4 ms·

I think being a hacker, phreaker or cracker became so illegal it really scared people off experimenting and learning about computer security the practical way.

I think being a hacker, phreaker or cracker became so illegal it really scared people off experimenting and learning about computer security the practical way. Now there are obviously great security people around, but the path one needs to take to become a professional in the field seems to be more theoretical and rubber stamped. For me this is why I focused more on just software engineering with less focus on network security. I get paid to hack without worrying about the police knocking on my door for experimenting and exploring.

tptacek 6y ago
The opposite is true; it is much easier today to engage with computer security legally than it was in the 1990s. And the consequences for crossing the line are generally smaller. It's easier for lots of reasons, many of them banal, like the fact that you can get a modern Unix system on your laptop in minutes for free, and tear it down and bring it back up on demand with virtualization, or the fact that everyone has Internet access and nobody has to bounce through an X.25 Internet gateway or an outdial to get to IRC. It's also easier because huge amounts of vulnerability research have been published since the 1990s. The cutting edge of vulnerability research in the 1990s is almost unbelievably primitive compared to what's available in open school curricula now, let alone refereed vulnerability research venues. In the 1990s, basic details about things like stack overflows or even temp file races were permanently embargoed and made available only to large-company system operators. Most of what's disclosed today by vendors would have been decried as unethical by the security community in 1995. People that want to do active vulnerability research today can participate in thousands of bug bounty programs, none of which existed in the 1990s. And, despite what the prevailing sentiment on HN would indicate, I think it's actually a bit rarer for people to be prosecuted for undirected, non-monetized hacking than it was in the '90s.
- bamboozled 6y ago
  Yeah I was comparing the situation to circa 2000 onwards. Not around the time when Linux came out. I think th is sentiment regarding bug bounties programs kind of solidifies my point. Corporate America and the government has made only the type of hacking they benefit from legal, while experimentation is off the table. I’m not so much advocating for a free for all by the way. I think there is difference between curiosity and malicious intent.
AnthonyMouse 6y ago
And of course the opposite is true in some other countries. Some of the best computer security people come out of places like Russia because they don't much care what their people do to computers in America. But that also means that the aggressive laws here are not only useless but harmful, because there is no middle ground between fooling around and real crime. If fooling around gets you a slap on the wrist then domestic kids fool around, test the fences, cause people to learn of the vulnerabilities and they get fixed. But they still don't commit credit card fraud or corporate espionage, because those would still be highly illegal. If, on the other hand, there is a dichotomy where in one country looking at a computer sideways is a felony and in another there is complete lawlessness, then the first time you get hacked it's by foreign raiders rampaging through the village and causing widespread destruction, instead of some kid who only tags your website with graffiti and in so doing impresses upon you the need for better security.

tptacek 6y ago

The opposite is true; it is much easier today to engage with computer security legally than it was in the 1990s. And the consequences for crossing the line are generally smaller. It's easier for lots of reasons, many of them banal, like the fact that you can get a modern Unix system on your laptop in minutes for free, and tear it down and bring it back up on demand with virtualization, or the fact that everyone has Internet access and nobody has to bounce through an X.25 Internet gateway or an outdial to get to IRC. It's also easier because huge amounts of vulnerability research have been published since the 1990s. The cutting edge of vulnerability research in the 1990s is almost unbelievably primitive compared to what's available in open school curricula now, let alone refereed vulnerability research venues. In the 1990s, basic details about things like stack overflows or even temp file races were permanently embargoed and made available only to large-company system operators. Most of what's disclosed today by vendors would have been decried as unethical by the security community in 1995. People that want to do active vulnerability research today can participate in thousands of bug bounty programs, none of which existed in the 1990s. And, despite what the prevailing sentiment on HN would indicate, I think it's actually a bit rarer for people to be prosecuted for undirected, non-monetized hacking than it was in the '90s.

bamboozled 6y ago
Yeah I was comparing the situation to circa 2000 onwards. Not around the time when Linux came out. I think th is sentiment regarding bug bounties programs kind of solidifies my point. Corporate America and the government has made only the type of hacking they benefit from legal, while experimentation is off the table. I’m not so much advocating for a free for all by the way. I think there is difference between curiosity and malicious intent.

AnthonyMouse 6y ago

And of course the opposite is true in some other countries. Some of the best computer security people come out of places like Russia because they don't much care what their people do to computers in America. But that also means that the aggressive laws here are not only useless but harmful, because there is no middle ground between fooling around and real crime. If fooling around gets you a slap on the wrist then domestic kids fool around, test the fences, cause people to learn of the vulnerabilities and they get fixed. But they still don't commit credit card fraud or corporate espionage, because those would still be highly illegal. If, on the other hand, there is a dichotomy where in one country looking at a computer sideways is a felony and in another there is complete lawlessness, then the first time you get hacked it's by foreign raiders rampaging through the village and causing widespread destruction, instead of some kid who only tags your website with graffiti and in so doing impresses upon you the need for better security.