7 ms·
> One of the problems I've had over the past year and a half is how to communicate this idea without: > 1. Sounding like a crank. > 2. Giving ideas to terrori
by dfabulich 9y ago
> One of the problems I've had over the past year and a half is how to communicate this idea without:
> 1. Sounding like a crank.
> 2. Giving ideas to terrorists or hostile foreign governments.
#1 is this article's biggest problem. These problems are real, but I think the author sounds like a crank. (Based on the way this article is written, I suspect that the author actually is a crank--obsessed with security, but fundamentally lacking in the relevant skills to do anything about it.)
If the author is serious about this, here's what you do.
1. Become/join a non-profit organization. You want to be frequently quoted in the press, but not as "well-known software security expert Zach Aysan" but as "Zach Aysan, president of the Organization for Global Security."
2. Build your reputation by finding and earning credit for security problems. Do ethical reporting, but when the issues get fixed, exhibit them in a flashy way.
3. White papers, not blog posts. This "article" starts with a subtitle "with apologies to Elon Musk", followed by a personal dedication to Zach's father. This is not the tone of a white paper from a think tank.
The subtitle of the post should be the thesis statement of the article. "Self-driving cars lack adequate security protections." The first paragraph should be an executive summary of the argument of the post. Each paragraph should support the thesis statement.
Have someone read your articles; update your work based on their feedback. Thank them in the footer.
4. Separate "how to" articles from arguments. This article is long because it is both attempting to persuade the reader that we haven't invested enough effort into securing critical systems and also to give a list of proposals. These should be separate articles, with one article arguing why security is important, and another article giving a list of proposals.
- lucb1e 9y ago> #1 is this article's biggest problem I don't know, but I had the same idea years ago, and I later read about an author using the idea in a 2006 book (Daemon, by Daniel Suarez). I'd say this shouldn't be an issue, and it also solves number two: if we can think of it, so can hostile governments* and mad men. That said, the article does (after he gets to the point of "weapons of mass destruction") seem to get a little obsessive and, yeah, crank-y. But that has little to do with the concern itself. * Not "hostile foreign governments" because every government is foreign (and perhaps even hostile) to someone.
- TeMPOraL 9y agoReminds me of Snowden leaks - most of the stuff was pretty much obvious to anyone with any actual understanding of technology, and yet saying it out loud would get you labeled as a crackpot.
- carapace 9y agoTrue. I think you have to be paranoid, really paranoid, to be able to think about this kind of thing. "Normal" humans seem to have psychological stability mechanisms that operate pathologically when confronted with events that are too far outside of their world-view. It's fine to disbelieve Bigfoot. It's dangerous to disbelieve e.g. Stuxnet. Even the author: > It wasn't until I'd read through the code [of Stuxnet] myself that I finally believed that it had actually happened. Is it a failure of imagination? Head-in-the-sand-ism? Just not paranoid enough? To everyone reading this, if this article sounds like a crank, please re-evaluate your world-view. This is the clearest and most well-written description of the problem I've yet read.
- jtbayly 9y agoI'm not sure why this is being downvoted. It seems entirely reasonable to assume that people just can't bring themselves to think about some things logically.
- 3pt14159 9y agoCarapace I’ve been taking the comments here pretty hard. Thanks for this.
- carapace 9y agoDude thank you. You're a freakin' hero. You've identified what I call the "Maximum Overdrive" problem and actually gotten people to take it seriously. That is amazing and I applaud your efforts. Thank you.
- pvg 9y agoThe NSA warrantless surveillance program, something much more egregious than anything revealed by Snowden, was reported in the plain old regular press - the New York Times, back in 2005. James Bamford has made a long and distinguished career of writing about the NSA with his first book coming out in 1982.
- acct1771 9y agoYour mindset (nice sounding organization must be legit!) is the problem with trust in technology. Society needs to stop replacing any attempt at understanding with deference to "someone who knows computers", etc.
- dfabulich 9y agoSocial knowledge requires us to trust experts; we can't all be experts in everything.
- acct1771 9y agoI'm not an expert, but I've known for over half my life not to trust Intel/Microsoft et al - but many mainstream "industry experts" felt safe saying the opposite, until the proverbial "laying in the street" came to fruition.
- cornholio 9y ago> Separate "how to" articles from arguments. This article is long because it is both attempting to persuade the reader that we haven't invested enough effort into securing critical systems and also to give a list of proposals. The solutions are also very very wrong, he proposes a state enforced kill switch for every device capable of autonomous operation. Abusing that system seems like a much greater source of havoc than individual compromises of certain brands. His main point is pretty insightful and well argued, giving life and death powers to very fragile software on a massive scale will end in disaster. The computer industry is woefully unprepared to deliver hardware, software and systems with the provable integrity many of these applications require.
- deevolution 9y agoThe kill switch should simply be launching a rocket or emp at the infected autonomous vehicle.
- EamonnMR 9y agoThe passengers would probably prefer a less violent approach.
- deevolution 9y agoIm just pointing out an equally horrendous proposal.
- jrockway 9y ago> giving life and death powers to very fragile software on a massive scale will end in disaster. I dunno, we already use software to run trains and it works OK. Gone are the days of track circuits and physical protuberances on the track to open the brake tube when a train tries to go where it shouldn't. Modern positive train control uses 802.11-based wireless networks communicating between trains, and as scary as hacked-up WiFi routers sound for life-and-death applications, it has a better safety record than the easier-to-understand previous-generation technologies. https://en.wikipedia.org/wiki/Communications-based_train_control https://en.wikipedia.org/wiki/Communications-based_train_con... Complex software systems _can_ be successfully implemented. I might even be inclined to trust them more than cars driven by people that got an hour of sleep last night, or people whose financial incentives line up in such a way as to make driving 60mph on residential streets a smart business decision.
- dgudkov 9y ago>but I think the author sounds like a crank I guess, a few years ago anyone who would assume that Facebook can be used to propagate fake news and influence presidential elections would've been called a crank. I wish we have more "cranks" like the author. And of course when it comes to a chance of massive coordinated terrorist attack it's better to have many false positives (no matter how annoying they are) than overlook a real problem.