12 ms·

A Solution to Hackers? More Hackers

61 points by bipr0 9y ago

ditonal 9y ago
Step 1 would be to pardon Snowden. He was whistleblowing on an illegal and dangerous program that directly threatened our democracy and took steps to totalitarianism. But instead of honoring that, Obama and his DoJ instead go to SXSW and give insulting, condescending talks about how we should stop working on "cat apps" and come be a drone for Uncle Sam. Why? So you can demand all our expertise but trust none of our judgement? So you can underpay us, give us no voice at the table, but then insult our intelligence by acting like serving these crooks is some noble cause? Lawyers run the country, Congress is all lawyers and no engineers. But then they run into problems related to technology and they say "bring in the nerds". Well, the word you're looking for is experts, and they're in the West Coast making way more money and building real technology instead of bureaucratic bullshit and illegal authoritarian tools of oppression. And maybe smoking recreational marijuana without having to bullshit their way through some bogus polygraph (not that those even work). I can't imagine anyone but the most naive would work for the NSA, FBI, or CIA if they had any other options.
- microcolonel 9y ago
  > Lawyers run the country, Congress is all lawyers and no engineers. “In my years I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress.” — John Adams It's simply a matter of scale. Because the government has accrued so many powers beyond the founding intent, it has become attractive to buy it. As people buy it, the government invests in more powers to keep the gravy going. As long as they do it gradually enough, and make it seem like they have a moral imperative to spend your money because they know better, the state will continue to grow. More power, more corruption; more corruption, more power — until it all becomes too much. If Edward Snowden could offer the government more power to attract more relationship investment from business, then he would have been pardoned in Barack Obama's tenure.
- logfromblammo 9y ago
  As I have said before, I can deal with almost anything if you pay me enough. But they don't pay anyone enough to deal with unlimited bullshit. And that's what you get when your boss's boss has no idea what you do or how you do it, and whenever he does the manager's power walk, it looks like you're just sitting there, doing nothing. The polygraph machine is a psychological trick. The actual lie detector is the operator, just like in Meet the Parents, and the ritual and setting is intended to intimidate you, belittle you, and make you stressed enough for the human to get a read on your reactions. The test isn't entirely bullshit, but the machine sure is, and I sure wish they'd find a better way to do it without all the gratuitous bullying and humiliation. And since the detectors are human, there's no way to guarantee consistency across tests w.r.t. false positives and false negatives.
- Inconel 9y ago
  Regarding polygraphs, I've heard form a friend who gets administered them routinely, that they are actually fairly effective. By effective I don't mean that they can tell if a person is lying, the science behind them is as far as I know completely bogus, but in the hands of a skilled interrogator they can be very effective at convincing otherwise rational people to admit all shorts of things to the government that they shouldn't, and more importantly, that the government would otherwise have absolutely no way of finding out.
  - sugersvoltet 9y ago
    I don't really understand why people have an issue with polygraphs. They're pretty effective for the sole task they're designed for. As long as people don't try to involve them in legal cases (or otherwise use them as a genuine barometer for honesty), what's the problem?
    - dgfgfdagasdfgfa 9y ago
      Well, they create a culture of distrust, and when crossed with issues like drug use which may not be relevant to work concerns, it's going to scare high-value prospective employees.
      - sugersvoltet 9y ago
        Some kinds of organizations require some level of distrust in their culture. And the issue seems to really lie with how the employer handles past drug use. My understanding is many organizations, including some government agencies, tend to be fairly lenient about admitted past drug use (depending on many factors like how long ago it was and the kind of drug). I think in an ideal world, questions about past use would never be asked and drug tests would be strictly limited to determining if someone is high/drunk on the job. The fundamental problem is employers losing potentially valuable employees due to their unnecessary and invasive drug policies. The polygraph isn't to blame.
        drunkenmonkey 9y ago
- kbenson 9y ago
  > Congress is all lawyers and no engineers. Well, congress is largely responsible for crafting, reviewing, and changing legislation, which is laws, so being a lawyer probably makes a lot of sense. Let's not pretend engineers are incapable of making mistakes, or not fully considering the implications of an action and having to review and fix it later. Engineers are largely kept from making too many mistakes by having evolved a strict set of guidelines to and regulations to adhere to. Many of those same regulations that keep engineers in check were put in place by lawyers.
  - otempomores 9y ago
    Eh, no? That is what the advisory apparatus, the library and the slowness is for.. So none ecperts could read up. They became on the fly Domain Experts. That is what lobbyism was.. Influencing the Research of ready made experts. The reason lawyers dominate today is neither skill or Expertise.. just caste.
microcolonel 9y ago
If only they'd realize the same thing in regard to gun ownership.
- devrandomguy 9y ago
  Gun control is a completely different kettle of fish, because it is so unlikely for someone to recover from an attack; these aren't beanbag shotguns we're talking about. Also, there are no procedures that you can follow to prevent an unexpected bullet from quickly killing you, whereas with, say, an unexpected DoS, you can take measures to mitigate it after it has already started to hit you. With a security breach, you can lock down, wipe and recover from backups. But that bullet, it is just so uniquely final (and therefore, off topic, hence the downvotes).
  - microcolonel 9y ago
    The National Research Council conducted a thorough review of evidence some years ago and found no correlation between the introduction of gun control measures and reduction in violent crime. In certain jurisdictions, there is a negative correlation (probably unethical to do a RCT, so we'll never know if causal) between certain thresholds in gun ownership rates and the rate of violent crime. The accidental injury and death figures are not convincing when compared with other common risks. If your respirator monitoring machine gets hacked, or your records can not be retrieved to show a drug sensitivity, you could die from complications in an ER. I know for a fact that the hospitals near me run Windows XP, connected to the public internet, on mission critical systems. If a system which controls a switchable lane freeway signal gets hacked, even with generic malware which accidentally causes a crash, a distracted driver could plow into another. P.S. I'm facinated by your turn of phrase kettle of fish, here it would be a can of worms. Especially strange to me considering what I would think a kettle is [0][1][2][3][4]. Turns out there's such a thing as a fish kettle [5]. [0]: https://www.google.ca/search?tbm=isch&q=kettle https://www.google.ca/search?tbm=isch&q=kettle [1]: https://www.google.co.uk/search?tbm=isch&q=kettle https://www.google.co.uk/search?tbm=isch&q=kettle [2]: https://www.google.com.au/search?tbm=isch&q=kettle https://www.google.com.au/search?tbm=isch&q=kettle [3]: https://www.google.co.nz/search?tbm=isch&q=kettle https://www.google.co.nz/search?tbm=isch&q=kettle [4]: https://www.google.co.in/search?tbm=isch&q=kettle https://www.google.co.in/search?tbm=isch&q=kettle [5]: http://www.phrases.org.uk/images/fish-kettle.jpg http://www.phrases.org.uk/images/fish-kettle.jpg
BigChiefSmokem 9y ago
Not sure what the solution would be here besides being able to register for a "Licence to Hack" from the govt. Edit: going to leave this link right here, since it's incredibly relevant: https://www.theguardian.com/technology/2017/aug/03/researcher-who-stopped-wannacry-ransomware-detained-in-us https://www.theguardian.com/technology/2017/aug/03/researche...
- justanothersoul 9y ago
  Privateering for the digital age. I like it.
  - gruez 9y ago
    ...until Iran, NK, Russia, and China does the same thing
    - OtterCoder 9y ago
      Like they already do?
danjoc 9y ago
Counter point, #4) Hacking is cool http://www.ranum.com/security/computer_security/editorials/dumb/index.html http://www.ranum.com/security/computer_security/editorials/d...
mikegerwitz 9y ago
Considering we're posting on a website called "Hacker News", I can only assume I'm not the only one deeply frustrated by that title, and the opening paragraph. There's the hacker vs. cracker debate, but this is just profoundly disrespectful to me. There's no intentional disrespect here. The author probably has no idea. (Granted, a search for "hacker culture" does yield a Wikipedia article making it quite clear.) I feel disrespected for the complete lack of research on the term and because my core identity is being unintentionally slandered with such _brevity_ without even being understood or recognized. I continue to identify myself to others outside of the software community as a "free software hacker". And when someone sees this website on my computer---Hacker News---what are they to assume? When I'm sitting on an airplane looking at this site, what are they to assume? Had to vent.
- diegoperini 9y ago
  Some people will assume you are the one to call when their computer is broken. Some others will assume you are the reason why their computer is broken.
deleted 9y ago
[deleted]
davidf18 9y ago
Many of the famous and not so famous hacks were basically from refusal to follow manufacturer's instructions regarding upgrading OS versions (Home Depot, Target, for POS terminals, or National Health Service and others running on Windows XP which is no longer supported by the vendor) or not using 2-factor identification with a Yubikey or similar device (Clinton campaign John Podesta, Colin Powell). Another large health insurer (Anthem?) was audited by the federal government for security issues and then refused to implement the recommendations. Following software manufacturer's recommendations and using 2-factor identification and a Yukikey would go a long way to provide a lot of hacking. Hiring security consultants that put in additional cybersecurity software would also help in a number of cases.

61 points by bipr0 9y ago

Step 1 would be to pardon Snowden. He was whistleblowing on an illegal and dangerous program that directly threatened our democracy and took steps to totalitarianism. But instead of honoring that, Obama and his DoJ instead go to SXSW and give insulting, condescending talks about how we should stop working on "cat apps" and come be a drone for Uncle Sam. Why? So you can demand all our expertise but trust none of our judgement? So you can underpay us, give us no voice at the table, but then insult our intelligence by acting like serving these crooks is some noble cause? Lawyers run the country, Congress is all lawyers and no engineers. But then they run into problems related to technology and they say "bring in the nerds". Well, the word you're looking for is experts, and they're in the West Coast making way more money and building real technology instead of bureaucratic bullshit and illegal authoritarian tools of oppression. And maybe smoking recreational marijuana without having to bullshit their way through some bogus polygraph (not that those even work). I can't imagine anyone but the most naive would work for the NSA, FBI, or CIA if they had any other options.

microcolonel 9y ago
> Lawyers run the country, Congress is all lawyers and no engineers. “In my years I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress.” — John Adams It's simply a matter of scale. Because the government has accrued so many powers beyond the founding intent, it has become attractive to buy it. As people buy it, the government invests in more powers to keep the gravy going. As long as they do it gradually enough, and make it seem like they have a moral imperative to spend your money because they know better, the state will continue to grow. More power, more corruption; more corruption, more power — until it all becomes too much. If Edward Snowden could offer the government more power to attract more relationship investment from business, then he would have been pardoned in Barack Obama's tenure.
logfromblammo 9y ago
As I have said before, I can deal with almost anything if you pay me enough. But they don't pay anyone enough to deal with unlimited bullshit. And that's what you get when your boss's boss has no idea what you do or how you do it, and whenever he does the manager's power walk, it looks like you're just sitting there, doing nothing. The polygraph machine is a psychological trick. The actual lie detector is the operator, just like in Meet the Parents, and the ritual and setting is intended to intimidate you, belittle you, and make you stressed enough for the human to get a read on your reactions. The test isn't entirely bullshit, but the machine sure is, and I sure wish they'd find a better way to do it without all the gratuitous bullying and humiliation. And since the detectors are human, there's no way to guarantee consistency across tests w.r.t. false positives and false negatives.
Inconel 9y ago
Regarding polygraphs, I've heard form a friend who gets administered them routinely, that they are actually fairly effective. By effective I don't mean that they can tell if a person is lying, the science behind them is as far as I know completely bogus, but in the hands of a skilled interrogator they can be very effective at convincing otherwise rational people to admit all shorts of things to the government that they shouldn't, and more importantly, that the government would otherwise have absolutely no way of finding out.
- sugersvoltet 9y ago
  I don't really understand why people have an issue with polygraphs. They're pretty effective for the sole task they're designed for. As long as people don't try to involve them in legal cases (or otherwise use them as a genuine barometer for honesty), what's the problem?
  - dgfgfdagasdfgfa 9y ago
    Well, they create a culture of distrust, and when crossed with issues like drug use which may not be relevant to work concerns, it's going to scare high-value prospective employees.
    - sugersvoltet 9y ago
      Some kinds of organizations require some level of distrust in their culture. And the issue seems to really lie with how the employer handles past drug use. My understanding is many organizations, including some government agencies, tend to be fairly lenient about admitted past drug use (depending on many factors like how long ago it was and the kind of drug). I think in an ideal world, questions about past use would never be asked and drug tests would be strictly limited to determining if someone is high/drunk on the job. The fundamental problem is employers losing potentially valuable employees due to their unnecessary and invasive drug policies. The polygraph isn't to blame.
      - drunkenmonkey 9y ago
kbenson 9y ago
> Congress is all lawyers and no engineers. Well, congress is largely responsible for crafting, reviewing, and changing legislation, which is laws, so being a lawyer probably makes a lot of sense. Let's not pretend engineers are incapable of making mistakes, or not fully considering the implications of an action and having to review and fix it later. Engineers are largely kept from making too many mistakes by having evolved a strict set of guidelines to and regulations to adhere to. Many of those same regulations that keep engineers in check were put in place by lawyers.
- otempomores 9y ago
  Eh, no? That is what the advisory apparatus, the library and the slowness is for.. So none ecperts could read up. They became on the fly Domain Experts. That is what lobbyism was.. Influencing the Research of ready made experts. The reason lawyers dominate today is neither skill or Expertise.. just caste.

microcolonel 9y ago

If only they'd realize the same thing in regard to gun ownership.

devrandomguy 9y ago
Gun control is a completely different kettle of fish, because it is so unlikely for someone to recover from an attack; these aren't beanbag shotguns we're talking about. Also, there are no procedures that you can follow to prevent an unexpected bullet from quickly killing you, whereas with, say, an unexpected DoS, you can take measures to mitigate it after it has already started to hit you. With a security breach, you can lock down, wipe and recover from backups. But that bullet, it is just so uniquely final (and therefore, off topic, hence the downvotes).
- microcolonel 9y ago
  The National Research Council conducted a thorough review of evidence some years ago and found no correlation between the introduction of gun control measures and reduction in violent crime. In certain jurisdictions, there is a negative correlation (probably unethical to do a RCT, so we'll never know if causal) between certain thresholds in gun ownership rates and the rate of violent crime. The accidental injury and death figures are not convincing when compared with other common risks. If your respirator monitoring machine gets hacked, or your records can not be retrieved to show a drug sensitivity, you could die from complications in an ER. I know for a fact that the hospitals near me run Windows XP, connected to the public internet, on mission critical systems. If a system which controls a switchable lane freeway signal gets hacked, even with generic malware which accidentally causes a crash, a distracted driver could plow into another. P.S. I'm facinated by your turn of phrase kettle of fish, here it would be a can of worms. Especially strange to me considering what I would think a kettle is [0][1][2][3][4]. Turns out there's such a thing as a fish kettle [5]. [0]: https://www.google.ca/search?tbm=isch&q=kettle https://www.google.ca/search?tbm=isch&q=kettle [1]: https://www.google.co.uk/search?tbm=isch&q=kettle https://www.google.co.uk/search?tbm=isch&q=kettle [2]: https://www.google.com.au/search?tbm=isch&q=kettle https://www.google.com.au/search?tbm=isch&q=kettle [3]: https://www.google.co.nz/search?tbm=isch&q=kettle https://www.google.co.nz/search?tbm=isch&q=kettle [4]: https://www.google.co.in/search?tbm=isch&q=kettle https://www.google.co.in/search?tbm=isch&q=kettle [5]: http://www.phrases.org.uk/images/fish-kettle.jpg http://www.phrases.org.uk/images/fish-kettle.jpg

BigChiefSmokem 9y ago

Not sure what the solution would be here besides being able to register for a "Licence to Hack" from the govt. Edit: going to leave this link right here, since it's incredibly relevant: https://www.theguardian.com/technology/2017/aug/03/researcher-who-stopped-wannacry-ransomware-detained-in-us https://www.theguardian.com/technology/2017/aug/03/researche...

justanothersoul 9y ago
Privateering for the digital age. I like it.
- gruez 9y ago
  ...until Iran, NK, Russia, and China does the same thing
  - OtterCoder 9y ago
    Like they already do?

danjoc 9y ago

Counter point, #4) Hacking is cool http://www.ranum.com/security/computer_security/editorials/dumb/index.html http://www.ranum.com/security/computer_security/editorials/d...

mikegerwitz 9y ago

Considering we're posting on a website called "Hacker News", I can only assume I'm not the only one deeply frustrated by that title, and the opening paragraph. There's the hacker vs. cracker debate, but this is just profoundly disrespectful to me. There's no intentional disrespect here. The author probably has no idea. (Granted, a search for "hacker culture" does yield a Wikipedia article making it quite clear.) I feel disrespected for the complete lack of research on the term and because my core identity is being unintentionally slandered with such _brevity_ without even being understood or recognized. I continue to identify myself to others outside of the software community as a "free software hacker". And when someone sees this website on my computer---Hacker News---what are they to assume? When I'm sitting on an airplane looking at this site, what are they to assume? Had to vent.

diegoperini 9y ago
Some people will assume you are the one to call when their computer is broken. Some others will assume you are the reason why their computer is broken.

deleted 9y ago

[deleted]

davidf18 9y ago

Many of the famous and not so famous hacks were basically from refusal to follow manufacturer's instructions regarding upgrading OS versions (Home Depot, Target, for POS terminals, or National Health Service and others running on Windows XP which is no longer supported by the vendor) or not using 2-factor identification with a Yubikey or similar device (Clinton campaign John Podesta, Colin Powell). Another large health insurer (Anthem?) was audited by the federal government for security issues and then refused to implement the recommendations. Following software manufacturer's recommendations and using 2-factor identification and a Yukikey would go a long way to provide a lot of hacking. Hiring security consultants that put in additional cybersecurity software would also help in a number of cases.