3 ms·
>I think part of the problem is that school and college teach us to say "no" to something that's not always true It's mostly that we fail to frame the context
by maqp 7y ago
>I think part of the problem is that school and college teach us to say "no" to something that's not always true
It's mostly that we fail to frame the context of the statement when it's true and when it isn't.
In security stuff we often talk about threat model. The article mentions anonymity via HTTPS, which is never the case. You can remain anonymous from someone by using one-time pseudonym in Telegram. You can't remain anonymous from Telegram server without anonymizing your IP and phone number. You can remain anonymous from server with Tor, throwaway phone and prepaid SIM, but to remain anonymous from the NSA you need more steps like buying the SIM and phone with cash.
Things are complicated and we often assume the conditions without explicitly stating it. Some people think from the perspective of word case (next Snowden on a run) and some from their own (often privileged) position. Some argue from the viewpoint of a Chinese dissident, someone from western cryptoanarchist.
Risks are more often than not invisible so assessing them is extremely difficult. Security is often about margins, and I see a LOT of incompetence, e.g. encryption needs to be 256-bits and then key management (especially authentication) is hand waving.
IMO the fault is the upvoting culture. Back in the day when we used to have separate forums, someone who would post a question, could immediately be asked a followup question e.g. "what is your threat model". This helped set the context for all readers.
Once we moved into discussion with comments, we lost the story part, and people started to post "right" i.e. popular answers for upvotes without really focusing on relevance, like the author so eloquently puts it.
What doesn't of course help here is often the conversation is only part of larger puzzle. Maybe the NSA is part of OPs threat model and they didn't know it. E.g. if they're a sysadmin of large company. They're not a terrorist, they just manage systems of interest. That's where the conversation forks. And the more nuances the original discussion has, the faster the story is lost.
Furthermore, there's the endless amount of forum trolling that tries to drown insight amidst noise, memes, pop culture references and other thought terminating clichés that make you immediately turn on your heels, and look for insightful discussion under the next news story.
Then there's grass-roots marketing, disinformation, shilling etc propaganda, all which is specifically designed to have plausible deniability that makes it impossible to weed out.