4 ms·

I'm not advocating. I am pointing out that user control is fundamentally anti-security. Bad security may very well be worth the tradeoff if you value other thin

by 794CD01 10y ago

I'm not advocating. I am pointing out that user control is fundamentally anti-security. Bad security may very well be worth the tradeoff if you value other things like freedom, fashion, backwards compatibility, fewer restarts, price, etc.

MereInterest 10y ago
User control is, by definition, security. The goal of security is to keep control in the hands of the owner. To remove control in the name of security is at best deceptive and self-defeating.
- Hondor 10y ago
  No. The user might use his control to make his computer less secure. Then it does't have security. And in real life, most user do exactly this when they have the option easily available. Most viruses spread through user control. Users choose to run programs which are viruses. Users choose to not upgrade their insecure software. Those are pretty much the main ways viruses spread.
  - hasdrubal 10y ago
    You start off by saying "The user might use his control to make his computer less secure" which is true. But just two sentences later you claim "users choose to not upgrade their insecure software" which is obviously false. They might but the might not. I could argue the same way and claim that removing user choice might make the computer less secure e.g. by forcing updates to an insecure version, installing backdoors etc. In the real world, this is exactly what happens. Therefore removing user control makes computers less secure. Now do you agree or do you think that my argument is deeply flawed?
hasdrubal 10y ago
I don't see how your argument works. You seem to be saying that user control automatically leads to less security which is obviously false. Maybe you are conflating groups with individuals. If an individual has control then by definition he can chose to be more secure or less secure by his actions e.g that individual may chose to perform updates asap and stay away from suspicious downloads. He can also chose to do the opposite of these things and be less secure but there is obviously no direct implication either way. But underlying this is a one-dimensional view of security, consider more complex scenarios where users are forced to use a single software to perform a task. If that software is insecure then 100% of users are vulnerable whereas if there are a diverse range of programs the users are more resilient to attacks.
- 794CD01 10y ago
  >You seem to be saying that user control automatically leads to less security which is obviously false. No. > If an individual has control then by definition he can chose to be more secure or less secure by his actions He can in theory, but he does not in reality. >He can also chose to do the opposite of these things and be less secure but there is obviously no direct implication either way. Again, reality shows us that the vast majority of users choose to be insecure. >But underlying this is a one-dimensional view of security, consider more complex scenarios where users are forced to use a single software to perform a task. If that software is insecure then 100% of users are vulnerable whereas if there are a diverse range of programs the users are more resilient to attacks. Correct, a diverse set of platforms would also be good for security. But that is a separate argument.
  - pdkl95 10y ago
    > the vast majority of users choose to be insecure. This is incorrect. The vast majority of users choose to use the things they purchase for the intended features. They usually make no choice whatsoever about security. Your posts in this thread have been trying to blame users for poor product design; if something is badly insecure when used for the intended features, then it is defective. This is where you probably want to assert that remote management is the solution, which takes control away from the user and allows defects to be fixed at a later time. You have asserted many times that allowing users to control their own devices is "less secure". This conclusion may be true in some cases, but it is simply incorrect most of the time. When you take control away from the user and give it to the manufacturer (or other remote location), you are creating a backdoor that the user cannot override. Adding a remote backdoor is weakening security for the user. If you want to argue this, you're going to have to explain why both the FBI and Apple were wrong in their recent conflict about pushing a broken OS to a certain iphone. Yes, users have very little knowledge about computer security. The solution to that is to educate them and make better products that don't need as much technical knowledge to use safely. Only then will security be improved. Your solution of handing over control to someone else is trying to keep users ignorant while lowering user security.
    - 10y ago
rwallace 10y ago
I'm not convinced that freedom and security are quite as opposed as some claim; centralized control has repeatedly been shown to create its own security problems. But supposing and to the extent that they are, I'll bite that bullet. If I have to trade away security for freedom, then I'm willing to do exactly that.

by 794CD01 10y ago

MereInterest 10y ago

User control is, by definition, security. The goal of security is to keep control in the hands of the owner. To remove control in the name of security is at best deceptive and self-defeating.

Hondor 10y ago
No. The user might use his control to make his computer less secure. Then it does't have security. And in real life, most user do exactly this when they have the option easily available. Most viruses spread through user control. Users choose to run programs which are viruses. Users choose to not upgrade their insecure software. Those are pretty much the main ways viruses spread.
- hasdrubal 10y ago
  You start off by saying "The user might use his control to make his computer less secure" which is true. But just two sentences later you claim "users choose to not upgrade their insecure software" which is obviously false. They might but the might not. I could argue the same way and claim that removing user choice might make the computer less secure e.g. by forcing updates to an insecure version, installing backdoors etc. In the real world, this is exactly what happens. Therefore removing user control makes computers less secure. Now do you agree or do you think that my argument is deeply flawed?

hasdrubal 10y ago

I don't see how your argument works. You seem to be saying that user control automatically leads to less security which is obviously false. Maybe you are conflating groups with individuals. If an individual has control then by definition he can chose to be more secure or less secure by his actions e.g that individual may chose to perform updates asap and stay away from suspicious downloads. He can also chose to do the opposite of these things and be less secure but there is obviously no direct implication either way. But underlying this is a one-dimensional view of security, consider more complex scenarios where users are forced to use a single software to perform a task. If that software is insecure then 100% of users are vulnerable whereas if there are a diverse range of programs the users are more resilient to attacks.

794CD01 10y ago
>You seem to be saying that user control automatically leads to less security which is obviously false. No. > If an individual has control then by definition he can chose to be more secure or less secure by his actions He can in theory, but he does not in reality. >He can also chose to do the opposite of these things and be less secure but there is obviously no direct implication either way. Again, reality shows us that the vast majority of users choose to be insecure. >But underlying this is a one-dimensional view of security, consider more complex scenarios where users are forced to use a single software to perform a task. If that software is insecure then 100% of users are vulnerable whereas if there are a diverse range of programs the users are more resilient to attacks. Correct, a diverse set of platforms would also be good for security. But that is a separate argument.
- pdkl95 10y ago
  > the vast majority of users choose to be insecure. This is incorrect. The vast majority of users choose to use the things they purchase for the intended features. They usually make no choice whatsoever about security. Your posts in this thread have been trying to blame users for poor product design; if something is badly insecure when used for the intended features, then it is defective. This is where you probably want to assert that remote management is the solution, which takes control away from the user and allows defects to be fixed at a later time. You have asserted many times that allowing users to control their own devices is "less secure". This conclusion may be true in some cases, but it is simply incorrect most of the time. When you take control away from the user and give it to the manufacturer (or other remote location), you are creating a backdoor that the user cannot override. Adding a remote backdoor is weakening security for the user. If you want to argue this, you're going to have to explain why both the FBI and Apple were wrong in their recent conflict about pushing a broken OS to a certain iphone. Yes, users have very little knowledge about computer security. The solution to that is to educate them and make better products that don't need as much technical knowledge to use safely. Only then will security be improved. Your solution of handing over control to someone else is trying to keep users ignorant while lowering user security.
  - 10y ago

rwallace 10y ago

I'm not convinced that freedom and security are quite as opposed as some claim; centralized control has repeatedly been shown to create its own security problems. But supposing and to the extent that they are, I'll bite that bullet. If I have to trade away security for freedom, then I'm willing to do exactly that.