4 ms·

I have compassion for these people who made these ludicrous comments -- they clearly aren't cryptographers or digital security experts. Let's separate the peopl

I have compassion for these people who made these ludicrous comments -- they clearly aren't cryptographers or digital security experts. Let's separate the people making these comments from the corporations they represent. Public shaming of a person is never the right response, in my opinion -- live and let live. Public shaming of a corporation, on the other hand, may be the only way to get the attention of the decision-makers. Let's be kind and compassionate to individuals.

taf2 8y ago
and remember that corporations are by definition a collection of individuals... is public shaming really the only way to get through to the decision makers? I hate the thought of regulations... but maybe there is a $$ solution here?
blauditore 8y ago
Yeah, in many of those tweets you can almost feel that the person writing it is trying to reiterate something they don't fully understand.
lultimouomo 8y ago
To be clear: do you count shaming an official corporate account as shaming a corporation or as shaming the person that actually write the tweets? Because of course corporations will always put a person in front of, so that you feel bad for speaking the truth. That's why official corporation tweets often carry a signature with a person first name - it reminds me of Pennac's Malaussène, who by trade is a professional scapegoat.
kodablah 8y ago
My compassion dies when their humility does. You cannot affect attitude towards disclosures by accepting the existing attitude. Compassion is bidirectional. A "we will investigate and get back shortly", or a "our internal team has investigated and here is their answer: '...'" is much more appropriate. Several companies' social media responders are courteous. Excusing corporate condescension mouthpieces just encourages the practice.
- coleifer 8y ago
  So an eye for an eye, huh? The thing is, publicly shaming someone is a very lazy way to effect change. Sure it might work for corporations, but if there's resistance it may be necessary to try reaching out to the decision makers via a different communication channel. I don't think it's appropriate to ratchet up the shaming and outrage.
  - TimothyBJacobs 8y ago
    This is addressed in the article. There were numerous instances of internal security teams trying to effect change, but were completely ignored by the powers that be.
  - pavel_lishin 8y ago
    > The thing is, publicly shaming someone is a very lazy way to effect change. Effective, too! Sounds like a win for me, a human being who isn't paid to ensure that other companies keep their systems secure.
rthomas6 8y ago
I think the author agrees with this. And they see the employee behind the customer service account as acting as a mouth of the company. Responding to what they say in that role is shaming the company, not the individual. Bringing the employee's personal life or questioning their individual abilities would be unkind, however.
chasing 8y ago
As noted in the article, they're a public face of the company. If they don't know the actual answers to questions being posed, they should reach out to someone in their organization who does, not make stuff up.
- crtasm 8y ago
  I agree but after seeing a lot of these think some of their presented facts were from someone higher up - though maybe informally, maybe pasted from a internal FAQ.
  - chasing 8y ago
    Then something is internally broken at that company, and -- again -- the people who act as the public face of that company run the risk of having the resulting ire directed at them. But it's not personal -- it's their job to act as a proxy for the company in the public sphere. If they're being endlessly attacked by people because the company is doing something wrong, they need to send that information up the flagpole to their higher-ups.
the_clarence 8y ago
Unfortunately a lot of people in security are quite childish and will often shame and blame developers publicly. Troy describes this with large companies, but I see the same happening all the time on Github or privately during security audits. There will be an open source project full of volunteers and some asshole will come up and point out that they shouldn’t use the userland prng of OpenSSL or that they should not use AES CBC or some minor issues like it’s the end of the world. They often do it in a very mean way which will of course trigger the developers who will in turn refuse to apply changes. You then have this escalation on both side and it is the kind of thing that makes us, the security community, look bad. After that people complain that we can’t teach developers about security...
wbronitsky 8y ago
You clearly did not read the article. This isn't youtube comments; these comments are supposed to be for informed discussion. Please read the article before commenting next time so we can all have a solid place to discuss these issues.
thaumaturgy 8y ago
There's a subtlety that people seem to be missing. Okay: "that is a dumb policy." "Big Corp's security wicket is hilariously wrong." Not okay: "You are a moron." "This customer service rep should go find a fast food job." In the examples he posted, Troy seems to be staying strictly on the side of shaming the companies. Yes, he's doing it by interacting with a customer service rep, but that's their job: to represent the company. He's not attacking the CS reps directly, and I couldn't quickly find any examples from his Twitter account to the contrary.
loeg 8y ago
This is addressed in the article, but your comment does not seem responsive to the article. (To summarize: shame works; social media reps function as the face of the organization.)
manigandham 8y ago
This is about shaming companies, not individuals. Most of the time you don't even know the individual behind the generic customer support channel anyway.

taf2 8y ago

and remember that corporations are by definition a collection of individuals... is public shaming really the only way to get through to the decision makers? I hate the thought of regulations... but maybe there is a $$ solution here?

blauditore 8y ago

Yeah, in many of those tweets you can almost feel that the person writing it is trying to reiterate something they don't fully understand.

lultimouomo 8y ago

To be clear: do you count shaming an official corporate account as shaming a corporation or as shaming the person that actually write the tweets? Because of course corporations will always put a person in front of, so that you feel bad for speaking the truth. That's why official corporation tweets often carry a signature with a person first name - it reminds me of Pennac's Malaussène, who by trade is a professional scapegoat.

kodablah 8y ago

My compassion dies when their humility does. You cannot affect attitude towards disclosures by accepting the existing attitude. Compassion is bidirectional. A "we will investigate and get back shortly", or a "our internal team has investigated and here is their answer: '...'" is much more appropriate. Several companies' social media responders are courteous. Excusing corporate condescension mouthpieces just encourages the practice.

coleifer 8y ago
So an eye for an eye, huh? The thing is, publicly shaming someone is a very lazy way to effect change. Sure it might work for corporations, but if there's resistance it may be necessary to try reaching out to the decision makers via a different communication channel. I don't think it's appropriate to ratchet up the shaming and outrage.
- TimothyBJacobs 8y ago
  This is addressed in the article. There were numerous instances of internal security teams trying to effect change, but were completely ignored by the powers that be.
- pavel_lishin 8y ago
  > The thing is, publicly shaming someone is a very lazy way to effect change. Effective, too! Sounds like a win for me, a human being who isn't paid to ensure that other companies keep their systems secure.

rthomas6 8y ago

I think the author agrees with this. And they see the employee behind the customer service account as acting as a mouth of the company. Responding to what they say in that role is shaming the company, not the individual. Bringing the employee's personal life or questioning their individual abilities would be unkind, however.

chasing 8y ago

As noted in the article, they're a public face of the company. If they don't know the actual answers to questions being posed, they should reach out to someone in their organization who does, not make stuff up.

crtasm 8y ago
I agree but after seeing a lot of these think some of their presented facts were from someone higher up - though maybe informally, maybe pasted from a internal FAQ.
- chasing 8y ago
  Then something is internally broken at that company, and -- again -- the people who act as the public face of that company run the risk of having the resulting ire directed at them. But it's not personal -- it's their job to act as a proxy for the company in the public sphere. If they're being endlessly attacked by people because the company is doing something wrong, they need to send that information up the flagpole to their higher-ups.

the_clarence 8y ago

Unfortunately a lot of people in security are quite childish and will often shame and blame developers publicly. Troy describes this with large companies, but I see the same happening all the time on Github or privately during security audits. There will be an open source project full of volunteers and some asshole will come up and point out that they shouldn’t use the userland prng of OpenSSL or that they should not use AES CBC or some minor issues like it’s the end of the world. They often do it in a very mean way which will of course trigger the developers who will in turn refuse to apply changes. You then have this escalation on both side and it is the kind of thing that makes us, the security community, look bad. After that people complain that we can’t teach developers about security...

wbronitsky 8y ago

You clearly did not read the article. This isn't youtube comments; these comments are supposed to be for informed discussion. Please read the article before commenting next time so we can all have a solid place to discuss these issues.

thaumaturgy 8y ago

There's a subtlety that people seem to be missing. Okay: "that is a dumb policy." "Big Corp's security wicket is hilariously wrong." Not okay: "You are a moron." "This customer service rep should go find a fast food job." In the examples he posted, Troy seems to be staying strictly on the side of shaming the companies. Yes, he's doing it by interacting with a customer service rep, but that's their job: to represent the company. He's not attacking the CS reps directly, and I couldn't quickly find any examples from his Twitter account to the contrary.

loeg 8y ago

This is addressed in the article, but your comment does not seem responsive to the article. (To summarize: shame works; social media reps function as the face of the organization.)

manigandham 8y ago

This is about shaming companies, not individuals. Most of the time you don't even know the individual behind the generic customer support channel anyway.