5 ms·

I think tptacek has hummed a few bars in this direction before, but it has become received wisdom on some parts of the Internet that geeks vs. government is an

by patio11 14y ago

I think tptacek has hummed a few bars in this direction before, but it has become received wisdom on some parts of the Internet that geeks vs. government is an asymmetric fight and that since governments are stupid geeks will win. You often see this in, let me cherry pick out of charitability, threads suggesting that the OSS community develop surveillance countermeasures for use by dissidents subject to certifiably evil regimes. It doesn't really matter whether the nation state in question is Iran or the United States. Do not pick fights with people who can respond to a hacking incident by writing a check for $5 million dollars to a defense contractor and consider that low-intensity conflict resolution. It will not end well.

cheatercheater 14y ago
You forgot to mention black choppers. FTFY: "Do not pick fights with people who can fly black choppers"
- patio11 14y ago
  So when you mention black choppers, people will assume you are either being ironic or crazy. There's a particular policy goal affiliated with these attacks, and a spectrum of options for achieving that policy goal. Those options included "There exist certain individually identifiable employees of a foreign government who are personally indispensable to implementing something which goes against our policy goals. We could assassinate them." If you read the papers you know that that option is neither a joke nor the fevered imaginings of a paranoid conspiracy theorist.
  - eli 14y ago
    Indeed: http://www.nytimes.com/2012/05/29/world/obamas-leadership-in-war-on-al-qaeda.html?_r=1 http://www.nytimes.com/2012/05/29/world/obamas-leadership-in...
  - lifeisstillgood 14y ago
    It is likely that such assassinations are against both International Law (Geneva Conventions) and US law. Carter, Ford and Reagan all prohibited them through executive orders. Even if you think that knocking off some Hamas leaders is a good idea, you will experience scope creep - last year a (sort of) influential policy advisor suggested using drones against Julian Assange. Honestly, "we" (the West) are best armed, best funded, most free peoples ever to walk the earth. If we cannot put aside assassination and torture, then the human race has no hope. Here for an interesting review of legality of such assassinations: http://www.kentlaw.edu/perritt/courses/seminar/jerry-bekkerman-seminar%20paper%20%28final%29.htm http://www.kentlaw.edu/perritt/courses/seminar/jerry-bekkerm... Assange / assassination http://en.wikipedia.org/wiki/Tom_Flanagan_%28political_scientist%29 http://en.wikipedia.org/wiki/Tom_Flanagan_%28political_scien... edit: for clarity, before I become flamed as a woolly left winger, I think that there are many people in the world, that if they were hit by lightning today, the world would be much better off. but a) I think the world is nett worse off if democracies 'arrange' that lightning, because it demeans the important point of a democracy - being a beacon of hope for the future generations. b) the choice of targets, is not discussed in a democratic manner, and almost certainly would not be my choice. (Now thats a referendum I would love to see:-) c) my guess is that, like crime, taking out the people committing the crime right now, magically someone else steps into their place. Sometimes someone who yesterday was not committing those crimes. Hmm, still pretty left wing there...
    - tkahn6 14y ago
      The point in the first paragraph regarding 'scope creep' is a non sequitur because Julian Assange was in fact not assassinated and public figures calling for his assassination were not taken seriously. The second paragraph and points a and c are non sequiturs. In b it seems you are in favor of a lynch mob. Just explaining why I down-modded your comment
      - lifeisstillgood 14y ago
        down modding stuff is fine, giving reasoned comments is fantastic. lynch mob - no, but I was struck with concern and amusement by the idea of a quarterly referendum on which world figures we should target for assassination, plus maybe a limit of civilian children whose collateral death would be acceptable in the voting list. In fact its the opposite of a lynch mob. A lynch democracy perhaps. don't quite understand the non-sequiteur part... could you expand?
  - cheatercheater 14y ago
    Just for the record, I was implying you're crazy.
pliny 14y ago
The idea that governments are stupid in the sphere of technology ignores the recent-ish discovery on behalf of governments that if you just pay a bunch of geeks to be geeks on behalf of the (evil or otherwise) government and make them exempt from bureaucracy they get results that are at least as good as geeks acting independently.
epenn 14y ago
Similarly, I'll grant that the fight may appear asymmetrical at the higher level of organizations if one side is run by geeks and the other side is run by non-geeks. Nonetheless one should recognize that those hired by either side to be on the "front lines" so to speak will be geeks. Whether they're computer geeks or gun|bomb|espionage|etc geeks, assuming an asymmetry in the ability to employ strategy and accomplish goals on that level would be unwise.
- tatsuke95 14y ago
  Right. It always comes back to the people performing the task. Because people are generally "good" (IMHO), "evil" isn't particularly easy to get away with. This goes for geeks, police and even the military. Commands can be issued, but real people with real emotions have to deliver. This is why whistle-blower protection is so key to our economy and society. And while politics may attract a disproportionate level of narcissists and sociopaths, I'm guessing CS doesn't.
  - pgeorgi 14y ago
    I'd rather assume that sociopaths are drawn to politics because it's kind of a wildcard field (you can pretend to be expert and meddle in pretty much every topic). That doesn't mean there aren't highly specialized and capable sociopaths out there.
timdiggerm 14y ago
"geeks vs government" assumes geeks don't work for the government.
morsch 14y ago
Neither Stuxnet nor Flame target hackers or even the general population. They were targeting specific institutions. Attacking is easy once you know who or what to attack. Each individual hacker and each individual citizen is a much smaller target. Sure, as soon as you're identified, you're toast: they break in and install malware on your computer -- if you're lucky. But there's a lot of hackers and even more normal people, all of which can be made individually harder to identify through smart software.
- tptacek 14y ago
  Lots of people. Relatively few pieces of software. Pit against an avalanche of money and access to the best talent in the world. The incentive structure doesn't work, at all. Don't build circumvention tools. If you're lucky, they'll just turn out to be useless.
gvb 14y ago
In addition, keep in mind that the geeks in government (a) cannot talk about what they are working on (see http://www.foxnews.com/us/2011/12/26/decades-later-cold-war-secret-is-revealed/ http://www.foxnews.com/us/2011/12/26/decades-later-cold-war-...) and (b) are happy to be considered stupid because it makes their job easier.
DanI-S 14y ago
> You often see this in, let me cherry pick out of charitability, threads suggesting that the OSS community develop surveillance countermeasures for use by dissidents subject to certifiably evil regimes. > It doesn't really matter whether the nation state in question is Iran or the United States. Do not pick fights with people who can respond to a hacking incident by writing a check for $5 million dollars to a defense contractor and consider that low-intensity conflict resolution. It will not end well. Are you really saying that people should avoid writing software that could help people who are subject to evil regimes because said evil regime might be upset at them? There's an uncertain level of personal risk associated with doing such things, but there's definite moral hazard in total self-interest. Either way, if Flame was written by the US or Israel a lot of us on here are already complicit in such a project. We live in a democracy. Those are our tax dollars, hard at work. I totally agree with you otherwise; governments are not stupid.
- patio11 14y ago
  Are you really saying that people should avoid writing software that could help people who are subject to evil regimes because said evil regime might be upset at them? No, I'm saying that "my software helps people who are subject to evil regimes" is approximately as irresponsible as "my homeopathic remedy solves cancer" except in this case cancer has essentially infinite computational resources, arbitrarily high numbers of very savvy domain experts, and an army. Any hacker who believes their software, or their community's software, will hold up to dedicated adversarial interest from a nation-state is dangerously delusional.
  - DanI-S 14y ago
    I don't think it's as simple as you make it sound. If somebody writes a tool that helps 100 million Chinese people access the unfiltered internet, a percentage of them will be caught and punished in devastating and inhumane ways. Some fraction of the illicit traffic will be blocked and the holes sealed up. The remaining people will have access to material that, as far as the Chinese government is concerned, poses a tremendous risk to the state's continued authority. If this - as the state obviously believes - would help speed along the atrophy of an authoritarian state, net human suffering would be reduced overall.
ChuckMcM 14y ago
I agree with this, and I was similarly amazed when some folks calling themselves Anonymous started dumping personal information about law enforcement officers onto the web, you don't pick fights with people who are going to hunt you down and eliminate you. It may be they will just lock you up, it may be worse than that. That said, there is a history of people who have done that, paid the ultimate price, and later been honored for their sacrifice. Seems like history can go either way sometimes in judging the act, hero or idiot. I'm all in favor of people keeping their eyes open though as they walk into it. For me things like Flame just tell me that what I knew as an engineer could be done, actually have been done. And that is always a bit of a wake up call.
rdl 14y ago
I think a bigger asymmetry than "hackers vs. governments" is "defense vs. offense" -- the state of computer security is laughable enough that the attacker will probably win, whoever he is. If non-government hackers were building offensive tools, vs. defensive, and only had to win periodically vs. essentially all the time, they'd be able to put up a better fight. Government doesn't have a particular monopoly on competence, and internal politics and budget issues probably would allow a relatively capital-poor non-governmental enterprise to do pretty well vs. a contractor/government team.

by patio11 14y ago

cheatercheater 14y ago

You forgot to mention black choppers. FTFY: "Do not pick fights with people who can fly black choppers"

patio11 14y ago
So when you mention black choppers, people will assume you are either being ironic or crazy. There's a particular policy goal affiliated with these attacks, and a spectrum of options for achieving that policy goal. Those options included "There exist certain individually identifiable employees of a foreign government who are personally indispensable to implementing something which goes against our policy goals. We could assassinate them." If you read the papers you know that that option is neither a joke nor the fevered imaginings of a paranoid conspiracy theorist.
- eli 14y ago
  Indeed: http://www.nytimes.com/2012/05/29/world/obamas-leadership-in-war-on-al-qaeda.html?_r=1 http://www.nytimes.com/2012/05/29/world/obamas-leadership-in...
- lifeisstillgood 14y ago
  It is likely that such assassinations are against both International Law (Geneva Conventions) and US law. Carter, Ford and Reagan all prohibited them through executive orders. Even if you think that knocking off some Hamas leaders is a good idea, you will experience scope creep - last year a (sort of) influential policy advisor suggested using drones against Julian Assange. Honestly, "we" (the West) are best armed, best funded, most free peoples ever to walk the earth. If we cannot put aside assassination and torture, then the human race has no hope. Here for an interesting review of legality of such assassinations: http://www.kentlaw.edu/perritt/courses/seminar/jerry-bekkerman-seminar%20paper%20%28final%29.htm http://www.kentlaw.edu/perritt/courses/seminar/jerry-bekkerm... Assange / assassination http://en.wikipedia.org/wiki/Tom_Flanagan_%28political_scientist%29 http://en.wikipedia.org/wiki/Tom_Flanagan_%28political_scien... edit: for clarity, before I become flamed as a woolly left winger, I think that there are many people in the world, that if they were hit by lightning today, the world would be much better off. but a) I think the world is nett worse off if democracies 'arrange' that lightning, because it demeans the important point of a democracy - being a beacon of hope for the future generations. b) the choice of targets, is not discussed in a democratic manner, and almost certainly would not be my choice. (Now thats a referendum I would love to see:-) c) my guess is that, like crime, taking out the people committing the crime right now, magically someone else steps into their place. Sometimes someone who yesterday was not committing those crimes. Hmm, still pretty left wing there...
  - tkahn6 14y ago
    The point in the first paragraph regarding 'scope creep' is a non sequitur because Julian Assange was in fact not assassinated and public figures calling for his assassination were not taken seriously. The second paragraph and points a and c are non sequiturs. In b it seems you are in favor of a lynch mob. Just explaining why I down-modded your comment
    - lifeisstillgood 14y ago
      down modding stuff is fine, giving reasoned comments is fantastic. lynch mob - no, but I was struck with concern and amusement by the idea of a quarterly referendum on which world figures we should target for assassination, plus maybe a limit of civilian children whose collateral death would be acceptable in the voting list. In fact its the opposite of a lynch mob. A lynch democracy perhaps. don't quite understand the non-sequiteur part... could you expand?
- cheatercheater 14y ago
  Just for the record, I was implying you're crazy.

pliny 14y ago

The idea that governments are stupid in the sphere of technology ignores the recent-ish discovery on behalf of governments that if you just pay a bunch of geeks to be geeks on behalf of the (evil or otherwise) government and make them exempt from bureaucracy they get results that are at least as good as geeks acting independently.

epenn 14y ago

Similarly, I'll grant that the fight may appear asymmetrical at the higher level of organizations if one side is run by geeks and the other side is run by non-geeks. Nonetheless one should recognize that those hired by either side to be on the "front lines" so to speak will be geeks. Whether they're computer geeks or gun|bomb|espionage|etc geeks, assuming an asymmetry in the ability to employ strategy and accomplish goals on that level would be unwise.

tatsuke95 14y ago
Right. It always comes back to the people performing the task. Because people are generally "good" (IMHO), "evil" isn't particularly easy to get away with. This goes for geeks, police and even the military. Commands can be issued, but real people with real emotions have to deliver. This is why whistle-blower protection is so key to our economy and society. And while politics may attract a disproportionate level of narcissists and sociopaths, I'm guessing CS doesn't.
- pgeorgi 14y ago
  I'd rather assume that sociopaths are drawn to politics because it's kind of a wildcard field (you can pretend to be expert and meddle in pretty much every topic). That doesn't mean there aren't highly specialized and capable sociopaths out there.

timdiggerm 14y ago

"geeks vs government" assumes geeks don't work for the government.

morsch 14y ago

Neither Stuxnet nor Flame target hackers or even the general population. They were targeting specific institutions. Attacking is easy once you know who or what to attack. Each individual hacker and each individual citizen is a much smaller target. Sure, as soon as you're identified, you're toast: they break in and install malware on your computer -- if you're lucky. But there's a lot of hackers and even more normal people, all of which can be made individually harder to identify through smart software.

tptacek 14y ago
Lots of people. Relatively few pieces of software. Pit against an avalanche of money and access to the best talent in the world. The incentive structure doesn't work, at all. Don't build circumvention tools. If you're lucky, they'll just turn out to be useless.

gvb 14y ago

In addition, keep in mind that the geeks in government (a) cannot talk about what they are working on (see http://www.foxnews.com/us/2011/12/26/decades-later-cold-war-secret-is-revealed/ http://www.foxnews.com/us/2011/12/26/decades-later-cold-war-...) and (b) are happy to be considered stupid because it makes their job easier.

DanI-S 14y ago

> You often see this in, let me cherry pick out of charitability, threads suggesting that the OSS community develop surveillance countermeasures for use by dissidents subject to certifiably evil regimes. > It doesn't really matter whether the nation state in question is Iran or the United States. Do not pick fights with people who can respond to a hacking incident by writing a check for $5 million dollars to a defense contractor and consider that low-intensity conflict resolution. It will not end well. Are you really saying that people should avoid writing software that could help people who are subject to evil regimes because said evil regime might be upset at them? There's an uncertain level of personal risk associated with doing such things, but there's definite moral hazard in total self-interest. Either way, if Flame was written by the US or Israel a lot of us on here are already complicit in such a project. We live in a democracy. Those are our tax dollars, hard at work. I totally agree with you otherwise; governments are not stupid.

patio11 14y ago
Are you really saying that people should avoid writing software that could help people who are subject to evil regimes because said evil regime might be upset at them? No, I'm saying that "my software helps people who are subject to evil regimes" is approximately as irresponsible as "my homeopathic remedy solves cancer" except in this case cancer has essentially infinite computational resources, arbitrarily high numbers of very savvy domain experts, and an army. Any hacker who believes their software, or their community's software, will hold up to dedicated adversarial interest from a nation-state is dangerously delusional.
- DanI-S 14y ago
  I don't think it's as simple as you make it sound. If somebody writes a tool that helps 100 million Chinese people access the unfiltered internet, a percentage of them will be caught and punished in devastating and inhumane ways. Some fraction of the illicit traffic will be blocked and the holes sealed up. The remaining people will have access to material that, as far as the Chinese government is concerned, poses a tremendous risk to the state's continued authority. If this - as the state obviously believes - would help speed along the atrophy of an authoritarian state, net human suffering would be reduced overall.

ChuckMcM 14y ago

I agree with this, and I was similarly amazed when some folks calling themselves Anonymous started dumping personal information about law enforcement officers onto the web, you don't pick fights with people who are going to hunt you down and eliminate you. It may be they will just lock you up, it may be worse than that. That said, there is a history of people who have done that, paid the ultimate price, and later been honored for their sacrifice. Seems like history can go either way sometimes in judging the act, hero or idiot. I'm all in favor of people keeping their eyes open though as they walk into it. For me things like Flame just tell me that what I knew as an engineer could be done, actually have been done. And that is always a bit of a wake up call.

rdl 14y ago

I think a bigger asymmetry than "hackers vs. governments" is "defense vs. offense" -- the state of computer security is laughable enough that the attacker will probably win, whoever he is. If non-government hackers were building offensive tools, vs. defensive, and only had to win periodically vs. essentially all the time, they'd be able to put up a better fight. Government doesn't have a particular monopoly on competence, and internal politics and budget issues probably would allow a relatively capital-poor non-governmental enterprise to do pretty well vs. a contractor/government team.