3 ms·

> “sophisticated” and “with resources of a nation-state.” Oops I've noticed this since the NK hacks in 2014 and it's bothered me. Why is this the reaction even

> “sophisticated” and “with resources of a nation-state.” Oops I've noticed this since the NK hacks in 2014 and it's bothered me. Why is this the reaction even in technologically savvy quarters?

creato 6y ago
This has several factors that lead people to make such comments: Tech nerds like to describe things as boring, obvious, and easy to do, it makes them feel smart. Certain politics lead people to assume that government is incompetent and therefore obviously it was an unsophisticated attack that breached them. A lot of IT workers think every instance of a hack is an example of underfunding the IT department, or the IT department wastes the budget they do have.
- syshum 6y ago
  >>Certain politics lead people to assume that government is incompetent I would say history leads people to assume that government is incompetent. We have plenty of evidence on which to form this conclusion >A lot of IT workers think every instance of a hack is an example of underfunding the IT department, Again this is also drawn from a place of experience, many of us have seen first hand organization refusing to put in the money needed to properly secure systems until AFTER their is a compromise, and then the money is only allocate for a few months to resolve the exact compromise that impacted the organization never really changing the security posture of the company / organization. This pattern is repeated over and over and over again
acdha 6y ago
I think it comes from the same place as “I could build that in a weekend”: people who know what most of the words mean but aren’t experienced enough to understand the difference between knowing in theory how something could work and successfully running a production-grade implementation. Security has a certain cachet which makes people want to sound like experts and one way to do that is to minimize others’ accomplishments, implicitly saying that they aren’t challenging to you.
- heartbreak 6y ago
  Someone actually responded to me (see below) implying that this attack could be developed by a single person in a single day. Impressive confidence.
  - edoceo 6y ago
    Software engineers are super good at estimating time-cost before the fact, right? (Disclaimer, I am terrible at it)
  - deleted 6y ago
    [deleted]
  - mikeyouse 6y ago
    In one of the threads about the Zodiac cypher, which had been unbroken for 51 years despite being given to the NSA, FBI, and the crypto community at large, there were several people who remarked how simple it was and how easy it should have been to crack. Dunning Kruger doesn’t cover the entirety of what’s happening, but there’s some pathology at work here.
    - oefrha 6y ago
      Meanwhile, the Zodiac story also demonstrates you don’t need to be a nation state to craft something sophisticated. Obfuscation and de-obfuscation aren’t on a level playing field. (This comment isn’t specifically about this attack.)
  - iJohnDoe 6y ago
    Just remember, it turns out those people are often below average intelligence. They can’t even understand how ridiculous they sound. Give them some spare pity and move on.
mhh__ 6y ago
Honestly HN seems to have a very contrarian streak on these matters. I wouldn't necessarily say it's partisan but the prevailing opinion seems to be whatever is against the mainstream view (Examples include Election Fraud, Assange, Litvinenko etc.)
IfOnlyYouKnew 6y ago
Nihilistic, cynical contrarianism is indistinguishable from intelligence unless you know a subject. Example: "Continents move around", "time slows if you're fast", and "turtles, all the way down" are all similarly ridiculous unless you've studied these subjects. People see the first two receiving lots of applause[1] and start making claims that to them are just as believable. [1]: Or they see footnotes being correlated with "serious science" and start adding footnotes.]2] [2]: For details on how references make people appear smart, see Feynman, 1968: Cargo-Culting. Also scientism [3]: A heuristic that in our experiments succeeded in identifying 0.65 of the lower 20-quantile of wannabe basement-warriors is to count the occurrences of the terms /threat (model|actor)/, /sigint/, /retcon/, /psyops/, /opsec/, and the phrase /everyone does it/. Exclude any >= 1.

creato 6y ago

This has several factors that lead people to make such comments: Tech nerds like to describe things as boring, obvious, and easy to do, it makes them feel smart. Certain politics lead people to assume that government is incompetent and therefore obviously it was an unsophisticated attack that breached them. A lot of IT workers think every instance of a hack is an example of underfunding the IT department, or the IT department wastes the budget they do have.

syshum 6y ago
>>Certain politics lead people to assume that government is incompetent I would say history leads people to assume that government is incompetent. We have plenty of evidence on which to form this conclusion >A lot of IT workers think every instance of a hack is an example of underfunding the IT department, Again this is also drawn from a place of experience, many of us have seen first hand organization refusing to put in the money needed to properly secure systems until AFTER their is a compromise, and then the money is only allocate for a few months to resolve the exact compromise that impacted the organization never really changing the security posture of the company / organization. This pattern is repeated over and over and over again

acdha 6y ago

I think it comes from the same place as “I could build that in a weekend”: people who know what most of the words mean but aren’t experienced enough to understand the difference between knowing in theory how something could work and successfully running a production-grade implementation. Security has a certain cachet which makes people want to sound like experts and one way to do that is to minimize others’ accomplishments, implicitly saying that they aren’t challenging to you.

heartbreak 6y ago
Someone actually responded to me (see below) implying that this attack could be developed by a single person in a single day. Impressive confidence.
- edoceo 6y ago
  Software engineers are super good at estimating time-cost before the fact, right? (Disclaimer, I am terrible at it)
- deleted 6y ago
  [deleted]
- mikeyouse 6y ago
  In one of the threads about the Zodiac cypher, which had been unbroken for 51 years despite being given to the NSA, FBI, and the crypto community at large, there were several people who remarked how simple it was and how easy it should have been to crack. Dunning Kruger doesn’t cover the entirety of what’s happening, but there’s some pathology at work here.
  - oefrha 6y ago
    Meanwhile, the Zodiac story also demonstrates you don’t need to be a nation state to craft something sophisticated. Obfuscation and de-obfuscation aren’t on a level playing field. (This comment isn’t specifically about this attack.)
- iJohnDoe 6y ago
  Just remember, it turns out those people are often below average intelligence. They can’t even understand how ridiculous they sound. Give them some spare pity and move on.

mhh__ 6y ago

Honestly HN seems to have a very contrarian streak on these matters. I wouldn't necessarily say it's partisan but the prevailing opinion seems to be whatever is against the mainstream view (Examples include Election Fraud, Assange, Litvinenko etc.)

IfOnlyYouKnew 6y ago

Nihilistic, cynical contrarianism is indistinguishable from intelligence unless you know a subject. Example: "Continents move around", "time slows if you're fast", and "turtles, all the way down" are all similarly ridiculous unless you've studied these subjects. People see the first two receiving lots of applause[1] and start making claims that to them are just as believable. [1]: Or they see footnotes being correlated with "serious science" and start adding footnotes.]2] [2]: For details on how references make people appear smart, see Feynman, 1968: Cargo-Culting. Also scientism [3]: A heuristic that in our experiments succeeded in identifying 0.65 of the lower 20-quantile of wannabe basement-warriors is to count the occurrences of the terms /threat (model|actor)/, /sigint/, /retcon/, /psyops/, /opsec/, and the phrase /everyone does it/. Exclude any >= 1.