5 ms·

I bring in the Wisdom of James Mickens, PhD and research at MS to share my opinion on that advice. > Security people are like smarmy teenagers who listen to go

I bring in the Wisdom of James Mickens, PhD and research at MS to share my opinion on that advice. > Security people are like smarmy teenagers who listen to goth music: they are full of morbid and detailed monologues about the pervasive catastrophes that surround us, but they are much less interested in the practical topic of what people should do before we’re inevitably killed by ravens or a shortage of black mascara. It’s like, websites are amazing BUT DON’T CLICK ON THAT LINK, and your phone can run all of these amazing apps BUT MANY OF YOUR APPS ARE EVIL, and if you order a Russian bride on Craigslist YOU MAY GET A CONFUSED FILIPINO MAN WHO DOES NOT LIKE BEING SHIPPED IN A BOX. It’s not clear what else there is to do with computers besides click on things, run applications, and fill spiritual voids using destitute mail-ordered foreigners. If the security people are correct, then the only provably safe activity is to stare at a horseshoe whose integrity has been verified by a quorum of Rivest, Shamir, and Adleman. he concludes the paper by saying > However, as JohnF. Kennedy once said, “SCREW IT WE’RE GOING TO THE MOON.” I cannot live my life in fear because someone named PhreakusMaximus at DefConHat 2014 showed that you can induce peanut allergies at a distance using an SMS message and a lock of your victim’s hair. If that’s how it is, I accept it and move on. Thinking about security is like thinking about where to ride your motorcycle: the safe places are no fun, and the fun places are not safe. I shall ride wherever my spirit takes me, and I shall find my Gigantic Martian Insect Party, and I will, uh, probably be rent asunder by huge cryptozoological man- dibles, but I will die like Thomas Jefferson: free, defiant, and without a security label. With all the leaks and exposures, and backdoors we are finding out about we are now just learning how unsafe everything always has been, the security that we thought we had in OSes and cryptographic wizardry devised by intellectuals who exist on a different plane were not actually protecting us from the harsh elements of reality but were instead a security blanket we hid under hoping the outside wasn't real, but the internet and web is here, and it is terrfying and horrible and an insecure mess, but "I will die like Thomas Jefferson: free, defiant, and without a security label."

sixhobbits 5y ago
Thank you! I was trying to remember his name a few days ago to find his essays and it was driving me crazy - couldn't remember enough keywords to get past the 10000 content marketing articles on search engines.
notRobot 5y ago
This is kind of amazing, actually. Thanks for sharing! Link to paper for anyone else interested: https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- kzzzznot 5y ago
  Great read, thank you both. Have added this page to my reading list. https://mickens.seas.harvard.edu/wisdom-james-mickens https://mickens.seas.harvard.edu/wisdom-james-mickens
avgcorrection 5y ago
That paper looks delightful :)
onion2k 5y ago
It's a great paper, and what I wrote isn't in contention with the point Mickens makes. Rather than pretend that QR codes are a problem and dodgy domains aren't, it's better to peek out from the security blanket and understand the threats that exist no matter what. A QR is a danger just as a typed domain or a clicked link is a threat, so users should beware. That doesn't stop people living their lives, but instead gives them the awareness to check things occasionally when they look off, what to look out for as they go about their web business, and not to blindly trust what they see, or to blindly assume something is a threat because it's a code. Security people are like smarmy teenagers who listen to goth music FWIW I'm not a security person; I'm smarmy for entirely different reasons. I do quite like goth music though.
xtiansimon 5y ago
I can recognize sarcastic and flip cynical reason when I read it. Ground work for an ideology of distrust and irrationality. Meanwhile, don’t click on links you get in spam email and don’t visit QR-codes printed on stickers you find on the bus or subway is common sense and will serve you well.
devchix 5y ago
This is warm-and-fuzzy sounding sophistry. JFK didn't just say, "Screw it we're going to the moon." He put billions of funding and hired smart people to do it. The bad things that will happen to you is typically not an irate man shipped to you in a box. The first rule: don't lose the principal. That is, don't do stupid things that will get you hacked, whether the loss be small or large. I don't understand the necessity of QR code for a URL, they are worse than URL shortener. Is there an actual, valid, use case of QR codes, I can only think of 2FA key generation, and even that could be done pointing your camera at a string of digits? With OCR, you and your phone can see where you're going. Nobody is stopping you from going to fun, unsafe places, don't get robbed doing it, that's all we're saying. Edited to add: I think what made the QR code take off was restaurants putting them on their menus in the pandemic, so they could do touchless, menu-less ordering. Their ubiquitousness and the harmless environment in which they are encountered (restaurants, food, drinks, friends) acclimate people to using them and formed a habit and a perception when there had been none. It's not a new danger; unsafe URL had always been a danger, now it has a new benign look.

sixhobbits 5y ago

Thank you! I was trying to remember his name a few days ago to find his essays and it was driving me crazy - couldn't remember enough keywords to get past the 10000 content marketing articles on search engines.

notRobot 5y ago

This is kind of amazing, actually. Thanks for sharing! Link to paper for anyone else interested: https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf

kzzzznot 5y ago
Great read, thank you both. Have added this page to my reading list. https://mickens.seas.harvard.edu/wisdom-james-mickens https://mickens.seas.harvard.edu/wisdom-james-mickens

avgcorrection 5y ago

That paper looks delightful :)

onion2k 5y ago

It's a great paper, and what I wrote isn't in contention with the point Mickens makes. Rather than pretend that QR codes are a problem and dodgy domains aren't, it's better to peek out from the security blanket and understand the threats that exist no matter what. A QR is a danger just as a typed domain or a clicked link is a threat, so users should beware. That doesn't stop people living their lives, but instead gives them the awareness to check things occasionally when they look off, what to look out for as they go about their web business, and not to blindly trust what they see, or to blindly assume something is a threat because it's a code. Security people are like smarmy teenagers who listen to goth music FWIW I'm not a security person; I'm smarmy for entirely different reasons. I do quite like goth music though.

xtiansimon 5y ago

I can recognize sarcastic and flip cynical reason when I read it. Ground work for an ideology of distrust and irrationality. Meanwhile, don’t click on links you get in spam email and don’t visit QR-codes printed on stickers you find on the bus or subway is common sense and will serve you well.

devchix 5y ago

This is warm-and-fuzzy sounding sophistry. JFK didn't just say, "Screw it we're going to the moon." He put billions of funding and hired smart people to do it. The bad things that will happen to you is typically not an irate man shipped to you in a box. The first rule: don't lose the principal. That is, don't do stupid things that will get you hacked, whether the loss be small or large. I don't understand the necessity of QR code for a URL, they are worse than URL shortener. Is there an actual, valid, use case of QR codes, I can only think of 2FA key generation, and even that could be done pointing your camera at a string of digits? With OCR, you and your phone can see where you're going. Nobody is stopping you from going to fun, unsafe places, don't get robbed doing it, that's all we're saying. Edited to add: I think what made the QR code take off was restaurants putting them on their menus in the pandemic, so they could do touchless, menu-less ordering. Their ubiquitousness and the harmless environment in which they are encountered (restaurants, food, drinks, friends) acclimate people to using them and formed a habit and a perception when there had been none. It's not a new danger; unsafe URL had always been a danger, now it has a new benign look.