3 ms·

I’d argue that if trespassing and burglary weren’t treated as crimes but rather as natural occurrences we’d have a much more robust home security culture today.

by ummonk 3y ago

I’d argue that if trespassing and burglary weren’t treated as crimes but rather as natural occurrences we’d have a much more robust home security culture today. It would also be a lot more fun to be a trespasser.

Retric 3y ago
Hacking requires software or hardware vulnerabilities, without them it’s possible to have a completely invulnerable computer system. Users are frequently blamed, but the dumbest user can’t leak credentials that don’t exist. Home security has no perfectly secure state.
- majormajor 3y ago
  The odds of "nobody ever accidentally writing a security bug" are astronomically low. Were hacking legal, the risk/reward calculation still encourages huge amounts of effort spent on hacking. No matter how robust your programming security culture, mistakes will happen. And the people who exploited them could have HUGE gains. All for only risking having wasted their time in failure.
  - 3np 3y ago
    > Were hacking legal Do consider "we're hacking legal" or "hacking the legal system", which is widely practiced by corporatae everywhere. Why should it be OK to hack the legal rules set in place by regulators and not the business rules set in place by a business or individual? In both cases it typically involves finding loopholes that allow you to get what you normally wouldn't, while complying with de-facto implementation of rules. (E.g. rooting an Android phone you bought, or requesting data from a publicly readable but probably misconfigured S3 bucket).
    - dahfizz 3y ago
      > while complying with de-facto implementation of rules. If someone leaves their front door unlocked, does that give you permission to enter and take whatever you want? There is this insane notion that if you can accomplish something in cyber space, then you are allowed to. That's not how society works.
      - 3np 3y ago
        I didn't and wouldn't go that far. Logging in to a remote server with default credentials and wiping remote data after exfiltration would be a closer example to that than the ones I gave, and to answer the rhetorical question: no. There's a big difference when you start talking about destruction of data for others, faking credentials in interactions with a third-party, and/or knowingly causing remote unavailability. > There is this insane notion that if you can accomplish something in cyber space, then you are allowed to. That's not how society works. What my previous comment is trying to challenge is the rules-for-thee-and-not-for-me dogma which means that publicly exposing private records of others on an unprotected S3 bucket is an oopsie-daisie while an individual doing a request for it risks ending up in jail. https://arstechnica.com/tech-policy/2022/02/missouri-governor-rebuffed-journalist-wont-be-prosecuted-for-viewing-html https://arstechnica.com/tech-policy/2022/02/missouri-governo... > Gov. Parson's office continues to insist that the journalist committed a crime. "The hacking of Missouri teachers' personally identifiable information is a clear violation of Section 569.095, which the state takes seriously." > "It is unlawful to access encoded data and systems in order to examine other people's personal information, and we are coordinating state resources to respond and utilize all legal methods available," Parson said in October. https://en.wikipedia.org/wiki/Ola_Bini https://en.wikipedia.org/wiki/Ola_Bini
  - Retric 3y ago
    The possibility of creating a given security bug depends on a host of things such as network connectivity, system architecture, computer language etc. These decisions were made early so we wouldn’t see anything like the current internet, operating systems, or even hardware etc in such a world. Granted, computer systems would presumably suck in such a world but that’s a different question. It’s likely the risk/reword would actually be worse in such a world as fewer things would be possible to exploit for meaningful gain.
piffey 3y ago
Electricity moving between boxes is not equivalent to physical spaces in reality.
- forinti 3y ago
  No, but the financial loss can be just as bad and sometimes many times larger.
- ummonk 3y ago
  True. If someone electronically drains your bank account that's totally different from someone robbing your safe.

by ummonk 3y ago

Retric 3y ago

Hacking requires software or hardware vulnerabilities, without them it’s possible to have a completely invulnerable computer system. Users are frequently blamed, but the dumbest user can’t leak credentials that don’t exist. Home security has no perfectly secure state.

majormajor 3y ago
The odds of "nobody ever accidentally writing a security bug" are astronomically low. Were hacking legal, the risk/reward calculation still encourages huge amounts of effort spent on hacking. No matter how robust your programming security culture, mistakes will happen. And the people who exploited them could have HUGE gains. All for only risking having wasted their time in failure.
- 3np 3y ago
  > Were hacking legal Do consider "we're hacking legal" or "hacking the legal system", which is widely practiced by corporatae everywhere. Why should it be OK to hack the legal rules set in place by regulators and not the business rules set in place by a business or individual? In both cases it typically involves finding loopholes that allow you to get what you normally wouldn't, while complying with de-facto implementation of rules. (E.g. rooting an Android phone you bought, or requesting data from a publicly readable but probably misconfigured S3 bucket).
  - dahfizz 3y ago
    > while complying with de-facto implementation of rules. If someone leaves their front door unlocked, does that give you permission to enter and take whatever you want? There is this insane notion that if you can accomplish something in cyber space, then you are allowed to. That's not how society works.
    - 3np 3y ago
      I didn't and wouldn't go that far. Logging in to a remote server with default credentials and wiping remote data after exfiltration would be a closer example to that than the ones I gave, and to answer the rhetorical question: no. There's a big difference when you start talking about destruction of data for others, faking credentials in interactions with a third-party, and/or knowingly causing remote unavailability. > There is this insane notion that if you can accomplish something in cyber space, then you are allowed to. That's not how society works. What my previous comment is trying to challenge is the rules-for-thee-and-not-for-me dogma which means that publicly exposing private records of others on an unprotected S3 bucket is an oopsie-daisie while an individual doing a request for it risks ending up in jail. https://arstechnica.com/tech-policy/2022/02/missouri-governor-rebuffed-journalist-wont-be-prosecuted-for-viewing-html https://arstechnica.com/tech-policy/2022/02/missouri-governo... > Gov. Parson's office continues to insist that the journalist committed a crime. "The hacking of Missouri teachers' personally identifiable information is a clear violation of Section 569.095, which the state takes seriously." > "It is unlawful to access encoded data and systems in order to examine other people's personal information, and we are coordinating state resources to respond and utilize all legal methods available," Parson said in October. https://en.wikipedia.org/wiki/Ola_Bini https://en.wikipedia.org/wiki/Ola_Bini
- Retric 3y ago
  The possibility of creating a given security bug depends on a host of things such as network connectivity, system architecture, computer language etc. These decisions were made early so we wouldn’t see anything like the current internet, operating systems, or even hardware etc in such a world. Granted, computer systems would presumably suck in such a world but that’s a different question. It’s likely the risk/reword would actually be worse in such a world as fewer things would be possible to exploit for meaningful gain.

piffey 3y ago

Electricity moving between boxes is not equivalent to physical spaces in reality.

forinti 3y ago
No, but the financial loss can be just as bad and sometimes many times larger.
ummonk 3y ago
True. If someone electronically drains your bank account that's totally different from someone robbing your safe.