6 ms·

EFF Pries More Information on Zero Days from the Government

124 points by tghw 11y ago

blakesterz 11y ago
I love the EFF and what they do but I always feel like their writing style is so often... I'm not sure how to put it... just kind of over the top? e.g. first paragraph, "the charade is over" ... third "this too doesn’t exactly come as a shocker." So much of what they write about is really important but I can't help but think the writing is often maybe too hyperbolic and turns off people that should be following these things closer.
- pc86 11y ago
  How much of the organization's funding is based on donations? That may be part of why most articles have this Chicken Little "the end is near" type of theme to them.
  - rm_-rf_slash 11y ago
    Agreed. While I find the EFF's general tone to be a bit too hyperbolic (something about their mission and site design makes me think their writing would be better served by a level-headed style akin to a BBC article), at the end of the day I am grateful for the work that they do and if they have to be a little melodramatic to spur donations, then so be it.
    - twoodfin 11y ago
      If serious people stop taking them seriously because of a propensity for melodrama and chicken-little-ism, that's going to make their work harder, not easier.
      - tptacek 11y ago
        This is a real problem, but on balance serious people seem to take EFF pretty seriously. It's a much bigger problem for Fight For The Future, which seems to be fueled entirely by melodrama. Part of the reason, I think, is that EFF has much better on-staff technical (in the conventional sense and the legal sense) expertise than FFTF does. EFF does get really dodgy in their pure advocacy pieces (these are the "Your Rights Online" stories where EFF doesn't have much to do with the story). They're better in stories where they have a direct role.
      - Kalium 11y ago
        I think this problem was illustrated for us all neatly by Wikileaks. When they released documents with no drama and no fanfare... nobody cared and they struggled to keep the material up. Once they played up the drama, everything changed.
      - pc86 11y ago
        It is certainly a very fine line to have little enough showmanship that the people already interested just ignore it, but enough that new people become interested/concerned.
- zitterbewegung 11y ago
  Putting the hyperbole in not only makes people click on it but it makes people be more swayed not only by reason but also by feeling . Sharing the article probably makes a significant people Donate to the organization. Disclaimer : I am an EFF member.
  - dhimes 11y ago
    I suspect they A/B tested it and went with what works.
  - mikeash 11y ago
    It sways people away because of feelings, too. I admire what the EFF does but I always have a hard time taking them seriously because of this. Also, at some point, I think integrity demands reasonable language even if hyperbole is effective. It ends up being a variation on clickbait.
  - JumpCrisscross 11y ago
    I respect their opinions, but similarly can't make it past a few paragraphs of their PR pieces. A valuable membership benefit, for me, would be a level-headed newsletter re-writing their PR wires.
- carc 11y ago
  I've always felt the exact same way. I can rarely get through anything they send me because my natural reaction is to trust what I'm reading LESS when the writing is in that tone.
- govuicuh 11y ago
  What weak bulkshitty criticism. The US government tortures innocents, bombs hospitals, and engages in genocide, and here you're nitpicking over some choice words. Get some perspective.
  - happyscrappy 11y ago
    Too bad the rest of the world is gutless weasels.
- TazeTSchnitzel 11y ago
  I'm not sure if it's the right word, but EFF's stuff reeks of... triumphalism? Even the tiniest improvement is always hailed as this massive victory. In fairness, this is something many political groups are prone to.
- JamesSwift 11y ago
  As a peripheral observer, I do find myself discounting a lot of what I read from them exactly because of this.
Animats 11y ago
This changes what "responsible disclosure" of security bugs means. It's no longer appropriate to report security bugs just to the vendor and CERT. They must be disclosed publicly to prevent them from being misused by government. It's now irresponsible to delay disclosure.
- fweespeech 11y ago
  Giving the vendor (60 days) to fix it is reasonable.
  - riskable 11y ago
    The "reasonableness" behind the length of time before public disclosure of vulnerabilities is not based on how long the vendor will take to fix it. It is based on the likelihood that someone else will discover the vulnerability (if not already!) and exploit it. We must operate under the assumption that if "a good guy" has discovered a vulnerability in a product then "a bad guy" will also find it before long. That "before long" part is really just an assumption based on the best-case scenario: No one else has discovered the vulnerability yet. Even if the vendor has no fix available disclosure is still of the utmost importance because it gives the public at large a fighting chance at remediating the problem; whether the vendor is ready or not! Example: If a critical vulnerability is discovered in Nginx and the developers can't put out a release any time soon I can always switch to Apache or some other web server. How "entrenched" or "locked in" you are with a product is neither here nor there. That's your own damned fault if you can't swap it out with something else. Especially if you knew you were locked in ahead of time and have yet to do anything about it.
    - Animats 11y ago
      "We must operate under the assumption that if "a good guy" has discovered a vulnerability in a product then "a bad guy" will also find it before long." Today, we have to operate under the assumption that if a good guy has discovered a vulnerability, a bad guy is probably already exploiting it.
  - 11y ago

124 points by tghw 11y ago

I love the EFF and what they do but I always feel like their writing style is so often... I'm not sure how to put it... just kind of over the top? e.g. first paragraph, "the charade is over" ... third "this too doesn’t exactly come as a shocker." So much of what they write about is really important but I can't help but think the writing is often maybe too hyperbolic and turns off people that should be following these things closer.

pc86 11y ago
How much of the organization's funding is based on donations? That may be part of why most articles have this Chicken Little "the end is near" type of theme to them.
- rm_-rf_slash 11y ago
  Agreed. While I find the EFF's general tone to be a bit too hyperbolic (something about their mission and site design makes me think their writing would be better served by a level-headed style akin to a BBC article), at the end of the day I am grateful for the work that they do and if they have to be a little melodramatic to spur donations, then so be it.
  - twoodfin 11y ago
    If serious people stop taking them seriously because of a propensity for melodrama and chicken-little-ism, that's going to make their work harder, not easier.
    - tptacek 11y ago
      This is a real problem, but on balance serious people seem to take EFF pretty seriously. It's a much bigger problem for Fight For The Future, which seems to be fueled entirely by melodrama. Part of the reason, I think, is that EFF has much better on-staff technical (in the conventional sense and the legal sense) expertise than FFTF does. EFF does get really dodgy in their pure advocacy pieces (these are the "Your Rights Online" stories where EFF doesn't have much to do with the story). They're better in stories where they have a direct role.
    - Kalium 11y ago
      I think this problem was illustrated for us all neatly by Wikileaks. When they released documents with no drama and no fanfare... nobody cared and they struggled to keep the material up. Once they played up the drama, everything changed.
    - pc86 11y ago
      It is certainly a very fine line to have little enough showmanship that the people already interested just ignore it, but enough that new people become interested/concerned.
zitterbewegung 11y ago
Putting the hyperbole in not only makes people click on it but it makes people be more swayed not only by reason but also by feeling . Sharing the article probably makes a significant people Donate to the organization. Disclaimer : I am an EFF member.
- dhimes 11y ago
  I suspect they A/B tested it and went with what works.
- mikeash 11y ago
  It sways people away because of feelings, too. I admire what the EFF does but I always have a hard time taking them seriously because of this. Also, at some point, I think integrity demands reasonable language even if hyperbole is effective. It ends up being a variation on clickbait.
- JumpCrisscross 11y ago
  I respect their opinions, but similarly can't make it past a few paragraphs of their PR pieces. A valuable membership benefit, for me, would be a level-headed newsletter re-writing their PR wires.
carc 11y ago
I've always felt the exact same way. I can rarely get through anything they send me because my natural reaction is to trust what I'm reading LESS when the writing is in that tone.
govuicuh 11y ago
What weak bulkshitty criticism. The US government tortures innocents, bombs hospitals, and engages in genocide, and here you're nitpicking over some choice words. Get some perspective.
- happyscrappy 11y ago
  Too bad the rest of the world is gutless weasels.
TazeTSchnitzel 11y ago
I'm not sure if it's the right word, but EFF's stuff reeks of... triumphalism? Even the tiniest improvement is always hailed as this massive victory. In fairness, this is something many political groups are prone to.
JamesSwift 11y ago
As a peripheral observer, I do find myself discounting a lot of what I read from them exactly because of this.

Animats 11y ago

This changes what "responsible disclosure" of security bugs means. It's no longer appropriate to report security bugs just to the vendor and CERT. They must be disclosed publicly to prevent them from being misused by government. It's now irresponsible to delay disclosure.

fweespeech 11y ago
Giving the vendor (60 days) to fix it is reasonable.
- riskable 11y ago
  The "reasonableness" behind the length of time before public disclosure of vulnerabilities is not based on how long the vendor will take to fix it. It is based on the likelihood that someone else will discover the vulnerability (if not already!) and exploit it. We must operate under the assumption that if "a good guy" has discovered a vulnerability in a product then "a bad guy" will also find it before long. That "before long" part is really just an assumption based on the best-case scenario: No one else has discovered the vulnerability yet. Even if the vendor has no fix available disclosure is still of the utmost importance because it gives the public at large a fighting chance at remediating the problem; whether the vendor is ready or not! Example: If a critical vulnerability is discovered in Nginx and the developers can't put out a release any time soon I can always switch to Apache or some other web server. How "entrenched" or "locked in" you are with a product is neither here nor there. That's your own damned fault if you can't swap it out with something else. Especially if you knew you were locked in ahead of time and have yet to do anything about it.
  - Animats 11y ago
    "We must operate under the assumption that if "a good guy" has discovered a vulnerability in a product then "a bad guy" will also find it before long." Today, we have to operate under the assumption that if a good guy has discovered a vulnerability, a bad guy is probably already exploiting it.
- 11y ago