5 ms·

I've heard it put this way: If you force users to trade convenience for security, they will find a way to obtain convenience at the expense of security.

hinkley 6y ago
If you make it harder for people to do the right thing than the wrong thing, they will choose the wrong thing. This has been brought up a million times in the context of DRM, but it is true in the general case as well.
- tombert 6y ago
  I could be mistaken on this, but wasn't this basically the sales pitch for Spotify? Basically saying "you'll never get rid of piracy, but you can compete with it".
  - setr 6y ago
    Not sure about Spotify, but I know gabe newell had famously made basically this argument, in regards to steam's success
  - danudey 6y ago
    This was the sales pitch for iTunes and the iTunes store: "We approached it as 'Hey, we all love music.' Talk to the senior guys in the record companies and they all love music, too. … We love music, and there's a problem. And it's not just their problem. Stealing things is everybody's problem. We own a lot of intellectual property, and we don't like when people steal it. So people are stealing stuff and we're optimists. We believe that 80 percent of the people stealing stuff don't want to be; there’s just no legal alternative. So we said, Let's create a legal alternative to this. Everybody wins. Music companies win. The artists win. Apple wins. And the user wins because he gets a better service and doesn't have to be a thief." https://www.esquire.com/news-politics/a11177/steve-jobs-esquire-interview-0703/ https://www.esquire.com/news-politics/a11177/steve-jobs-esqu... Another point of reference: because they had no legal ground to stand on, HBO targeted Canadian torrenters of Game of Thrones with an e-mail saying, among other things, "It's never been easier to [watch Game of Thrones legally]!" This was true, it had never been easier. It had also never been harder. For the entire time that Game of Thrones was being aired, the only legal way for Canadians to watch it was to pay about a hundred dollars per month for cable and the cable packages that would give them HBO. You could buy it on iTunes, but only as a season, after the season was over. So yeah, I kept torrenting it, everyone I know kept torrenting it, and everyone hated (or laughed at, or both) HBO the whole time.
    - MaxBarraclough 6y ago
      Interesting that it depends so much on region. Here in the UK, Sky offer a cheap 'over-the-top' streaming alternative to their satellite offerings, [0] so you could watch Game of Thrones for £8/month, provided you didn't mind the inferior video quality. [0] https://en.wikipedia.org/wiki/Now_TV_(Sky) https://en.wikipedia.org/wiki/Now_TV_(Sky)
      - Nursie 6y ago
        They have a "topup" now which allows you to get real, full-fat 1080p. Woohoo! I did actually add that to my subscription, and during lockdown have used it to re-watch Game of Thrones :)
        MaxBarraclough 6y ago
        I gave that a go but wasn't impressed by the 1080P quality. I suspect they're using a low bitrate.
        Nursie 6y ago
        Most likely. You can get the bitrate to display (when the video controls are up maybe?) if you wanted to take a look. Between that and whatever magic my OLED tv was doing, it looked pretty good to me. Just a shame they haven't released it all in 4K/UHD yet...
        MaxBarraclough 6y ago
        I doubt they'll offer 4K. They want to push people toward their expensive satellite packages for that.
        Nursie 6y ago
        I meant HBO! I think GoT season 1 is the only season that's had a release at that res so far. I was really hoping to get an HDR version of the "The long night", to address some of the banding and other visibility problems present in the episode, and maybe see a bit more of what went on. But there isn't one yet. So I watched it with the lights out so that my eyes adjusted :) But yeah, you're probably right, NowTv has massive potential to undercut their main offering.
  - floatboth 6y ago
    This was also a sales pitch for Steam – especially in developing countries where the whole concept of paying for non-physical things was a hard sell. (Though in this case it wasn't just competition – access to official servers in online games was something that was often not pirateable.)
akira2501 6y ago
> If you force users to trade convenience for security I _wish_ it was better security they were making the trade for. It often isn't though. These programs are large, expensive, and don't do much most of the time. I feel there's a perverse incentive for developers to make their AV products as noisy as is possible to justify their own existence. And yet.. even with full AV rollouts locked down at the highest level, bad actors still get into networks and exploit them. So, to me it feels like our users are trading away their convenience for our misguided CYA policies.
- NegativeLatency 6y ago
  There was that one AV with a JS interpreter running as root https://news.ycombinator.com/item?id=22544554 https://news.ycombinator.com/item?id=22544554
- lmilcin 6y ago
  The truth is, you don't need much in the way of AV software if you are willing to outright block certain types of files. In most large corporations you are basically not allowed to send anything that could even potentially hide a virus except for maybe Office files (nobody yet built a compelling alternative to Powerpoint and Excel). Typical rules already block all executable binaries, scripts and password protected archives (because they could hold binaries or scripts), etc. As a Java developer I have recently discovered my company started blocking *.java files.
- majewsky 6y ago
  My guess/fear is that most AV software gets deployed because some insurance policy requires you to tick that box.
  - fakecigar 6y ago
    A lot of this stuff (AV software) is getting deployed at all different layers of the environment. Firewalls are getting better at dynamic file analysis and file blocking, the endpoints are loaded with user behavior/analytics, av and dlp tools. AV is so omnipresent because it's in a decent amount netsec appliances these companies stand up
TeMPOraL 6y ago
It's true, and often it's not laziness - corporate security measures are often focused only on denying access, and they're so overbearing that, were they followed to the letter, they could easily shut the company down. It's through workarounds that actual work gets done.
- Nasrudith 6y ago
  Sounds like a large organizational incentive intergration failure where subpieces are at odds such that they care more about dodging blame and outside of their domain it isn't their problem. "Not My Fault/Not My Problem" as a toxic approach making balancing decisions worse.
- vmilner 6y ago
  I remember having issues with a corporate email system where base64/uuencoded data would fail to get through with a very rough dependency on size - large files had a smaller chance of getting through but it was clear that there wasn't a hard size limit. Eventually someone twigged that the problem was a "rude word" scanner, and that beyond a certain size you would hit the "scunthorpe" problem, and forbidden words would appear in the ASCII text randomly.
rodgerd 6y ago
The thing is, usability is security. People will do anything to be able to do their job (because people like being able to, you know, eat and stuff). Things that stop you doing your job are bad for security. I wish more of the security industry would get their frigging heads around this. PGP did less for messaging security over decades of availability than iMessage and Signal did in a few weeks of availability.

hinkley 6y ago

If you make it harder for people to do the right thing than the wrong thing, they will choose the wrong thing. This has been brought up a million times in the context of DRM, but it is true in the general case as well.

tombert 6y ago
I could be mistaken on this, but wasn't this basically the sales pitch for Spotify? Basically saying "you'll never get rid of piracy, but you can compete with it".
- setr 6y ago
  Not sure about Spotify, but I know gabe newell had famously made basically this argument, in regards to steam's success
- danudey 6y ago
  This was the sales pitch for iTunes and the iTunes store: "We approached it as 'Hey, we all love music.' Talk to the senior guys in the record companies and they all love music, too. … We love music, and there's a problem. And it's not just their problem. Stealing things is everybody's problem. We own a lot of intellectual property, and we don't like when people steal it. So people are stealing stuff and we're optimists. We believe that 80 percent of the people stealing stuff don't want to be; there’s just no legal alternative. So we said, Let's create a legal alternative to this. Everybody wins. Music companies win. The artists win. Apple wins. And the user wins because he gets a better service and doesn't have to be a thief." https://www.esquire.com/news-politics/a11177/steve-jobs-esquire-interview-0703/ https://www.esquire.com/news-politics/a11177/steve-jobs-esqu... Another point of reference: because they had no legal ground to stand on, HBO targeted Canadian torrenters of Game of Thrones with an e-mail saying, among other things, "It's never been easier to [watch Game of Thrones legally]!" This was true, it had never been easier. It had also never been harder. For the entire time that Game of Thrones was being aired, the only legal way for Canadians to watch it was to pay about a hundred dollars per month for cable and the cable packages that would give them HBO. You could buy it on iTunes, but only as a season, after the season was over. So yeah, I kept torrenting it, everyone I know kept torrenting it, and everyone hated (or laughed at, or both) HBO the whole time.
  - MaxBarraclough 6y ago
    Interesting that it depends so much on region. Here in the UK, Sky offer a cheap 'over-the-top' streaming alternative to their satellite offerings, [0] so you could watch Game of Thrones for £8/month, provided you didn't mind the inferior video quality. [0] https://en.wikipedia.org/wiki/Now_TV_(Sky) https://en.wikipedia.org/wiki/Now_TV_(Sky)
    - Nursie 6y ago
      They have a "topup" now which allows you to get real, full-fat 1080p. Woohoo! I did actually add that to my subscription, and during lockdown have used it to re-watch Game of Thrones :)
      - MaxBarraclough 6y ago
        I gave that a go but wasn't impressed by the 1080P quality. I suspect they're using a low bitrate.
        Nursie 6y ago
        Most likely. You can get the bitrate to display (when the video controls are up maybe?) if you wanted to take a look. Between that and whatever magic my OLED tv was doing, it looked pretty good to me. Just a shame they haven't released it all in 4K/UHD yet...
        MaxBarraclough 6y ago
        I doubt they'll offer 4K. They want to push people toward their expensive satellite packages for that.
        Nursie 6y ago
        I meant HBO! I think GoT season 1 is the only season that's had a release at that res so far. I was really hoping to get an HDR version of the "The long night", to address some of the banding and other visibility problems present in the episode, and maybe see a bit more of what went on. But there isn't one yet. So I watched it with the lights out so that my eyes adjusted :) But yeah, you're probably right, NowTv has massive potential to undercut their main offering.
- floatboth 6y ago
  This was also a sales pitch for Steam – especially in developing countries where the whole concept of paying for non-physical things was a hard sell. (Though in this case it wasn't just competition – access to official servers in online games was something that was often not pirateable.)

akira2501 6y ago

> If you force users to trade convenience for security I _wish_ it was better security they were making the trade for. It often isn't though. These programs are large, expensive, and don't do much most of the time. I feel there's a perverse incentive for developers to make their AV products as noisy as is possible to justify their own existence. And yet.. even with full AV rollouts locked down at the highest level, bad actors still get into networks and exploit them. So, to me it feels like our users are trading away their convenience for our misguided CYA policies.

NegativeLatency 6y ago
There was that one AV with a JS interpreter running as root https://news.ycombinator.com/item?id=22544554 https://news.ycombinator.com/item?id=22544554
lmilcin 6y ago
The truth is, you don't need much in the way of AV software if you are willing to outright block certain types of files. In most large corporations you are basically not allowed to send anything that could even potentially hide a virus except for maybe Office files (nobody yet built a compelling alternative to Powerpoint and Excel). Typical rules already block all executable binaries, scripts and password protected archives (because they could hold binaries or scripts), etc. As a Java developer I have recently discovered my company started blocking *.java files.
majewsky 6y ago
My guess/fear is that most AV software gets deployed because some insurance policy requires you to tick that box.
- fakecigar 6y ago
  A lot of this stuff (AV software) is getting deployed at all different layers of the environment. Firewalls are getting better at dynamic file analysis and file blocking, the endpoints are loaded with user behavior/analytics, av and dlp tools. AV is so omnipresent because it's in a decent amount netsec appliances these companies stand up

TeMPOraL 6y ago

It's true, and often it's not laziness - corporate security measures are often focused only on denying access, and they're so overbearing that, were they followed to the letter, they could easily shut the company down. It's through workarounds that actual work gets done.

Nasrudith 6y ago
Sounds like a large organizational incentive intergration failure where subpieces are at odds such that they care more about dodging blame and outside of their domain it isn't their problem. "Not My Fault/Not My Problem" as a toxic approach making balancing decisions worse.
vmilner 6y ago
I remember having issues with a corporate email system where base64/uuencoded data would fail to get through with a very rough dependency on size - large files had a smaller chance of getting through but it was clear that there wasn't a hard size limit. Eventually someone twigged that the problem was a "rude word" scanner, and that beyond a certain size you would hit the "scunthorpe" problem, and forbidden words would appear in the ASCII text randomly.

rodgerd 6y ago

The thing is, usability is security. People will do anything to be able to do their job (because people like being able to, you know, eat and stuff). Things that stop you doing your job are bad for security. I wish more of the security industry would get their frigging heads around this. PGP did less for messaging security over decades of availability than iMessage and Signal did in a few weeks of availability.