4 ms·

Yeah, I was thinking to myself in the shower this morning how this wasn't the best analogy and someone was going to nitpick it. Maybe a better one is a forklif

Yeah, I was thinking to myself in the shower this morning how this wasn't the best analogy and someone was going to nitpick it. Maybe a better one is a forklift operator dropping something on someone because they didn't do their company-mandated safety training and pressed the wrong button. It was an accident, the guy didn't mean to hurt anyone, but he did because he was negligent and there has to be consequences for that.

aaomidi 5y ago
> and there has to be consequences for that. I literally don't get this "revenge" view point. Maybe we're just going to disagree here. The same way punishments don't work on dogs, children, etc. They also don't "stop" security incidents from happening. Your example is bad because proper access controls would: 1. Be designed in such a way that humans can follow them and that humans __do__ follow them. 2. If humans can't follow them, then humans shouldn't be involved at all. There are so many examples in this thread of "well this is against security training, but everyone does it anyway". That's a bad design. That's created for selective enforcement and makes the entire thing a joke.
- subjectsigma 5y ago
  It seems like we are just going to disagree. Talk to literally anyone who works with this kind of information and they would laugh at your comment. Your requirements as written cannot be practically implemented at scale across all organizations accessing classified info. Read an Security Classification Guide sometime, you will very quickly understand. There has to be a policy somewhere that says "We know you can technically do $THING, but don't or you will go to jail." EDIT: Sorry @dang I know I keep editing my comments a lot and you probably don't like that, but the more I think about it the more ridiculous these claims are the more miffed I get. Seriously, to all these people telling me that the NSA is just incompetent because someone went out of their way to commit a crime, imagine the following scenario: you tell someone a piece of classified information, they then walk over to an unclas computer and type that sentence in verbatim into their Gmail and hit 'Send'. Please design a crypto system, ACL, network architecture, workflow, any technical solution that could practically prevent that from happening across hundreds of organizations and probably millions of employees. I would bet you a lot of money you cannot.
  - aaomidi 5y ago
    None of what you're suggesting: 1. Undoes the damage done by the leak. 2. Prevents further leaks happening in the future. The only thing it does is ruin a person and their families life as they were entering retirement.
    - subjectsigma 5y ago
      I have made it pretty clear that you are incorrect about #2 (in a practical sense, not a literal one). There's nothing more to say.
      - aaomidi 5y ago
        Probably the case, I think we just fundamentally disagree on human behavior

aaomidi 5y ago

> and there has to be consequences for that. I literally don't get this "revenge" view point. Maybe we're just going to disagree here. The same way punishments don't work on dogs, children, etc. They also don't "stop" security incidents from happening. Your example is bad because proper access controls would: 1. Be designed in such a way that humans can follow them and that humans __do__ follow them. 2. If humans can't follow them, then humans shouldn't be involved at all. There are so many examples in this thread of "well this is against security training, but everyone does it anyway". That's a bad design. That's created for selective enforcement and makes the entire thing a joke.

subjectsigma 5y ago
It seems like we are just going to disagree. Talk to literally anyone who works with this kind of information and they would laugh at your comment. Your requirements as written cannot be practically implemented at scale across all organizations accessing classified info. Read an Security Classification Guide sometime, you will very quickly understand. There has to be a policy somewhere that says "We know you can technically do $THING, but don't or you will go to jail." EDIT: Sorry @dang I know I keep editing my comments a lot and you probably don't like that, but the more I think about it the more ridiculous these claims are the more miffed I get. Seriously, to all these people telling me that the NSA is just incompetent because someone went out of their way to commit a crime, imagine the following scenario: you tell someone a piece of classified information, they then walk over to an unclas computer and type that sentence in verbatim into their Gmail and hit 'Send'. Please design a crypto system, ACL, network architecture, workflow, any technical solution that could practically prevent that from happening across hundreds of organizations and probably millions of employees. I would bet you a lot of money you cannot.
- aaomidi 5y ago
  None of what you're suggesting: 1. Undoes the damage done by the leak. 2. Prevents further leaks happening in the future. The only thing it does is ruin a person and their families life as they were entering retirement.
  - subjectsigma 5y ago
    I have made it pretty clear that you are incorrect about #2 (in a practical sense, not a literal one). There's nothing more to say.
    - aaomidi 5y ago
      Probably the case, I think we just fundamentally disagree on human behavior