4 ms·

As an "expert" in another area that has been invoked a few times in this thread, biology (WRT the vaccine analogy), I do sympathize with the position of tptacek

by xaa 10y ago

As an "expert" in another area that has been invoked a few times in this thread, biology (WRT the vaccine analogy), I do sympathize with the position of tptacek and others. It is so very tempting to think that we experts not only know the facts better than the public, which we usually do, but that we also know what's best for the public. But I fear that withholding valid but easily misinterpretable information from the public is a dangerous road to go down. It puts us in the position of making choices for people. You can see how, if we start withholding information from the public because we feel they are too ignorant to handle it, it creates a bit of a self-fulfilling prophecy. 2017 is really not a very good time for experts in any field to be telling others to do things "because we say so" or to ask that information be withheld because we know what's best for people. For better and worse, people are increasingly distrusting expertise and, as a consequence, (trying to) think for themselves. This can be a good thing if we let go of a little ego. On the other hand, our remaining credibility is fragile, and we need to spend it wisely. It also does create the appearance of hypocrisy, although not necessarily the reality, when security researchers are in favor of full and public disclosure in some cases but not others.

idlewords 10y ago
Nobody is talking about withholding information. What we're talking about is framing a story about a fairly subtle point of security UI design in a way that doesn't panic people into moving from a secure messenger to SMS, which is actually happening and which is a terrible outcome. Ancillary to that, imagine a major story about vaccine risk that didn't talk to any doctors. That's what the Guardian did here.
- xaa 10y ago
  > Nobody is talking about withholding information. A request for retraction is very close to a request to do just this. I will explain more below, though. > major story about vaccine risk that didn't talk to any doctors I think this analogy is not quite right. In a story about vaccine risk, you'd maybe talk to one epidemiologist, one immunologist, one pharmacologist, etc. In this story, they have done something similar: Boelter as the expert (yes, only a PhD student, not optimal to be sure) on the technical aspects of the vulnerability, and several others commenting on the broader social and privacy implications. And this is very important because the letter writers and the EFF admit, when pressed, that it is indeed a vulnerability, or threat, or what-have-you. They would prefer the framing of "UX tradeoff", but that is because their core criticism here is seemingly not about anything technical, it's the fear, as you have said and which I do not deny is legitimate, that people will use this information the wrong way. It is this point I was responding to. If the authors of the open letter do not have valid technical concerns (other than "backdoor", which was edited), their work is done, both on the philosophical grounds I listed above, and on the practical grounds that experts do not get to dictate tone, implications, or framing to journalists. The oddest thing about it all is that the researchers seem to even agree with the Guardian that Signal is more secure. So to recap, the technical aspects of the vulnerability are not disputed, and even the recommendation of using product X over Y if you care about security is not disputed. It is the fear that people will use product Z, which the Guardian did not even mention, instead of Y that is the problem! It is based on these facts plus the call for a retraction that I have concluded that the security researchers in this case are trying to withhold, or at least control, the flow of information to the public based purely on the (justified) fear that some of the public will react incorrectly. Just imagine how the conversation between the Guardian and the US and UK governments must have gone during the Snowden revelations. I am sure they were bombarded with many consequentialist arguments about why publishing them have all kinds of bad effects. But the role of journalists isn't to decide what's good or bad, or how people should use what they publish, it's simply to publish factual information. The only grounds for retraction should be factual inaccuracy.
- xaa 10y ago
  Also, another reason the vaccine analogy fails is that this situation is being likened to the Guardian overemphasizing the risks of vaccines on the assumption that the only choices are "vaccine" or "no vaccine". But the story is really more like "Complications associated with Vaccine A" when several alternative vaccines without those risks exist.

by xaa 10y ago

idlewords 10y ago

Nobody is talking about withholding information. What we're talking about is framing a story about a fairly subtle point of security UI design in a way that doesn't panic people into moving from a secure messenger to SMS, which is actually happening and which is a terrible outcome. Ancillary to that, imagine a major story about vaccine risk that didn't talk to any doctors. That's what the Guardian did here.

xaa 10y ago
> Nobody is talking about withholding information. A request for retraction is very close to a request to do just this. I will explain more below, though. > major story about vaccine risk that didn't talk to any doctors I think this analogy is not quite right. In a story about vaccine risk, you'd maybe talk to one epidemiologist, one immunologist, one pharmacologist, etc. In this story, they have done something similar: Boelter as the expert (yes, only a PhD student, not optimal to be sure) on the technical aspects of the vulnerability, and several others commenting on the broader social and privacy implications. And this is very important because the letter writers and the EFF admit, when pressed, that it is indeed a vulnerability, or threat, or what-have-you. They would prefer the framing of "UX tradeoff", but that is because their core criticism here is seemingly not about anything technical, it's the fear, as you have said and which I do not deny is legitimate, that people will use this information the wrong way. It is this point I was responding to. If the authors of the open letter do not have valid technical concerns (other than "backdoor", which was edited), their work is done, both on the philosophical grounds I listed above, and on the practical grounds that experts do not get to dictate tone, implications, or framing to journalists. The oddest thing about it all is that the researchers seem to even agree with the Guardian that Signal is more secure. So to recap, the technical aspects of the vulnerability are not disputed, and even the recommendation of using product X over Y if you care about security is not disputed. It is the fear that people will use product Z, which the Guardian did not even mention, instead of Y that is the problem! It is based on these facts plus the call for a retraction that I have concluded that the security researchers in this case are trying to withhold, or at least control, the flow of information to the public based purely on the (justified) fear that some of the public will react incorrectly. Just imagine how the conversation between the Guardian and the US and UK governments must have gone during the Snowden revelations. I am sure they were bombarded with many consequentialist arguments about why publishing them have all kinds of bad effects. But the role of journalists isn't to decide what's good or bad, or how people should use what they publish, it's simply to publish factual information. The only grounds for retraction should be factual inaccuracy.
xaa 10y ago
Also, another reason the vaccine analogy fails is that this situation is being likened to the Guardian overemphasizing the risks of vaccines on the assumption that the only choices are "vaccine" or "no vaccine". But the story is really more like "Complications associated with Vaccine A" when several alternative vaccines without those risks exist.