4 ms·
It's a truism that any approach which lets some friendly adversary pwn those whom you consider evil will also let your adversaries pwn you. Given that, it's re
by mirimir 7y ago
It's a truism that any approach which lets some friendly adversary pwn those whom you consider evil will also let your adversaries pwn you.
Given that, it's reassuring when the evil don't get pwned. Because they're canaries. If they're safe, you're safe.
- skybrian 7y agoUh, since your argument proves zero-day attacks don't exist, you might want to go back and figure out how you got it wrong?
- mirimir 7y agoIf they're compromised by a zero-day, that may come out. And so you may read about it. For example, we only learned about the FBI's NIT after the PlayPen etc busts. So Firefox got patched.
- skybrian 7y agoMaybe it would happen that way, but if it doesn't, it doesn't show you're safe. Testing can only prove the presence of bugs, not their absence. Reading about other people getting hacked can warn you that you're vulnerable to the same bug, but if they didn't get hacked it doesn't prove anything.
- mirimir 7y agoHey, I didn't claim that they were safe. Just that you can't be safe if they aren't.
- skybrian 7y agoYou did say "if they're safe, you're safe." But that's not true. Your security setup might (and probably does) have different vulnerabilities. Maybe you're using better or worse encryption than them? You can't really conclude anything, in general.
- mirimir 7y agoI get your point. And I did overstate the argument. Still, if available software and systems don't let them be safe, those software and systems won't let you be safe either. And arguably, the assholes are better at staying safe than you are. Or at least, the ones who aren't will go down fast. And when they do get pwned, it's often a public matter. Because criminal matters are public in sane countries, and they're newsworthy. So, for example, busts have alerted us to file snooping by anti-malware apps, retention and disclosure of VPN service logs, Firefox bugs, and leakage of Apache error messages around Tor. Also the risks of using unusual slang, although that's a human failure.
- skybrian 7y agoYes, I agree we can learn from other people's experiences using certain technology. Like, nobody believes Bitcoin is anonymous anymore, right? And certainly we learn something from watching people playing for higher stakes than us. On the other hand, for criminals it's a little different since they rely entirely on technology. That's also an ideal for some people of a libertarian mindset who are not criminals, but it's not the only way to do things. A combination of legal, political, and technical safeguards may work better than purely technical rules for most people? We don't have to live outside the law if we make the law work for us. Anyone who talks about legal rights is implicitly putting some faith in the legal system to put things right, as an ideal, anyway.