5 ms·
I feel like there must be some sort of internet law that says, “gross incompetence is indistinguishable from malice.”
by hysan 7y ago
I feel like there must be some sort of internet law that says, “gross incompetence is indistinguishable from malice.”
- SahAssar 7y agoPretty sure you are kidding, but for the benefit of future readers: > Never attribute to malice that which can be adequately explained by stupidity. https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- hedora 7y agoThere’s an obvious corollary: > If you want to get away with it, make it indistinguishable from incompetence. Here’s a WWII field manual from “them” on the subject. It actually helped me unlearn some bad behaviors instilled by previous bad management. :-) http://www.simplesabotage.com/ http://www.simplesabotage.com/
- SahAssar 7y agoBut would you say, in a general sense, that it is better to assume malice rather than mistakes/incompetence/stupidity?
- droithomme 7y agoIf one is responsible for ensuring security, they won't be very effective unless they realize malicious actors masquerading as the incompetent exist and are active.
- SahAssar 7y agoIf I am working on security critical software I don't try to determine the intent of anyone at all, everyone is assumed malicious and their code/actions reviewed as such. My question was in a more general sense, do you assume that all mistakes are done on purpose to conceal some sort of plot?
- droithomme 7y ago> everyone is assumed malicious and their code/actions reviewed as such. Yes we are in agreement. > in a more general sense, do you assume that all mistakes are done on purpose to conceal some sort of plot? Obviously not and no one is claiming that. The extremes of never assuming malice and never assuming incompetence are ... extremes. Always starting with a presumption of innocence is said to be a useful premise for a criminal justice system. And always starting with a presumption of malice is a useful premise for security oversight. Not just code but other things like Secret Service details and plane boarding. It's assumed that boxcutter is for hijacking, so you have to give it up. It's presumed that bottle of water is some sort of chemical to be used in making a bomb, so you have to give it up. It's presumed that baby is a secret bomb, so the baby is going to be scanned and inspected. An unrecognized wellwisher rapidly approaching the President on stage at an event is presumed to be an assassin and will be tackled. A car of lost people looking for a wedding location which is approaching a US security checkpoint in Iraq or Afghanistan without slowing down will be machine gunned. A suspicious man, under the influence, who is staggering along down the center of the road in Baltimore who does not follow orders to stop and get on the ground and who instead reaches into his pocket for his id, cell phone, or breath mints, will be shot dead. Malice is the default assumption in a wide variety of security contexts.
- droithomme 7y agoRelated term of art for programmers is underhanded code. Always make your undermining of security and insertion of backdoors to appear to be a simple coding error: http://underhanded-c.org/ http://underhanded-c.org/
- justinclift 7y agoIt really needs an "... or corruption" appended to the end. ;)
- hysan 7y agoWas not kidding and thank you :)
- SahAssar 7y agoI just assumed because what you wrote fit so well with Hanlon's razor :)