4 ms·

Is this Brian White for real? Host: Who could exploit this vulnerability...? White: Those that have significant resources, for instance, Google... (mentions na

Is this Brian White for real? Host: Who could exploit this vulnerability...? White: Those that have significant resources, for instance, Google... (mentions nation-states much later) Nice FUD there. White: what is important here, there are no known attacks ongoing right now... Nice argument from ignorance there. White: there is a lot of things we don't know but it reinforces two things to me, one is that increasingly the software we are operating is quite secure, coz now we are looking at kernel level problems... Nice false cause fallacy.

wickawic 9y ago
You should argue the points, not label the fallacies. Would you rather White say “well there’s probably attacks, but no one knows!”? This is just as incorrect as his statement, the problem being that /no one knows./ The FUD is real though.
- zero_intp 9y ago
  I disagree with you. Labeling fallacies is shorthand for calling them out. When reading PR or news, I prefer to read a quick breakdown of the syllogisms BEFORE I go into technical details.
  - ant6n 9y ago
    > I prefer to read a quick breakdown of the syllogisms Do you have a link for a good one?
- rando444 9y ago
  Arguing logical fallacies is a waste of time and effort. They are things that never should have been said in the first place because they're only made to deflect, detract, or support a nonsensical argument. If you get caught up in trying to defend against these things you've already fallen into their trap.
  - pessimizer 9y ago
    People frequently use logical fallacies in good faith, usually because they're falling for one of the many permutations of the law of averages, using associative logic/magical thinking, or just have some axiomatic beliefs that they believe are somehow sinful/wrong to scrutinize due to their religion/loyalty.
    - rando444 9y ago
      Very true, I think the point still stands though that the best thing to do is to point them out rather than to try and argue them.. otherwise you end up legitimizing the discussion and going off on some irrelevant tangent rather than debating something worthwhile.
  - specialist 9y ago
    Yup. Big difference between rhetoric and an intellectually honest discussion. "If you're explaining, you're losing." -- Lee Atwater
workthrowaway27 9y ago
I've heard security researchers make the last claim. Especially with the increasing use of fuzzing, ASLR, etc., trivially exploitable buffer overflows and other things of that nature are much less common now.
- UncleMeat 9y ago
  But still extremely common. SQL injection is my favorite one. We've had a good solution for it for ages. But look at CVEs and you will still see loads of SQL injection.

wickawic 9y ago

You should argue the points, not label the fallacies. Would you rather White say “well there’s probably attacks, but no one knows!”? This is just as incorrect as his statement, the problem being that /no one knows./ The FUD is real though.

zero_intp 9y ago
I disagree with you. Labeling fallacies is shorthand for calling them out. When reading PR or news, I prefer to read a quick breakdown of the syllogisms BEFORE I go into technical details.
- ant6n 9y ago
  > I prefer to read a quick breakdown of the syllogisms Do you have a link for a good one?
rando444 9y ago
Arguing logical fallacies is a waste of time and effort. They are things that never should have been said in the first place because they're only made to deflect, detract, or support a nonsensical argument. If you get caught up in trying to defend against these things you've already fallen into their trap.
- pessimizer 9y ago
  People frequently use logical fallacies in good faith, usually because they're falling for one of the many permutations of the law of averages, using associative logic/magical thinking, or just have some axiomatic beliefs that they believe are somehow sinful/wrong to scrutinize due to their religion/loyalty.
  - rando444 9y ago
    Very true, I think the point still stands though that the best thing to do is to point them out rather than to try and argue them.. otherwise you end up legitimizing the discussion and going off on some irrelevant tangent rather than debating something worthwhile.
- specialist 9y ago
  Yup. Big difference between rhetoric and an intellectually honest discussion. "If you're explaining, you're losing." -- Lee Atwater

workthrowaway27 9y ago

I've heard security researchers make the last claim. Especially with the increasing use of fuzzing, ASLR, etc., trivially exploitable buffer overflows and other things of that nature are much less common now.

UncleMeat 9y ago
But still extremely common. SQL injection is my favorite one. We've had a good solution for it for ages. But look at CVEs and you will still see loads of SQL injection.