6 ms·

Trying to think of a real world analogy - let's say your car was compromised and hackers were using it when it was idle to launch attacks, or make money. Would

Trying to think of a real world analogy - let's say your car was compromised and hackers were using it when it was idle to launch attacks, or make money. Would I be mad if someone entered my car and turned on/activated the locks?

hugozap 11y ago
There must be better analogies.
- dogma1138 11y ago
  "Canadian man breaks into home, cooks meals, does laundry, writes in owner’s diary"? http://www.nydailynews.com/news/crime/canadian-man-breaks-home-feeds-animals-laundry-article-1.2385010 http://www.nydailynews.com/news/crime/canadian-man-breaks-ho...
- ef4 11y ago
  You see someone tie their boat to a dock and walk away. Then you notice that their knot is terrible, and the boat is about to drift off, so you untie it and re-tie it for them.
  - josefresco 11y ago
    Meh. People aren't losing their routers completely, they're just being used without their knowledge or permission. Maybe if you noticed that local kids were hosting parties on the boat and you closed the gate so they could not longer enter?
    - dogma1138 11y ago
      Closing a gate isn't really a violation of privacy, if we use the boat analogy it would be more like you've noticed that some thief's are about to steal the boat so you sail it out yourself. This is still quite a big violation of privacy, even if was done for good reasons. It's like some one notices that your window is open so they pick the lock on you front door and enter your home to close it.
      - AnimalMuppet 11y ago
        > It's like some one notices that your window is open so they pick the lock on you front door and enter your home to close it. Beautifully put. And they justify doing it because of the danger of someone breaking and entering. But someone might have broken and entered, and they definitely did, so the justification sounds very hollow.
CorpOverreach 11y ago
Assuming everything went as planned, no problem. But to play devil's advocate... The risk with these things is always the "what if?". What if during that patch it bricked my device due to some fluke? What if I had a special customization that relied on a specific behavior on the component that was just updated without my consent? What if that patch attempt to a vehicle fails, leaving it unable to turn on? What if that vehicle was an ambulance?
- anon4 11y ago
  I think their answer would be "the needs of the many outweigh the needs of the few"... And to flip that argument again - would you prefer your device to be bricked by someone trying to run a webserver serving child pornography, or by someone trying to protect you from the first?
  - ethbro 11y ago
    Aka the "yelling 'Fire!' in a crowded movie theater is not free speech" exception. It's good for the guy who wants to yell "Fire", but is it good for the majority? If you patch routers and 1% get bricked by some fluke, is that not a win for society? Also, to rebut the "How dare you change the firmware on my router without my consent?!" point, let's not forget these were essentially unprotected routers at this point in the applied_patch vs known_vulnerability cycle. If you don't want anyone patching your router without your permission... SECURE YOUR OWN PROPERTY. If I leave something on the sidewalk, I don't get angry when people cart it off / step on it. I especially don't get angry when they glue the broken bits back together and leave it on my doorstep with a note saying "We noticed this was broken. Superglue works wonders! Here's the number for a hardware store where you can buy it."
- logfromblammo 11y ago
  What if someone could do any of those things intentionally and maliciously, instead of merely by accident? If the vehicle is an ambulance, a well-intentioned intruder could break it at any time, whereas a malicious one could break it at the worst possible time. While either one could cause a disaster while carrying a trauma patient at full speed on the highway, the accidental damage might also occur while motionless and empty in a parking lot. If grey-hats can patch a vulnerability against your will, it is very likely that they first tried disclosing the vulnerability to the manufacturer of your device, and they declined to fix it within a reasonable time, or you didn't run that update. Either way, whatever damage done to the device as a result of exploiting vulnerability would not have occurred if the vulnerability had already been repaired.
noonespecial 11y ago
A good analogy? It's batman. We're debating web batman. Cool.
navait 11y ago
Do we really need an analogy? What will it teach us that we can't conceive of now? There are benefits to someone doing this, and risks and costs to it, if benefit > (risk)(damage), it's good. If not, it's bad. Analogies just over-abstract the issue.
- dvanduzer 11y ago
  Laws / moral codes are always abstractions. They have to be. It's useless to create a new rule that says "Hammurabi wasn't allowed to murder Gilgamesh last Tuesday." But there has always been a tension between the utilitarian criteria you're using, and the absolutist* criteria that others use when evaluating the morality of a decision. In practice, the most effective systems seem to strike a balance. Something like: "First, do no harm. Everything else is details. And the details matter, and the details need to be regularly debated, and the debate itself is an important part of the process." Abstract examples like the trolley problem don't teach us things that we can't conceive of. They can help us boil down and isolate specific aspects of absolutist thinking and determine if we're better off with the statistical approach to deciding if an action is good or bad. * Technically referred to as deontological ethics, but dang, software engineers ain't got nothing on philosophers when it comes to oblique terminology.

hugozap 11y ago

There must be better analogies.

dogma1138 11y ago
"Canadian man breaks into home, cooks meals, does laundry, writes in owner’s diary"? http://www.nydailynews.com/news/crime/canadian-man-breaks-home-feeds-animals-laundry-article-1.2385010 http://www.nydailynews.com/news/crime/canadian-man-breaks-ho...
ef4 11y ago
You see someone tie their boat to a dock and walk away. Then you notice that their knot is terrible, and the boat is about to drift off, so you untie it and re-tie it for them.
- josefresco 11y ago
  Meh. People aren't losing their routers completely, they're just being used without their knowledge or permission. Maybe if you noticed that local kids were hosting parties on the boat and you closed the gate so they could not longer enter?
  - dogma1138 11y ago
    Closing a gate isn't really a violation of privacy, if we use the boat analogy it would be more like you've noticed that some thief's are about to steal the boat so you sail it out yourself. This is still quite a big violation of privacy, even if was done for good reasons. It's like some one notices that your window is open so they pick the lock on you front door and enter your home to close it.
    - AnimalMuppet 11y ago
      > It's like some one notices that your window is open so they pick the lock on you front door and enter your home to close it. Beautifully put. And they justify doing it because of the danger of someone breaking and entering. But someone might have broken and entered, and they definitely did, so the justification sounds very hollow.

CorpOverreach 11y ago

Assuming everything went as planned, no problem. But to play devil's advocate... The risk with these things is always the "what if?". What if during that patch it bricked my device due to some fluke? What if I had a special customization that relied on a specific behavior on the component that was just updated without my consent? What if that patch attempt to a vehicle fails, leaving it unable to turn on? What if that vehicle was an ambulance?

anon4 11y ago
I think their answer would be "the needs of the many outweigh the needs of the few"... And to flip that argument again - would you prefer your device to be bricked by someone trying to run a webserver serving child pornography, or by someone trying to protect you from the first?
- ethbro 11y ago
  Aka the "yelling 'Fire!' in a crowded movie theater is not free speech" exception. It's good for the guy who wants to yell "Fire", but is it good for the majority? If you patch routers and 1% get bricked by some fluke, is that not a win for society? Also, to rebut the "How dare you change the firmware on my router without my consent?!" point, let's not forget these were essentially unprotected routers at this point in the applied_patch vs known_vulnerability cycle. If you don't want anyone patching your router without your permission... SECURE YOUR OWN PROPERTY. If I leave something on the sidewalk, I don't get angry when people cart it off / step on it. I especially don't get angry when they glue the broken bits back together and leave it on my doorstep with a note saying "We noticed this was broken. Superglue works wonders! Here's the number for a hardware store where you can buy it."
logfromblammo 11y ago
What if someone could do any of those things intentionally and maliciously, instead of merely by accident? If the vehicle is an ambulance, a well-intentioned intruder could break it at any time, whereas a malicious one could break it at the worst possible time. While either one could cause a disaster while carrying a trauma patient at full speed on the highway, the accidental damage might also occur while motionless and empty in a parking lot. If grey-hats can patch a vulnerability against your will, it is very likely that they first tried disclosing the vulnerability to the manufacturer of your device, and they declined to fix it within a reasonable time, or you didn't run that update. Either way, whatever damage done to the device as a result of exploiting vulnerability would not have occurred if the vulnerability had already been repaired.

noonespecial 11y ago

A good analogy? It's batman. We're debating web batman. Cool.

navait 11y ago

Do we really need an analogy? What will it teach us that we can't conceive of now? There are benefits to someone doing this, and risks and costs to it, if benefit > (risk)(damage), it's good. If not, it's bad. Analogies just over-abstract the issue.

dvanduzer 11y ago
Laws / moral codes are always abstractions. They have to be. It's useless to create a new rule that says "Hammurabi wasn't allowed to murder Gilgamesh last Tuesday." But there has always been a tension between the utilitarian criteria you're using, and the absolutist* criteria that others use when evaluating the morality of a decision. In practice, the most effective systems seem to strike a balance. Something like: "First, do no harm. Everything else is details. And the details matter, and the details need to be regularly debated, and the debate itself is an important part of the process." Abstract examples like the trolley problem don't teach us things that we can't conceive of. They can help us boil down and isolate specific aspects of absolutist thinking and determine if we're better off with the statistical approach to deciding if an action is good or bad. * Technically referred to as deontological ethics, but dang, software engineers ain't got nothing on philosophers when it comes to oblique terminology.