4 ms·

Only playing defense won't work for nation states due to similar thought processes of mutually assured destruction. If you're enemy has a bigger and scarier gun

Only playing defense won't work for nation states due to similar thought processes of mutually assured destruction. If you're enemy has a bigger and scarier gun, it puts you at a disadvantage in geo politics. Also, I'm not sure the clear line is that clear. There will almost always be a tipping point for people for this type of scenario. If the hacking operation that was exposed would have prevented an attack that kills 1 person, was it still OK to expose? 100 people? 10,000? It's almost impossible to know what the exposure cost will be but if people die due to it and it becomes known, some people will rethink what the "right" thing to do was. This type of stuff seems like it should be decided by elected representatives and not by some team of coders that work for some for profit company. It seems possible to me that the decision they made was based purely on what was best for Google. I think we as tech workers need to acknowledge and understand the viewpoints contrary to ours and try to compromise with those on the other side. This type of issue is complex and I think we really need to acknowledge that there is no easy "right" solution to something like this. Blind idealism on both sides of the issue won't be good for either side or for society in general. We as tech workers are not infallible and we don't deserve to dictate rules to society just because we know how to write code.

eqvinox 6y ago
> [...] mutually assured destruction [...] But that's exactly what this is not. Every big and scary gun the enemy might have is also a big and scary vulnerability that you could fix. While it's infeasible to have "perfect" security, you can absolutely make the enemy's offensive tools useless. It's especially bad since when working offensively, you're incentivized to not fix issues. That might be OK for black hats & nations with "questionable" ethics, but how is this a thing in any democratic country? When state agencies are sitting on exploits and purposely not working to get them fixed, that's IMHO a kind of treason on your own country. It's leaving entry points open for others to find. And anything you can find, they can find too. > Also, I'm not sure the clear line is that clear. [...] prevented an attack that kills 1 person, was it still OK to expose? 100 people? 10,000? [...] The line is clear, because that attack that the "goodie" western hackers couldn't execute, and possibly resulted in deaths, might as well be an attack that the "baddie" hackers couldn't execute, resulting in people surviving. Systems are generally designed such that working correctly is the intended best state (even for weapons support systems.) More work going towards keeping systems within their design parameters (i.e. not hacked) should be the best way to save lives. Even if we're talking about some terrorist building a computerized IED, there are likely systems whose correct functioning can help save lives - maybe some chemical detectors at an airport, or first responder management systems, etc. It's also the only line that can be drawn on an objective standard. Regardless of whether you're the USA, EU, China, or North Korea - "systems functioning correctly to their design" is an universal standard. Do you think North Korea cares about any life that isn't their bonzo supreme leader?
- bostonsre 6y ago
  > While it's infeasible to have "perfect" security, you can absolutely make the enemy's offensive tools useless. This seems contradictory. If its not possible to have perfect security, how are you supposed to make your enemy's offensive tools useless? > It's especially bad since when working offensively, you're incentivized to not fix issues. That might be OK for black hats & nations with "questionable" ethics, but how is this a thing in any democratic country? When state agencies are sitting on exploits and purposely not working to get them fixed, that's IMHO a kind of treason on your own country. It's leaving entry points open for others to find. And anything you can find, they can find too. Yes, it is an extremely gray area that is tough to find an easy answer to. Whatever ideals you want to stick to, the fact is the other side more likely than not will not play by your ideal/"right" rules. It seems like China and Russia have no plans on slowing down pilfering intellectual property and causing chaos in the US. Is it really a good idea for the US to throw down all offensive cyber weapons for some ideal? That would only encourage China and Russia to act worse knowing that they don't have to worry about repercussions from their actions. > The line is clear, because that attack that the "goodie" western hackers couldn't execute, and possibly resulted in deaths, might as well be an attack that the "baddie" hackers couldn't execute, resulting in people surviving. In this case, the article was about google exposing a hacking operation of a government that was trying to prevent terrorism. If the terrorists are able to kill people due to this government operation being shutdown are you saying that it was better for google to have exposed it just because security flaws are bad and should be fixed? It isn't possible to know for sure which side is "right" in this situation. If the operation would have prevented deaths with no collateral deaths on the other side, how can anyone say that preventing some bits on computers being moved in unexpected ways is better than having people die? > Even if we're talking about some terrorist building a computerized IED, there are likely systems whose correct functioning can help save lives - maybe some chemical detectors at an airport, or first responder management systems, etc. > It's also the only line that can be drawn on an objective standard. Regardless of whether you're the USA, EU, China, or North Korea - "systems functioning correctly to their design" is an universal standard. Clean, well designed and secure systems are nice and all but I don't a large majority of non-tech workers will agree that this standard trumps every other consideration when it comes to a functioning society. It doesn't seem fair that some tech workers like clean design and they deserve to dictate what is right and wrong in society.
pm90 6y ago
You make some really good points. Encryption advocates aren’t just pursuing some vague ideal though. The case they’re making is just that deliberately weakening encryption for one party weakens it for everyone. In these discussions we should also distinguish between attacks by nation states and those by non state actors. It seems the argument for weakening encryption is mostly to catch or prevent illegal activities by non state actors who likely lack the sophistication to understand weak encryption fully. State actors would almost certainly know and avoid using weak encryption. But it gets more interesting. Law enforcement is a perennial cat and mouse game. You catch today’s criminals harnessing weak encryption, the next generation of baddies will get smarter. The end result is weak encryption for everyone, without really helping society except to maybe catch the “current generation of baddies”. Advocates for strong encryption point out that this is an extremely short term and stupid thinking that destroys the protection offered by cryptography without really giving us all that much anyway.
- bostonsre 6y ago
  Yes, I completely agree that weakening encryption is an incredibly slippery slope. I don't know what the right answer is. I just know that a lot of people would not be happy with a government that did not do everything in their power to prevent horrible acts from happening. There are bad people in this world that would not think twice about murdering thousands of innocent men, women, and children. To have the government immediately report any vulnerabilities that they find instead of using those findings to do good for their citizens will be a hard pill for most of the population to swallow. It will absolutely have negative consequences when they don't report those vulnerabilities immediately though. For a government to do perfectly well for its population, it would need to stay on the cutting edge of technology and ensure its population has the best security while at the same time staying able to exploit the security of their adversaries. But that would be incredibly hard to do. On the completely secure systems end of the spectrum, bad people will take advantage of that complete security. You wouldn't have to worry about having your identity stolen, but I don't know how we would prevent bad actors like organized criminals or terrorists from taking advantage of those completely anonymous and secure tools. I'm also not too sure what living in an authoritarian regime with complete security would look like. Maybe dissidents would still have tools to fight the regime or maybe the regime would be better at controlling the population and squashing dissent.
cycomanic 6y ago
I really don't think the issue is complex. The whole what if 1 person dies, 100 people, 10,000 is a red herring. Also whom should we trust with saying this many people would do if it gets exposed the IC? Just look at the NSA list of how FISA protects the US [1], that's the justification for the biggest spying operation in human history aimed not only at foreign agents but also allied governments, their own citizens etc.. It's funny that it's being used as an argument for why 702 is good, because considering the scale of the operation it's almost laughable. Even more, how many of those points would have been exposed by old fashioned spying. [1] https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/1627009/section-702-saves-lives-protects-the-nation-and-allies/ https://www.nsa.gov/News-Features/Feature-Stories/Article-Vi...

eqvinox 6y ago

> [...] mutually assured destruction [...] But that's exactly what this is not. Every big and scary gun the enemy might have is also a big and scary vulnerability that you could fix. While it's infeasible to have "perfect" security, you can absolutely make the enemy's offensive tools useless. It's especially bad since when working offensively, you're incentivized to not fix issues. That might be OK for black hats & nations with "questionable" ethics, but how is this a thing in any democratic country? When state agencies are sitting on exploits and purposely not working to get them fixed, that's IMHO a kind of treason on your own country. It's leaving entry points open for others to find. And anything you can find, they can find too. > Also, I'm not sure the clear line is that clear. [...] prevented an attack that kills 1 person, was it still OK to expose? 100 people? 10,000? [...] The line is clear, because that attack that the "goodie" western hackers couldn't execute, and possibly resulted in deaths, might as well be an attack that the "baddie" hackers couldn't execute, resulting in people surviving. Systems are generally designed such that working correctly is the intended best state (even for weapons support systems.) More work going towards keeping systems within their design parameters (i.e. not hacked) should be the best way to save lives. Even if we're talking about some terrorist building a computerized IED, there are likely systems whose correct functioning can help save lives - maybe some chemical detectors at an airport, or first responder management systems, etc. It's also the only line that can be drawn on an objective standard. Regardless of whether you're the USA, EU, China, or North Korea - "systems functioning correctly to their design" is an universal standard. Do you think North Korea cares about any life that isn't their bonzo supreme leader?

bostonsre 6y ago
> While it's infeasible to have "perfect" security, you can absolutely make the enemy's offensive tools useless. This seems contradictory. If its not possible to have perfect security, how are you supposed to make your enemy's offensive tools useless? > It's especially bad since when working offensively, you're incentivized to not fix issues. That might be OK for black hats & nations with "questionable" ethics, but how is this a thing in any democratic country? When state agencies are sitting on exploits and purposely not working to get them fixed, that's IMHO a kind of treason on your own country. It's leaving entry points open for others to find. And anything you can find, they can find too. Yes, it is an extremely gray area that is tough to find an easy answer to. Whatever ideals you want to stick to, the fact is the other side more likely than not will not play by your ideal/"right" rules. It seems like China and Russia have no plans on slowing down pilfering intellectual property and causing chaos in the US. Is it really a good idea for the US to throw down all offensive cyber weapons for some ideal? That would only encourage China and Russia to act worse knowing that they don't have to worry about repercussions from their actions. > The line is clear, because that attack that the "goodie" western hackers couldn't execute, and possibly resulted in deaths, might as well be an attack that the "baddie" hackers couldn't execute, resulting in people surviving. In this case, the article was about google exposing a hacking operation of a government that was trying to prevent terrorism. If the terrorists are able to kill people due to this government operation being shutdown are you saying that it was better for google to have exposed it just because security flaws are bad and should be fixed? It isn't possible to know for sure which side is "right" in this situation. If the operation would have prevented deaths with no collateral deaths on the other side, how can anyone say that preventing some bits on computers being moved in unexpected ways is better than having people die? > Even if we're talking about some terrorist building a computerized IED, there are likely systems whose correct functioning can help save lives - maybe some chemical detectors at an airport, or first responder management systems, etc. > It's also the only line that can be drawn on an objective standard. Regardless of whether you're the USA, EU, China, or North Korea - "systems functioning correctly to their design" is an universal standard. Clean, well designed and secure systems are nice and all but I don't a large majority of non-tech workers will agree that this standard trumps every other consideration when it comes to a functioning society. It doesn't seem fair that some tech workers like clean design and they deserve to dictate what is right and wrong in society.

pm90 6y ago

You make some really good points. Encryption advocates aren’t just pursuing some vague ideal though. The case they’re making is just that deliberately weakening encryption for one party weakens it for everyone. In these discussions we should also distinguish between attacks by nation states and those by non state actors. It seems the argument for weakening encryption is mostly to catch or prevent illegal activities by non state actors who likely lack the sophistication to understand weak encryption fully. State actors would almost certainly know and avoid using weak encryption. But it gets more interesting. Law enforcement is a perennial cat and mouse game. You catch today’s criminals harnessing weak encryption, the next generation of baddies will get smarter. The end result is weak encryption for everyone, without really helping society except to maybe catch the “current generation of baddies”. Advocates for strong encryption point out that this is an extremely short term and stupid thinking that destroys the protection offered by cryptography without really giving us all that much anyway.

bostonsre 6y ago
Yes, I completely agree that weakening encryption is an incredibly slippery slope. I don't know what the right answer is. I just know that a lot of people would not be happy with a government that did not do everything in their power to prevent horrible acts from happening. There are bad people in this world that would not think twice about murdering thousands of innocent men, women, and children. To have the government immediately report any vulnerabilities that they find instead of using those findings to do good for their citizens will be a hard pill for most of the population to swallow. It will absolutely have negative consequences when they don't report those vulnerabilities immediately though. For a government to do perfectly well for its population, it would need to stay on the cutting edge of technology and ensure its population has the best security while at the same time staying able to exploit the security of their adversaries. But that would be incredibly hard to do. On the completely secure systems end of the spectrum, bad people will take advantage of that complete security. You wouldn't have to worry about having your identity stolen, but I don't know how we would prevent bad actors like organized criminals or terrorists from taking advantage of those completely anonymous and secure tools. I'm also not too sure what living in an authoritarian regime with complete security would look like. Maybe dissidents would still have tools to fight the regime or maybe the regime would be better at controlling the population and squashing dissent.

cycomanic 6y ago

I really don't think the issue is complex. The whole what if 1 person dies, 100 people, 10,000 is a red herring. Also whom should we trust with saying this many people would do if it gets exposed the IC? Just look at the NSA list of how FISA protects the US [1], that's the justification for the biggest spying operation in human history aimed not only at foreign agents but also allied governments, their own citizens etc.. It's funny that it's being used as an argument for why 702 is good, because considering the scale of the operation it's almost laughable. Even more, how many of those points would have been exposed by old fashioned spying. [1] https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/1627009/section-702-saves-lives-protects-the-nation-and-allies/ https://www.nsa.gov/News-Features/Feature-Stories/Article-Vi...