3 ms·

Seems to have generally aged well, though I don't think much said here will be controversial.

• staticassertion 5y ago
  Oh, I kinda skimmed the "Hacking is not cool" bit. I sorta read the first bit of it as avoiding idolizing offensive research but they're actually saying that... you shouldn't learn to hack... at all. Dumb.
• IshKebab 5y ago
  It's too black and white though. For example I definitely agree that educating users shouldn't be "the solution". If you can make things secure in a way that doesn't require educating users then definitely do that. But security is about probabilities, and if you can effectively educate users then that will help improve the probabilities. There definitely are some attacks that you can't block completely and rely a bit on user savviness. His email example is a good one - sure you can block attachments, but what about emails from `johnsmith34@gmail.com` that just say "Hi, this is the CFO, my laptop died so I'm on my phone; please urgently wire £10m to 00-01-03 4058394!"? There are things you can do to help, but user education is definitely one of them. That said, my company has some bullshit online phishing training course and it is terrible. I don't think it would be hard to do a good online training course, but I doubt many are.
  • staticassertion 5y ago
    > It's too black and white though. Yeah, agreed, but I think in 2005 this was just sort of the common way to write about security. It was a lot more hostile, a lot more brazen. I think it's because the industry was even worse back then than it is now, with even weaker goal posts. We're in a better position now to discuss nuance today.