4 ms·

You just described significant portions of the security industry, which runs on maximizing the fear and FUD factor. It's not just true of computer security. It

by api 12y ago

You just described significant portions of the security industry, which runs on maximizing the fear and FUD factor. It's not just true of computer security. It's really true globally of the entire "security" sector, from infosec to police to the global "national security" defense/intelligence industry and so forth. Step 1: frighten, step 2: sell protection, step 3: profit. Not saying there aren't risks out there, just that the industry markets itself through bombast and sometimes exaggerates them. Back to the infosec realm, the simple truth is that the only absolutely secure system is one that is off and the only absolute privacy is in your own head (maybe). Everything else is a matter of degrees of risk, and the curve is hockey stick shaped. It's relatively easy to mitigate the big risks, but that leaves a long tail of small risks and small vulnerabilities that require an exponentially increasing amount of effort and inconvenience to deal with.

kachnuv_ocasek 12y ago
Well, apparently, even that is not enough.
rqebmm 12y ago
every industry trumps up the usefulness of their product, it's called marketing. It's on the consumer to cut through the marketing-speak and understand what they actually need to pay for.
- UweSchmidt 12y ago
  It's also on each industry to inform truthfully and honestly. As the work to "cut through the marketing speak" can obstruct business activity there are already various laws in place to punish a too liberal interpretation of the word "marketing".
- TeMPOraL 12y ago
  > every industry trumps up the usefulness of their product, it's called marketing. It should be called lying and bullshitting, and I strongly believe that we tolerate it far too much as a culture.
  - api 12y ago
    Marketing can degrade into con artistry. It isn't always, but it certainly can. That being said, I think in the long run people appreciate it if your marketing isn't scummy. (Not directly aimed at the original article, though I do think there's a lot of deceptive, confusing, and overly hyperbolic FUD in the security sector.)
tripzilch 12y ago
Well, yes, but without this huge marketing effort on the side of the infosec industry, we'd still be running the web on http instead of https, and we'd still have to convince people that XSS is bad and not just a "neat trick". Those are just the first two things from the top of my head that IMO rightly took great effort to be taken seriously by the mainstream (developers and consumers alike). Also I disagree with the "Uncertainty & Doubt" part of FUD. Security researchers are generally extremely clear about what exactly the issues and risks are, with few exceptions when required for responsible disclosure.

by api 12y ago

kachnuv_ocasek 12y ago

Well, apparently, even that is not enough.

rqebmm 12y ago

every industry trumps up the usefulness of their product, it's called marketing. It's on the consumer to cut through the marketing-speak and understand what they actually need to pay for.

UweSchmidt 12y ago
It's also on each industry to inform truthfully and honestly. As the work to "cut through the marketing speak" can obstruct business activity there are already various laws in place to punish a too liberal interpretation of the word "marketing".
TeMPOraL 12y ago
> every industry trumps up the usefulness of their product, it's called marketing. It should be called lying and bullshitting, and I strongly believe that we tolerate it far too much as a culture.
- api 12y ago
  Marketing can degrade into con artistry. It isn't always, but it certainly can. That being said, I think in the long run people appreciate it if your marketing isn't scummy. (Not directly aimed at the original article, though I do think there's a lot of deceptive, confusing, and overly hyperbolic FUD in the security sector.)

tripzilch 12y ago

Well, yes, but without this huge marketing effort on the side of the infosec industry, we'd still be running the web on http instead of https, and we'd still have to convince people that XSS is bad and not just a "neat trick". Those are just the first two things from the top of my head that IMO rightly took great effort to be taken seriously by the mainstream (developers and consumers alike). Also I disagree with the "Uncertainty & Doubt" part of FUD. Security researchers are generally extremely clear about what exactly the issues and risks are, with few exceptions when required for responsible disclosure.