32 ms·

> such a law does nothing against proper criminals. Doesn't sound right to me; The intersection between criminals and people with good information opsec is ti

by ska 5y ago

> such a law does nothing against proper criminals. Doesn't sound right to me; The intersection between criminals and people with good information opsec is tiny(mostly because the latter category is tiny anyway). I agree the law is problematic, but not for that reason.

runarberg 5y ago
Out of curiosity. Why do you mention the latter group (people with good information opsec) is tiny when the former group (criminals) is probably an order of magnitude smaller?
- mLuby 5y ago
  Honestly I thought you were way off base and that the number of criminals would be orders of magnitude higher than infosec workers, but apparently I'm wrong. "in 2020, there were 1.8 million people in prison" [1] "[in 2019,] the country’s total employed cybersecurity workforce is just 716,000" [2] "There are about 465,000 open positions in cybersecurity nationwide as of May 2021" [3] [1]: https://easyreadernews.com/why-are-so-many-americans-in-prison-in-2021/ https://easyreadernews.com/why-are-so-many-americans-in-pris... [2]: https://www.csis.org/analysis/cybersecurity-workforce-gap https://www.csis.org/analysis/cybersecurity-workforce-gap [3]: https://www.cbsnews.com/news/cybersecurity-job-openings-united-states/ https://www.cbsnews.com/news/cybersecurity-job-openings-unit...
  - deleted 5y ago
    [deleted]
- throwaway744678 5y ago
  (Not OP) It does not really matter: if someone is a criminal (however tiny that group is), and we make the (reasonable?) hypothesis that criminals are not more (nor less) informed that the general population, the intersection is really tiny. tiny * tiny = very tiny
  - deleted 5y ago
    [deleted]
  - runarberg 5y ago
    Two two variables aren’t independent so you can’t just multiply the two. You must account for their covariance before you do that.
- ska 5y ago
  > is tiny when the former group (criminals) is probably an order of magnitude smaller? How did you arrive at that? Even a significant fraction of people I know who do security work would agree they don't in general have good info opsec, because it's a pain in the ass. Most of the technical people I know wouldn't even know how to do it properly. "Criminals" is hard to define precisely, but some small integer percent is at least a reasonable lower bound. Afaics people who are actually good at info opsec don't number in the millions. So even if we simplify by assuming the rough magnitude of both groups is the same, you still have the intersection of two small groups -> tiny. This is probably complicated a little bit because criminals have more incentive than average, if not more experience.
- fedreserved 5y ago
  Many smaller rust belt cities where the factories left the majority of employment is drug dealing. I have to imagine there's a sizable minority in states like California/Colorado/Washington etc with marijuana growers
- luke2m 5y ago
  Re to mLuby: you don’t have to work in infosec to be worried about it.
  - jeltz 5y ago
    But not everyone in infosec have good security because it is a pain in the ass. I would say people with good personal infosec is at most the same order of magnitude as criminals but probably fewer.

by ska 5y ago

runarberg 5y ago

Out of curiosity. Why do you mention the latter group (people with good information opsec) is tiny when the former group (criminals) is probably an order of magnitude smaller?

mLuby 5y ago
Honestly I thought you were way off base and that the number of criminals would be orders of magnitude higher than infosec workers, but apparently I'm wrong. "in 2020, there were 1.8 million people in prison" [1] "[in 2019,] the country’s total employed cybersecurity workforce is just 716,000" [2] "There are about 465,000 open positions in cybersecurity nationwide as of May 2021" [3] [1]: https://easyreadernews.com/why-are-so-many-americans-in-prison-in-2021/ https://easyreadernews.com/why-are-so-many-americans-in-pris... [2]: https://www.csis.org/analysis/cybersecurity-workforce-gap https://www.csis.org/analysis/cybersecurity-workforce-gap [3]: https://www.cbsnews.com/news/cybersecurity-job-openings-united-states/ https://www.cbsnews.com/news/cybersecurity-job-openings-unit...
- deleted 5y ago
  [deleted]
throwaway744678 5y ago
(Not OP) It does not really matter: if someone is a criminal (however tiny that group is), and we make the (reasonable?) hypothesis that criminals are not more (nor less) informed that the general population, the intersection is really tiny. tiny * tiny = very tiny
- deleted 5y ago
  [deleted]
- runarberg 5y ago
  Two two variables aren’t independent so you can’t just multiply the two. You must account for their covariance before you do that.
ska 5y ago
> is tiny when the former group (criminals) is probably an order of magnitude smaller? How did you arrive at that? Even a significant fraction of people I know who do security work would agree they don't in general have good info opsec, because it's a pain in the ass. Most of the technical people I know wouldn't even know how to do it properly. "Criminals" is hard to define precisely, but some small integer percent is at least a reasonable lower bound. Afaics people who are actually good at info opsec don't number in the millions. So even if we simplify by assuming the rough magnitude of both groups is the same, you still have the intersection of two small groups -> tiny. This is probably complicated a little bit because criminals have more incentive than average, if not more experience.
fedreserved 5y ago
Many smaller rust belt cities where the factories left the majority of employment is drug dealing. I have to imagine there's a sizable minority in states like California/Colorado/Washington etc with marijuana growers
luke2m 5y ago
Re to mLuby: you don’t have to work in infosec to be worried about it.
- jeltz 5y ago
  But not everyone in infosec have good security because it is a pain in the ass. I would say people with good personal infosec is at most the same order of magnitude as criminals but probably fewer.