4 ms·

It is absolutely bonkers how many otherwise pretty reasonable people miss this glaringly obvious fact.

tqi 3y ago
We are all vulnerable to confirmation bias
snake_doc 3y ago
A common analogy is to think about traffic lights. If you run a penetration test, asking an individual to run a red light. You will achieve near 100% success. However, when the traffic lights change actors’ behaviors to stop (at some probability such that it results in less collisions), most actors will stop according to the traffic lights.
- RiceRichardJ 3y ago
  That's not a good analogy at all. The incentives and motivations are completely different. Many drivers would at one point or another consider running a red light in order to save some time. I don't think you can say the same about passengers wanting to hijack a flight.
CamperBob2 3y ago
"Aspects of deterrence and standardization required by the program fundamentally changes the threat actors’ calculus." “By your logic I could claim that this rock keeps tigers away.” “Oh, how does it work?” “It doesn’t work.” “Uh-huh.” “It’s just a stupid rock.” “Uh-huh.” “But I don’t see any tigers around, do you?” “Lisa, I want to buy your rock.”
- tadfisher 3y ago
  Fear will keep the local systems in line. Fear of this battle station.
- ethanbond 3y ago
  Do you believe there aren’t people who wish to use air travel for nefarious purposes? Do you believe that none of those people are factoring in the presence of identity checks, x-rays, backscatters, bomb dogs, and metal detectors into their risk/reward calculation or the techniques by which they’d commit nefarious acts?
  - gaganyaan 3y ago
    They're probably factoring in strengthened cockpit doors and passengers' willingness to fight back, because those actually work. The rest is security theater.
    - tmpX7dMeXU 3y ago
      If you are going to resort to “it is because it is”, leave and let someone else argue your side.
- majormajor 3y ago
  And on the opposite side of the stupid-examples spectrum: any tech company that hasn't had a computer security breach should fire their security team. All they're doing is spending a lot of money to make their developer's lives a lot harder. Anyone with clean floors should fire their janitors. Etc... Those don't mean every security spend is worthwhile and justified; but Simpsons quotes also don't mean that no security spend has any effect.
deleted 3y ago
[deleted]

tqi 3y ago

We are all vulnerable to confirmation bias

A common analogy is to think about traffic lights. If you run a penetration test, asking an individual to run a red light. You will achieve near 100% success. However, when the traffic lights change actors’ behaviors to stop (at some probability such that it results in less collisions), most actors will stop according to the traffic lights.

RiceRichardJ 3y ago
That's not a good analogy at all. The incentives and motivations are completely different. Many drivers would at one point or another consider running a red light in order to save some time. I don't think you can say the same about passengers wanting to hijack a flight.

CamperBob2 3y ago

"Aspects of deterrence and standardization required by the program fundamentally changes the threat actors’ calculus." “By your logic I could claim that this rock keeps tigers away.” “Oh, how does it work?” “It doesn’t work.” “Uh-huh.” “It’s just a stupid rock.” “Uh-huh.” “But I don’t see any tigers around, do you?” “Lisa, I want to buy your rock.”

tadfisher 3y ago
Fear will keep the local systems in line. Fear of this battle station.
ethanbond 3y ago
Do you believe there aren’t people who wish to use air travel for nefarious purposes? Do you believe that none of those people are factoring in the presence of identity checks, x-rays, backscatters, bomb dogs, and metal detectors into their risk/reward calculation or the techniques by which they’d commit nefarious acts?
- gaganyaan 3y ago
  They're probably factoring in strengthened cockpit doors and passengers' willingness to fight back, because those actually work. The rest is security theater.
  - tmpX7dMeXU 3y ago
    If you are going to resort to “it is because it is”, leave and let someone else argue your side.
majormajor 3y ago
And on the opposite side of the stupid-examples spectrum: any tech company that hasn't had a computer security breach should fire their security team. All they're doing is spending a lot of money to make their developer's lives a lot harder. Anyone with clean floors should fire their janitors. Etc... Those don't mean every security spend is worthwhile and justified; but Simpsons quotes also don't mean that no security spend has any effect.

deleted 3y ago

[deleted]