5 ms·

It seemed clear to me that the analogical "weapons" aren't the _tools_, they're the exploit that the hacker group discovered.

derefr 11y ago
Other similar analogies: • mining equipment: not dangerous :: enriched vein of uranium discovered using mining equipment : dangerous • chemistry equipment : not dangerous :: nerve gas, napalm, etc. : dangerous It's a strange situation where the equipment has a set of very legitimate uses, but once you allow it into people's hands, they now have complete unmonitored autonomy in how they use it, and might very well use it to bring about something dangerous with no-one the wiser. This is unlike most experience we have with dangerous tools. Cars, for example, can easily be used as weapons—but that danger only applies in public where others can observe you using the car, and your driver's license can be revoked. Similarly, a HAM operator could, on a whim, pollute the RF spectrum around them with noise—but that's also an action that by its very nature is observable, and so their broadcast device could be tracked down and shut down, and their operator certification revoked. But nobody sees you when you decide to mine for uranium, or produce chemical weapons, or develop software exploits. These aren't the tool being used as a weapon, being used to attack; these are instead cases of a tool being used to create a weapon, to create the potential for future violence, violence that—until it ever comes to pass—has no observable effects out on the world that will hint that this person is acting with malicious intent. It really seems like the law doesn't know what to do about that category of things, generally.
- wvh 11y ago
  [...] they now have complete unmonitored autonomy in how they use it [...] It really seems like the law doesn't know what to do about that category of things, generally. You can use a hammer to construct something, or to bash someone's skull. That's human nature, and freedom. To not have that choice would mean we have lost a lot more than we'd have gained. This moral ambivalence makes it (luckily) nearly impossible for any form of authority to make a definite statement or prevent usage. It ensures freedom. And sometimes bashing someone's skull might be the "positive" action, and using a hammer to construct a building the "negative" result, as when the building is used predominantly to harm people. One could use hacking tools to get around totalitarian governments or locked-down operating systems, or even to get into a former lover's device but at the same time prevent that exploit to be used anywhere else because of the bug's exposure. Even the "criminal" might be the good guy in the long run – morality is highly complex. IT security really ends up most often in ambivalent, shades of grey territory, and not in the clear black/white contrast preferred by many people and especially law- and policy-makers.
  - hueving 11y ago
    This discussion is about vulnerabilities, not tools like nmap, etc that can be used for other constructive purposes. Please explain how you think having an undisclosed vulnerability is useful to build something.
- AnthonyMouse 11y ago
  > enriched vein of uranium FWIW "enrich" in the context of uranium is the thing done by centrifuges. You don't get enriched uranium out of the ground. And Napalm is basically styrofoam and gasoline. You don't need much in the way of chemistry equipment to make it. > It really seems like the law doesn't know what to do about that category of things, generally. The main problem with the concept is that it doesn't end. A person with malicious intent can cause quite a lot of destruction with only the stuff everybody already has. There is no point in restricting chemistry equipment when people already have gasoline (or olive oil or lard or alcohol or ...) The only way to separate a person from the means to cause trouble is to eject them naked into the vacuum of space, and even then it's mostly because you can expect that to kill them.
  - spacecowboy_lon 11y ago
    Or Fertilizer and Diesel
wcummings 11y ago
There's little difference between knowledge of a vulnerability and a tool to exploit it.

derefr 11y ago

Other similar analogies: • mining equipment: not dangerous :: enriched vein of uranium discovered using mining equipment : dangerous • chemistry equipment : not dangerous :: nerve gas, napalm, etc. : dangerous It's a strange situation where the equipment has a set of very legitimate uses, but once you allow it into people's hands, they now have complete unmonitored autonomy in how they use it, and might very well use it to bring about something dangerous with no-one the wiser. This is unlike most experience we have with dangerous tools. Cars, for example, can easily be used as weapons—but that danger only applies in public where others can observe you using the car, and your driver's license can be revoked. Similarly, a HAM operator could, on a whim, pollute the RF spectrum around them with noise—but that's also an action that by its very nature is observable, and so their broadcast device could be tracked down and shut down, and their operator certification revoked. But nobody sees you when you decide to mine for uranium, or produce chemical weapons, or develop software exploits. These aren't the tool being used as a weapon, being used to attack; these are instead cases of a tool being used to create a weapon, to create the potential for future violence, violence that—until it ever comes to pass—has no observable effects out on the world that will hint that this person is acting with malicious intent. It really seems like the law doesn't know what to do about that category of things, generally.

wvh 11y ago
[...] they now have complete unmonitored autonomy in how they use it [...] It really seems like the law doesn't know what to do about that category of things, generally. You can use a hammer to construct something, or to bash someone's skull. That's human nature, and freedom. To not have that choice would mean we have lost a lot more than we'd have gained. This moral ambivalence makes it (luckily) nearly impossible for any form of authority to make a definite statement or prevent usage. It ensures freedom. And sometimes bashing someone's skull might be the "positive" action, and using a hammer to construct a building the "negative" result, as when the building is used predominantly to harm people. One could use hacking tools to get around totalitarian governments or locked-down operating systems, or even to get into a former lover's device but at the same time prevent that exploit to be used anywhere else because of the bug's exposure. Even the "criminal" might be the good guy in the long run – morality is highly complex. IT security really ends up most often in ambivalent, shades of grey territory, and not in the clear black/white contrast preferred by many people and especially law- and policy-makers.
- hueving 11y ago
  This discussion is about vulnerabilities, not tools like nmap, etc that can be used for other constructive purposes. Please explain how you think having an undisclosed vulnerability is useful to build something.
AnthonyMouse 11y ago
> enriched vein of uranium FWIW "enrich" in the context of uranium is the thing done by centrifuges. You don't get enriched uranium out of the ground. And Napalm is basically styrofoam and gasoline. You don't need much in the way of chemistry equipment to make it. > It really seems like the law doesn't know what to do about that category of things, generally. The main problem with the concept is that it doesn't end. A person with malicious intent can cause quite a lot of destruction with only the stuff everybody already has. There is no point in restricting chemistry equipment when people already have gasoline (or olive oil or lard or alcohol or ...) The only way to separate a person from the means to cause trouble is to eject them naked into the vacuum of space, and even then it's mostly because you can expect that to kill them.
- spacecowboy_lon 11y ago
  Or Fertilizer and Diesel

wcummings 11y ago

There's little difference between knowledge of a vulnerability and a tool to exploit it.