4 ms·

It's by far not the first time that a highly-priviledged "security" component turns out to actually reduce security, because it is a large and gainful attack su

by vog 9y ago

It's by far not the first time that a highly-priviledged "security" component turns out to actually reduce security, because it is a large and gainful attack surface. I can't help but to think of all those exploits that target anti-virus software.

gargravarr 9y ago
"I know, let's examine some suspicious code in a highly-privileged process that the user explicitly trusts to keep them safe." When you think about it, "it seemed like a good idea at the time" can explain most tragedies in human histories.
- zAy0LfpBZLC8mAC 9y ago
  Except it never seemed like a good idea to anyone with a clue of IT security.
- sametmax 9y ago
  Well, a few hours ago we had a thread on HN about eradicating a whole specy of insects. And we had in comments intelligent educated people that though that "it seems like a good idea". So if mass disruption of the very system that support your life can have supporters among a community composed of smart and actively debating people, "it seemed like a good idea at the time" probably happens every week at gov agencies.
  - Kadin 9y ago
    Lots of things are done because there's a broad consensus opinion that it's a good idea. There is nothing intrinsically bad about that, and needless or baseless skepticism is often counterproductive and paralyzing, leading to inaction even in the face of widespread consensus. What leads to failures, and I suspect happened at Intel, was that they mistook a very localized consensus for a broader one. There's a word for this, it's called "groupthink". A group of people can talk themselves into doing something very stupid (or evil) while still thinking they're doing the right thing, given enough time and motivation. There was no widespread consensus, outside of Intel, that the IME was a good idea. If they had solicited opinions from outside their organization, they would doubtless have gotten horrified reactions. But they didn't, or if they did they must have dismissed those concerns, because they went through with the bad idea anyway. The apparent secrecy with which they developed the IME is also a cause for alarm; groups of people who operate in isolation are particularly prone to groupthink, and so even if their motivations are good ones, the fact that they are working without continuous feedback from anyone on the outside raises the chances of a perverse outcome.
- mikeash 9y ago
  People usually won’t do something if they think it’s a bad idea. Tragedies begin with “it seemed like a good idea at the time” because everything does.
azernik 9y ago
From what I understand, the justification wasn't about security, but rather about remote administration. Which is even worse, because that is ACTUALLY a backdoor, just one that is supposed to only be used by the legitimate owner of the machine.
- milcron 9y ago
  It enables DRM technologies, too.

by vog 9y ago

gargravarr 9y ago

"I know, let's examine some suspicious code in a highly-privileged process that the user explicitly trusts to keep them safe." When you think about it, "it seemed like a good idea at the time" can explain most tragedies in human histories.

zAy0LfpBZLC8mAC 9y ago
Except it never seemed like a good idea to anyone with a clue of IT security.
sametmax 9y ago
Well, a few hours ago we had a thread on HN about eradicating a whole specy of insects. And we had in comments intelligent educated people that though that "it seems like a good idea". So if mass disruption of the very system that support your life can have supporters among a community composed of smart and actively debating people, "it seemed like a good idea at the time" probably happens every week at gov agencies.
- Kadin 9y ago
  Lots of things are done because there's a broad consensus opinion that it's a good idea. There is nothing intrinsically bad about that, and needless or baseless skepticism is often counterproductive and paralyzing, leading to inaction even in the face of widespread consensus. What leads to failures, and I suspect happened at Intel, was that they mistook a very localized consensus for a broader one. There's a word for this, it's called "groupthink". A group of people can talk themselves into doing something very stupid (or evil) while still thinking they're doing the right thing, given enough time and motivation. There was no widespread consensus, outside of Intel, that the IME was a good idea. If they had solicited opinions from outside their organization, they would doubtless have gotten horrified reactions. But they didn't, or if they did they must have dismissed those concerns, because they went through with the bad idea anyway. The apparent secrecy with which they developed the IME is also a cause for alarm; groups of people who operate in isolation are particularly prone to groupthink, and so even if their motivations are good ones, the fact that they are working without continuous feedback from anyone on the outside raises the chances of a perverse outcome.
mikeash 9y ago
People usually won’t do something if they think it’s a bad idea. Tragedies begin with “it seemed like a good idea at the time” because everything does.

azernik 9y ago

From what I understand, the justification wasn't about security, but rather about remote administration. Which is even worse, because that is ACTUALLY a backdoor, just one that is supposed to only be used by the legitimate owner of the machine.

milcron 9y ago
It enables DRM technologies, too.