4 ms·

This strikes me as one of the most poorly understood aspects of software/computing. Breaking into a computer system is like criticizing someone's ideas, not br

by brhsiao 10y ago

This strikes me as one of the most poorly understood aspects of software/computing. Breaking into a computer system is like criticizing someone's ideas, not breaking into a house. Since anyone can trivially break into a house, we judge people by their intent, and thus authorities are trained to wonder "why was he doing that at all?" Whereas with computers malice is taken for granted and security has to be by design. Most people understand that criticism does you a favor. Maybe we should explain that security systems are like public debates, and that successful hackers just happened to say something first.

zyxley 10y ago
I feel like a better analogy, especially in this case, would be "it's not breaking into the house, it's looking in the window". Non-technical people would generally understand the equivalent of, say, a business leaving a stack of personal files next to a sidewalk window and someone calling up the news to say "this could lead to identity theft!".
- mcbits 10y ago
  From what little is described of this "hack", it does sound akin to looking in a window that nobody noticed was open. In general, uninvited pentesting is more like going around and checking doorknobs to see if they're locked. Not sure if that's illegal (in Slovenia no less), but I can't blame someone for feeling really uptight about it.
eshyong 10y ago
How does this analogy make sense? It's totally possible for someone to steal valuable data from a computer system, even personal information. There may not have been any sensitive information in this case, but to suggest that breaking a security system is a "public debate" seems wrong.
- brhsiao 10y ago
  I mean the underlying conceptual security system, not the data it protects. Crowdsourced security audits are similar to everyone telling you in public debates why you're wrong.
  - eshyong 10y ago
    Ah ok, sure. Thanks for clarifying.
qb45 10y ago
Maybe now that he has been sentenced and everything seems settled, he should talk to some lawyers or NGOs and have them sued for negligence. Two years of not giving a damn is unacceptable.
Bluestrike2 10y ago
Part of the problem is the over-reliance on metaphor. They're flawed, and often confuse people. The suggestion of people walking into houses, or sticking their hands through open windows (or even just peering through them), tends to unsettle people. It brings to mind trespassing and countless episodes of Law & Order that start off with rape and murder. So why are we willingly choosing to discuss encryption, networking, and security research/disclosure through analogies that set people on edge from the very beginning? We lose the listener immediately. And probably poison the well, too.
ArkyBeagle 10y ago
I think it might be more like breaking into a house than you think. The reason is that there's no way to verify your intent. This leaves 'em free to make up one of their choosing. "Security by design" seems to imply "oh, this is just a game." Nope. If you now require all people to be part of an electronics security arms race, this is a problem. It may well be that there should be a mechanism for the police to refer such a kid to others in e. security to enculturate him or get him a network to be part of.
- mSparks 10y ago
  no, its not like breaking into anything. Its more like walking past your neighbors house and finding the person who is supposed to be looking after it has left all the windows and doors open and a shopping list of things to steal pinned to the wall. Then when your friend doesn't do anything about it. Telling your other friends what an idiot he is. The reason telling people they are insecure has been criminalised is the security agencies are the ones doing all the stealing.
  - andai 10y ago
    That last part, what?
    - mSparks 10y ago
      It's a simple posit. The security agencies (generally) don't breach systems to protect you from physical harm. They breach systems to steal the intellectual property of anyone and everyone for use by the elites that provide their funding. So we've had three decades of systems security being cast as a dirty word only criminals care about.
  - ArkyBeagle 10y ago
    Thanks for trying to explain it. Are you familiar with "window peeping"? It's sort of a tort.

by brhsiao 10y ago

zyxley 10y ago

I feel like a better analogy, especially in this case, would be "it's not breaking into the house, it's looking in the window". Non-technical people would generally understand the equivalent of, say, a business leaving a stack of personal files next to a sidewalk window and someone calling up the news to say "this could lead to identity theft!".

mcbits 10y ago
From what little is described of this "hack", it does sound akin to looking in a window that nobody noticed was open. In general, uninvited pentesting is more like going around and checking doorknobs to see if they're locked. Not sure if that's illegal (in Slovenia no less), but I can't blame someone for feeling really uptight about it.

eshyong 10y ago

How does this analogy make sense? It's totally possible for someone to steal valuable data from a computer system, even personal information. There may not have been any sensitive information in this case, but to suggest that breaking a security system is a "public debate" seems wrong.

brhsiao 10y ago
I mean the underlying conceptual security system, not the data it protects. Crowdsourced security audits are similar to everyone telling you in public debates why you're wrong.
- eshyong 10y ago
  Ah ok, sure. Thanks for clarifying.

qb45 10y ago

Maybe now that he has been sentenced and everything seems settled, he should talk to some lawyers or NGOs and have them sued for negligence. Two years of not giving a damn is unacceptable.

Bluestrike2 10y ago

Part of the problem is the over-reliance on metaphor. They're flawed, and often confuse people. The suggestion of people walking into houses, or sticking their hands through open windows (or even just peering through them), tends to unsettle people. It brings to mind trespassing and countless episodes of Law & Order that start off with rape and murder. So why are we willingly choosing to discuss encryption, networking, and security research/disclosure through analogies that set people on edge from the very beginning? We lose the listener immediately. And probably poison the well, too.

ArkyBeagle 10y ago

I think it might be more like breaking into a house than you think. The reason is that there's no way to verify your intent. This leaves 'em free to make up one of their choosing. "Security by design" seems to imply "oh, this is just a game." Nope. If you now require all people to be part of an electronics security arms race, this is a problem. It may well be that there should be a mechanism for the police to refer such a kid to others in e. security to enculturate him or get him a network to be part of.

mSparks 10y ago
no, its not like breaking into anything. Its more like walking past your neighbors house and finding the person who is supposed to be looking after it has left all the windows and doors open and a shopping list of things to steal pinned to the wall. Then when your friend doesn't do anything about it. Telling your other friends what an idiot he is. The reason telling people they are insecure has been criminalised is the security agencies are the ones doing all the stealing.
- andai 10y ago
  That last part, what?
  - mSparks 10y ago
    It's a simple posit. The security agencies (generally) don't breach systems to protect you from physical harm. They breach systems to steal the intellectual property of anyone and everyone for use by the elites that provide their funding. So we've had three decades of systems security being cast as a dirty word only criminals care about.
- ArkyBeagle 10y ago
  Thanks for trying to explain it. Are you familiar with "window peeping"? It's sort of a tort.