4 ms·

> If I was responsible for ... the only software that gets to run is the one I want running. Not wishing to pick on you personally, but the above paragraph i

> If I was responsible for ... the only software that gets to run is the one I want running. Not wishing to pick on you personally, but the above paragraph is wonderful example of the sort of logic going around that bothers me. You trace a faultless journey from responsibility to desiring total control. That's not what responsibility is. You're describing the feeling of culpability within a brutal regime - where Vader simply force-chokes a lieutenant for "failing me once too often". Responsibility involves leadership, which involves not stripping every subordinate of their agency, dignity and humanity. It involves trusting people. Sadly, computers make a "zero trust" ecosystem far too easy now, and that's how they can destroy our society. Good computing is figuring out ways to preserve liberal democratic society while also improving it.

api 4y ago
The problem isn’t that you can’t trust people. The problem is that people are defenseless in the face of malicious hackers with vastly more expertise and zero day vulnerabilities. It’s not that you can’t trust your employees. It’s that you can’t trust them to defend themselves from being mugged. The forcing function for all this removal of freedom is defense against malicious hackers. The removal of freedom is not the goal so much as a side effect. It works the same way in the real world. We would not need borders or armies or police if everyone were nice.
- nonrandomstring 4y ago
  Some good points. Lets see what we can do here: > The problem isn’t that you can’t trust people. Good. It's always best to have an optimistic view of our fellows, that's how we build good social structures. > The problem is that people are defenceless in the face of malicious hackers So. Make then not defenceless. We arm them. With education and other tools they need to defend themselves. Digital Self Defence (Or Digital Literacy 2.0 if you want a fluffier title) is the project I am committed to. Defensive tools belong in the hands of users. > with vastly more expertise We can balance the theatre twofold, by giving people more defensive capability, knowledge and rights, and by attacking the knowledge base and knowledge value of malicious actors. We must recognise that many of our own institutions play part of the problem, from vendor malware, and backdoors to security disinformation. Cyber-law needs radical reform to give end-user better security rights, and "surveillance capitalism" needs dragging to the dock. > zero day vulnerabilities. Starting maybe with an all out assault on "zero days", including the companies, agencies and re-sellers of them, using the law. > It’s that you can’t trust them to defend themselves from being mugged. Part of ones job then, is to enable them to defend themselves. You cannot follow your children around for the rest of their lives in case bullies pick on them. You need to teach them fighting skills so they won't be doormats. That's the reality of the digital workplace today. Also, don't give your kids gold Rolex Oyster watches and diamond rings to mooch around scuzzy neighbourhoods with. Limit assets, practice compartmentalisation. Half an ounce of sensible opsec is worth a ton of authoritarian technical non-solutions. > The removal of freedom is not the goal so much as a side effect. The removal of freedom is NEVER an acceptable "side effect" of any security action. Security and freedom are not diamtrics. Otherwise "the terrorists win" and one may as well join the ranks of malicious principles and directly attack our own people (which is the stance many US agencies have taken since 2001 toward baby and bath-water alike) > real world ... borders armies police But this isn't the real world. Its a digital one which is different. The old military model of perimeters and weapons isn't working and smart people in cybersecurity know that. The collateral damage of that broken model is our digital economy and liberal democracy itself (which are intimately linked in the American/Western mind if you believe one jot in things like startups and entrepreneurialism). We'll simply have to do better than handing over the responsibilities of our elected guardians to unelected companies considered by some [1] to be criminally motivated. We still have laws, schools and hopefully enough common sense to avoid that. EDIT: subtracted fulmination. [1] https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor.... https://en.wikipedia.org/wiki/Microsoft_litigation https://en.wikipedia.org/wiki/Microsoft_litigation
  - ranger207 4y ago
    > Make then not defenceless. This, simply put, doesn't work in an enterprise context. I'd argue that relying on people for security doesn't work in any context, and that it's about as effective as relying on programmers to not code memory leaks, but in companies where there's people whose _only_ use of a desktop computer is at work, as is increasingly common nowadays, it's simply not possible to get half the people out there to learn more than absolutely required to do their job. Go look at /r/sysadmin or /r/talesfromtechsupport: for some people it's a critical emergency if their desktop icons are rearranged because then their muscle memory to click on Chrome is broken. And that's not to mention executives who believe they're above things like "phishing awareness campaigns". Technical measures are much cheaper and vastly more effective than social measures directed at people who don't want to learn
    - nonrandomstring 4y ago
      It takes inner work to overcome a bleak view of people. It's too easy to eschew compassion and faith in fellow humans to improve themselves. I think the rehabilitation of our digital world asks us to give people greater "benefit of the doubt". Perhaps the hopeless people you describe are the product of a hopeless context - the "enterprise context" you mention. That culture seems to encourage intellectual sloth and shrugging ambivalence, and you give good examples. > Go look at /r/sysadmin or /r/ Please, I'd rather not :) > executives who believe they're above things like "phishing awareness campaigns My goodness I've met them. They're basically paid too much. I had to make a humint/influence piece for a major bank in London. Cybersec referred to it as "the cock problem"; basically mostly male with high six figure salaries whose security weakness was they "don't give a fuck". Same kind of fellas who would get pissed-up and drive their Aston Martin DB into a children's play-park. Major liability. They've learned they can transgress with impunity and just use money to solve it. What do they care if other people's money gets hacked? Not the best model for business, which requires a more upright mind-set to excel at. But banks don't exactly need to compete in a real business world. > Technical measures are much cheaper and vastly more effective Only in the short term. You'll need to forever keep your technical measures one step ahead of the mixture of malice and idiocy out there. A changed culture replicates and even grows itself.

api 4y ago

The problem isn’t that you can’t trust people. The problem is that people are defenseless in the face of malicious hackers with vastly more expertise and zero day vulnerabilities. It’s not that you can’t trust your employees. It’s that you can’t trust them to defend themselves from being mugged. The forcing function for all this removal of freedom is defense against malicious hackers. The removal of freedom is not the goal so much as a side effect. It works the same way in the real world. We would not need borders or armies or police if everyone were nice.

nonrandomstring 4y ago
Some good points. Lets see what we can do here: > The problem isn’t that you can’t trust people. Good. It's always best to have an optimistic view of our fellows, that's how we build good social structures. > The problem is that people are defenceless in the face of malicious hackers So. Make then not defenceless. We arm them. With education and other tools they need to defend themselves. Digital Self Defence (Or Digital Literacy 2.0 if you want a fluffier title) is the project I am committed to. Defensive tools belong in the hands of users. > with vastly more expertise We can balance the theatre twofold, by giving people more defensive capability, knowledge and rights, and by attacking the knowledge base and knowledge value of malicious actors. We must recognise that many of our own institutions play part of the problem, from vendor malware, and backdoors to security disinformation. Cyber-law needs radical reform to give end-user better security rights, and "surveillance capitalism" needs dragging to the dock. > zero day vulnerabilities. Starting maybe with an all out assault on "zero days", including the companies, agencies and re-sellers of them, using the law. > It’s that you can’t trust them to defend themselves from being mugged. Part of ones job then, is to enable them to defend themselves. You cannot follow your children around for the rest of their lives in case bullies pick on them. You need to teach them fighting skills so they won't be doormats. That's the reality of the digital workplace today. Also, don't give your kids gold Rolex Oyster watches and diamond rings to mooch around scuzzy neighbourhoods with. Limit assets, practice compartmentalisation. Half an ounce of sensible opsec is worth a ton of authoritarian technical non-solutions. > The removal of freedom is not the goal so much as a side effect. The removal of freedom is NEVER an acceptable "side effect" of any security action. Security and freedom are not diamtrics. Otherwise "the terrorists win" and one may as well join the ranks of malicious principles and directly attack our own people (which is the stance many US agencies have taken since 2001 toward baby and bath-water alike) > real world ... borders armies police But this isn't the real world. Its a digital one which is different. The old military model of perimeters and weapons isn't working and smart people in cybersecurity know that. The collateral damage of that broken model is our digital economy and liberal democracy itself (which are intimately linked in the American/Western mind if you believe one jot in things like startups and entrepreneurialism). We'll simply have to do better than handing over the responsibilities of our elected guardians to unelected companies considered by some [1] to be criminally motivated. We still have laws, schools and hopefully enough common sense to avoid that. EDIT: subtracted fulmination. [1] https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor.... https://en.wikipedia.org/wiki/Microsoft_litigation https://en.wikipedia.org/wiki/Microsoft_litigation
- ranger207 4y ago
  > Make then not defenceless. This, simply put, doesn't work in an enterprise context. I'd argue that relying on people for security doesn't work in any context, and that it's about as effective as relying on programmers to not code memory leaks, but in companies where there's people whose _only_ use of a desktop computer is at work, as is increasingly common nowadays, it's simply not possible to get half the people out there to learn more than absolutely required to do their job. Go look at /r/sysadmin or /r/talesfromtechsupport: for some people it's a critical emergency if their desktop icons are rearranged because then their muscle memory to click on Chrome is broken. And that's not to mention executives who believe they're above things like "phishing awareness campaigns". Technical measures are much cheaper and vastly more effective than social measures directed at people who don't want to learn
  - nonrandomstring 4y ago
    It takes inner work to overcome a bleak view of people. It's too easy to eschew compassion and faith in fellow humans to improve themselves. I think the rehabilitation of our digital world asks us to give people greater "benefit of the doubt". Perhaps the hopeless people you describe are the product of a hopeless context - the "enterprise context" you mention. That culture seems to encourage intellectual sloth and shrugging ambivalence, and you give good examples. > Go look at /r/sysadmin or /r/ Please, I'd rather not :) > executives who believe they're above things like "phishing awareness campaigns My goodness I've met them. They're basically paid too much. I had to make a humint/influence piece for a major bank in London. Cybersec referred to it as "the cock problem"; basically mostly male with high six figure salaries whose security weakness was they "don't give a fuck". Same kind of fellas who would get pissed-up and drive their Aston Martin DB into a children's play-park. Major liability. They've learned they can transgress with impunity and just use money to solve it. What do they care if other people's money gets hacked? Not the best model for business, which requires a more upright mind-set to excel at. But banks don't exactly need to compete in a real business world. > Technical measures are much cheaper and vastly more effective Only in the short term. You'll need to forever keep your technical measures one step ahead of the mixture of malice and idiocy out there. A changed culture replicates and even grows itself.