4 ms·

zero trust means no computer devices around you... (including TVs, toasters, etc...)

machinelabo 6y ago
You trust your can of baked beans? The entire society runs on the concept of trust. At some point, you're gonna have to trust someone.
- hutzlibu 6y ago
  True. But I like to reinforce my trust with open and verifiable information. Meaning, I would prefer the can of baked beans from a company that is open about where their beans come from and in what conditions. That would be possible today, and is already done to some extend but in early stages. But getting your food from the local farmer, where you can actually visit the farm, it is much more easy to trust that it is good. And regarding software, well - open source, preferably with a open community (or company) around it, where you can at least look through the actual dev logs and git submits to see if they sound solid and if you have the time and skills, jump into it to verify that they do as promised. Then I can have trust. Otherwise the trust would have to be blind. And society has spoiled that for me, for various reasons.
  - machinelabo 6y ago
    Huh? That's why we have regulations. Every country has one, in the US it is the FDA. Please don't try to shoehorn open source principles everywhere in life. It becomes a chore and a burden for a common citizen to verify the hazards of Baked Beans. Citizens offload this to a regulatory agency. You don't have the time to verify a fucking can of baked beans like a million other things in life. If you buy a measuring tape, do you ask for a NIST certificate? Where does the chain of trust end? Somewhere at the measurement standards in the pyramid of trust. Your personal role in this chain ends at the brand name "STANLEY", because you trust them to make a measuring tape that measures within specified tolerance. The whole movement around "I don't trust unless the information is freely available" is a pipe dream. It grinds the society to a halt. I urge you to look around 99% things in life that you just blindly trust. We need better mechanisms for building trust than "Don't trust unless verified". It is applicable in high risk situations, but the society pays a huge price for such an inefficient way to live.
    - hutzlibu 6y ago
      How do you know what things I trust blindly? But I agree, it is not efficient to question everything. I do not want to question everything! But I do know enough, to question a lot of things. Secrecy just allows bad things to stay hidden. If the default would be openness, then people who do bad things would hesitate more, as it would be easier to detect those things, don't you think? Whether it be government, food production or software.
      - machinelabo 6y ago
        I think one common theme we both can agree is that open available data only helps. It doesn't take away from anything. For those who want to verify, they can. They can look up FDA reports and inspection results. Transparency builds trust overtime.
        hutzlibu 6y ago
        "Transparency builds trust overtime." Yep. This is what I mean. I come from east germany, a former post sowjet state. A state which was build on blind trust on the state and no way for the common person to verify anything (or even dare to question anything openly). And big surprise: lots of dark things happened regulary. Now things are still far from perfect in my opinion, but much, much better. And I think they can still improve a lot with even more transparency, because there are still lots of dark things happening behind closed doors. We probably just disagree on the degree of those things.
        Spooky23 6y ago
        Fear and trust are not the same.
        tsimionescu 6y ago
        > A state which was build on blind trust on the state The former Soviet states and other USSR satellites were not built on trust, they were built on force. You had to act like you trusted the state to avoid the repressive force of the state. But people did not trust the state at all, much more so than in today's world. Everyone assumed their telephones were listened to. Everyone assumed that the walls had ears. The lies of the state were often obvious, and often discussed with very close friends and close family, and anything that wasn't an obvious lie was thus considered a likely lie anyway.
- TeMPOraL 6y ago
  The trick is to avoid trusting parties that have incentives to abuse that trust and means to do so. Free market working the way it does, sooner or later one of such entities will abuse that trust. So, baked beans are probably OK in terms of SIGINT. Depending on how well food regulations are enforced in your area, I might or might not worry about the edibility of them, though. But on-line services are definitely suspect with respect to data handling. Doubly so, if they pop up where they shouldn't be in the first place - like e.g. IoT - as that's already evidence of a business model built on abusive relationship.
  - lucb1e 6y ago
    > Doubly so, if they pop up where they shouldn't be in the first place - like e.g. IoT Hanlon's razor, "never attribute to malice that which is adequately explained by stupidity", does seem to apply to that particular one, though. But I'm no war historian or politician or something; while the security of these devices is stupidity to the point of criminal negligence, I find it hard to say for sure whether some of this might be on purpose.
    - nmlnn 6y ago
      That's just something people repeat over and over again until it seems true. In reality it just provides cover for malicious actors/actions.
      - bilbo0s 6y ago
        I agree. The CIA, NSA, DHS, etc are all much, much smarter than me, and I would use IoT to compromise targets if it were my job. So there's that data point.
    - TeMPOraL 6y ago
      I have my own razor[0], that I tend to call Hanlon's Handgun: "Never attribute to stupidity that which can be adequately explained by systemic incentives promoting malice". I think it applies here more than Hanlon's Original. Also, I wasn't thinking about security. I was thinking about intentional abuse of data, that starts with collecting and processing data that doesn't need to be done for a device to function. -- [0] - Introduced in https://news.ycombinator.com/item?id=21691282 https://news.ycombinator.com/item?id=21691282, named after me in https://news.ycombinator.com/item?id=21691718 https://news.ycombinator.com/item?id=21691718 :).
- markdown 6y ago
  Watties FTW!
- vaccinator 6y ago
  They'll probably figure out a non-suspicious way to include a computer in a can of bean soon enough... maybe it will let you know if the beans are still edible... in exchange, it will record everything you say.
  - CamperBob2 6y ago
    Coming soon: Juicero for Beans!

You trust your can of baked beans? The entire society runs on the concept of trust. At some point, you're gonna have to trust someone.

hutzlibu 6y ago
True. But I like to reinforce my trust with open and verifiable information. Meaning, I would prefer the can of baked beans from a company that is open about where their beans come from and in what conditions. That would be possible today, and is already done to some extend but in early stages. But getting your food from the local farmer, where you can actually visit the farm, it is much more easy to trust that it is good. And regarding software, well - open source, preferably with a open community (or company) around it, where you can at least look through the actual dev logs and git submits to see if they sound solid and if you have the time and skills, jump into it to verify that they do as promised. Then I can have trust. Otherwise the trust would have to be blind. And society has spoiled that for me, for various reasons.
- machinelabo 6y ago
  Huh? That's why we have regulations. Every country has one, in the US it is the FDA. Please don't try to shoehorn open source principles everywhere in life. It becomes a chore and a burden for a common citizen to verify the hazards of Baked Beans. Citizens offload this to a regulatory agency. You don't have the time to verify a fucking can of baked beans like a million other things in life. If you buy a measuring tape, do you ask for a NIST certificate? Where does the chain of trust end? Somewhere at the measurement standards in the pyramid of trust. Your personal role in this chain ends at the brand name "STANLEY", because you trust them to make a measuring tape that measures within specified tolerance. The whole movement around "I don't trust unless the information is freely available" is a pipe dream. It grinds the society to a halt. I urge you to look around 99% things in life that you just blindly trust. We need better mechanisms for building trust than "Don't trust unless verified". It is applicable in high risk situations, but the society pays a huge price for such an inefficient way to live.
  - hutzlibu 6y ago
    How do you know what things I trust blindly? But I agree, it is not efficient to question everything. I do not want to question everything! But I do know enough, to question a lot of things. Secrecy just allows bad things to stay hidden. If the default would be openness, then people who do bad things would hesitate more, as it would be easier to detect those things, don't you think? Whether it be government, food production or software.
    - machinelabo 6y ago
      I think one common theme we both can agree is that open available data only helps. It doesn't take away from anything. For those who want to verify, they can. They can look up FDA reports and inspection results. Transparency builds trust overtime.
      - hutzlibu 6y ago
        "Transparency builds trust overtime." Yep. This is what I mean. I come from east germany, a former post sowjet state. A state which was build on blind trust on the state and no way for the common person to verify anything (or even dare to question anything openly). And big surprise: lots of dark things happened regulary. Now things are still far from perfect in my opinion, but much, much better. And I think they can still improve a lot with even more transparency, because there are still lots of dark things happening behind closed doors. We probably just disagree on the degree of those things.
        Spooky23 6y ago
        Fear and trust are not the same.
        tsimionescu 6y ago
        > A state which was build on blind trust on the state The former Soviet states and other USSR satellites were not built on trust, they were built on force. You had to act like you trusted the state to avoid the repressive force of the state. But people did not trust the state at all, much more so than in today's world. Everyone assumed their telephones were listened to. Everyone assumed that the walls had ears. The lies of the state were often obvious, and often discussed with very close friends and close family, and anything that wasn't an obvious lie was thus considered a likely lie anyway.
TeMPOraL 6y ago
The trick is to avoid trusting parties that have incentives to abuse that trust and means to do so. Free market working the way it does, sooner or later one of such entities will abuse that trust. So, baked beans are probably OK in terms of SIGINT. Depending on how well food regulations are enforced in your area, I might or might not worry about the edibility of them, though. But on-line services are definitely suspect with respect to data handling. Doubly so, if they pop up where they shouldn't be in the first place - like e.g. IoT - as that's already evidence of a business model built on abusive relationship.
- lucb1e 6y ago
  > Doubly so, if they pop up where they shouldn't be in the first place - like e.g. IoT Hanlon's razor, "never attribute to malice that which is adequately explained by stupidity", does seem to apply to that particular one, though. But I'm no war historian or politician or something; while the security of these devices is stupidity to the point of criminal negligence, I find it hard to say for sure whether some of this might be on purpose.
  - nmlnn 6y ago
    That's just something people repeat over and over again until it seems true. In reality it just provides cover for malicious actors/actions.
    - bilbo0s 6y ago
      I agree. The CIA, NSA, DHS, etc are all much, much smarter than me, and I would use IoT to compromise targets if it were my job. So there's that data point.
  - TeMPOraL 6y ago
    I have my own razor[0], that I tend to call Hanlon's Handgun: "Never attribute to stupidity that which can be adequately explained by systemic incentives promoting malice". I think it applies here more than Hanlon's Original. Also, I wasn't thinking about security. I was thinking about intentional abuse of data, that starts with collecting and processing data that doesn't need to be done for a device to function. -- [0] - Introduced in https://news.ycombinator.com/item?id=21691282 https://news.ycombinator.com/item?id=21691282, named after me in https://news.ycombinator.com/item?id=21691718 https://news.ycombinator.com/item?id=21691718 :).
markdown 6y ago
Watties FTW!
vaccinator 6y ago
They'll probably figure out a non-suspicious way to include a computer in a can of bean soon enough... maybe it will let you know if the beans are still edible... in exchange, it will record everything you say.
- CamperBob2 6y ago
  Coming soon: Juicero for Beans!