys!” This is what the Utah Data Center is doing. All packets are collected using a tool like tcpdump, and then the Center reassembles them and categorizes the content into data cubes (e.g., movies, video calls, emails) that are easily findable with open source search engines such as Lucene and Solr. Is this taking security seriously? You bet! When you ask a security professional what they recommend is the most reasonable approach to protecting sensitive health records, they will say, “Its all about Penetration Tests, Risk Assessments, and IDS.” Mass Traffic Collection is currently one example that’s being taken very seriously as an approach to security. If a hosting provider like Akamai — which, runs 30% of the world’s web traffic — is able to reassemble your packets, and even archive them, is that what you want security to be? Probably not, but when a security professional says “let’s take security seriously”, to them it means just watch all the things. That may sound a bit paranoid but check out this pretty spooky Hacking Team Commercial[1] where they specifically say, “Is passive monitoring enough? You want to look through your target’s eyes.” I remember in 2006, after my IDS training, I was all for collecting every single packet (no matter what) because I was taught as a security professional, that was the only way I could do my job: watch everything, since we need to know everything about anything. If you watch everything, that’s inherently security, and the world is protected. That was my modus operandi for many years. This is why taking privacy and security seriously really means taking compliance seriously. Compliance lassos in “watch everything” while also providing validation and proof of security. If we’re doing good hygiene (e.g. Key rotation, Log review, Code review, Change control, etc. ) in our forts, there’s no reason to collect and watch everything. If compliance fails as an approach to security, IDS could expand to a massive data collection agent running on every company in the world. The recipe to collect everything already exists but that means only security is being taken seriously. I hope we start to take compliance seriously because I think that is the intersection for good privacy and good security. [1] https://www.youtube.com/watch?v=R63CRBNLE2o https://www.youtube.com/watch?v=R63CRBNLE2o

deleted 11y ago

[deleted]