5 ms·

As I said in another response: it's a political statement made with public art. As far as Parks and Rec is concerned, it's big heavy piece of vandalism, the int

by ics 12y ago

As I said in another response: it's a political statement made with public art. As far as Parks and Rec is concerned, it's big heavy piece of vandalism, the integrity of which they know nothing about. To put this in a programmer's perspective: imagine if artists wanting to make political statements suddenly started littering your linux kernel with binary blobs which caused your boot screen to flash an image of Snowden. Let's pretend that this version of the kernel is hosted on an otherwise trusted package cache, and nobody is actually verifying checksums and so thousands of unsuspecting developers now have this tainted kernel. Funny? Innocuous? Ingenious? Perhaps, but I'd be amazed if you all didn't wipe your disks right then and there. Edit: I don't mind downvotes (this is my most downvoted chain of comments so far). However if you do, please take some time to contribute to the discussion with a substantive argument. I fully support Snowden, these artists, and the Parks department here. My argument here is only an attempt to make better sense of what people seem to be ignoring for the sake of a political argument which many of us want to support.

Dylan16807 12y ago
Depending on what you mean by "otherwise trusted", I would either not care or freak out worrying that I got something other than the Snowden blob. Just displaying an image would be easy to verify with a disassembler. And it's misleading to use 'binary blob' as an analogy to a simple statue. Most binary blobs are effectively impossible to examine fully.
- ics 12y ago
  By otherwise trusted I simply mean that it is included by default, not that you specifically trust the source. Is the the park's reaction much different from using a disassembler? They cover it up so until someone can come to inspect it and then remove it. You can't just look at it and say "yep, that's a perfectly normal bronze sculpture alright" without inspecting it (requiring removal).
  - Dylan16807 12y ago
    The hiding is totally unrelated to removal, which is totally unrelated to realizing that it's a statue. So yes very different. And if they wanted to set up something dangerous, it would be easier to make it hidden. There's no good reason to suspect the statue is dangerous.
    - ics 12y ago
      No, it's the universal sign for "this is the thing that needs to be removed". Unfortunately they don't have cones which read "unauthorized object subject to removal immediately" which would get the point across while preserving people's ability to see it until it was removed or properly evaluated. That would make the whole issue of removal look even more Orwellian though, would it not? The reason why I brought up the potential danger of the statue is not because I or anyone expects it to be dangerous. (For a relevant incident though, remember the Boston Aqua Teen Hunger Force stuff... that got a terrible reaction, even though anyone who has ever played with electronics could tell that they were harmless. See http://en.wikipedia.org/wiki/2007_Boston_bomb_scare http://en.wikipedia.org/wiki/2007_Boston_bomb_scare ) I bring it up because it is both department policy and perfectly valid from the perspective of anyone who works to ensure safety in parks. If some circumstance, however crazy, causes someone to become injured by the installation then it's going to be a much bigger headache to Parks and Rec than a bunch of us calling them fascists/communists/whatever else is going on in here. Edit: In case I wasn't clear, the point of my analogy is that... as far as you know it's just an image on the boot screen. As far as you know, it's just a sculpture that's properly installed and isn't going to just roll off as soon as some kids try to climb it (park employees try to stop this too, but it's still common esp. at this park). If it was an official installation, presumably Parks and Rec would have enough confidence in the work itself to say "this is fine" and then take responsibility for it in the future. Perhaps a better analogy would've been if someone pulled a similar stunt on NYPL's public computers or something, shrug. (I have no righteous love for my own analogy here, I just thought it would make the issue a little more clear. I seem to have been wrong about that.)
      - Dylan16807 12y ago
- avn2109 12y ago
  >> "...easy to verify with a disassembler." Have to laugh at this, because only on HN is the use of a disassembler considered "easy." True story, I program computers for a living, and I have literally no idea how to verify anything at all with a disassembler. Or even approximately how one works.
  - jarfil 12y ago
    And whose fault is that? As a professional you should at least be aware (just aware, no need to be any kind of expert) of the pipeline you use. Which in this case is anything from your high level language of choice, all the way down to the actual electrons. Knowing that, you should realize that a disassembler is just one or two of those steps reversed, the "assembler" steps, which should make if pretty much self-explanatory.
  - Dylan16807 12y ago
    We're talking about a breach of a major distribution. It's the job of someone in charge to do the analysis, not every single end user. To them, it is easy. And I'm talking about looking at a 20 byte function; you could figure it out if you wanted.
    - ics 12y ago
      Read my analogy again (despite it's flaws). It isn't mainline kernel development has been breached. It is more like *Ubuntu accidentally set `APT::Get::AllowUnauthenticated "true";` and then thousands of users upgraded from a tainted mirror[1]. Regardless of how you lay blame, Canonical would have a responsibility to undo that action. [1] I don't use Ubuntu so maybe it doesn't fully apply here. On Arch using pacman, the list of mirrors/caches is mostly commented out so that people can choose their own. They are "trustworthy" essentially until they're not, but we have signature checking to fall back on. In the physical world we don't have this, thus the setup of my (again, flawed) analogy. Any more involved than that and it's missing the spirit of what I was trying to say, but I admit that the disassembler response made me chuckle.
      - 12y ago
- shiggerino 12y ago
  Any repository worth trusting would have exactly zero binary blobs, and a strong policy to ensure this. If you get your kernels from blob peddlers, displaying an image seems a lot more benign than something like iwlwifi. Disabling the former won't impact your work, the latter holds a part of your hardware hostage.
jjcm 12y ago
Vastly different. In this situation, it's very clear what you need to do to remove the addition to the sculpture park. In your example, the presence shows that the integrity of your system has been compromised. If this sculpture showed up inside of a high security museum display case, then your analogy would make sense.
- ics 12y ago
  Well as someone who lives right nearby, visits the park from time to time, knows people who work in the park... the integrity of their system has been compromised. Sure, the threat may be considered pretty mundane (by non-sculptors at least; anyone who has watched art students attempt large sculptural installations may get a twitch) but I think that you are massively underestimating the expectation of infrastructural safety in public parks. https://web.archive.org/web/20111221041147/http://www.artflaw.com/art/5-art-installation-disasters-mishaps-and-failures-4-and-3 https://web.archive.org/web/20111221041147/http://www.artfla... http://www.theguardian.com/local-government-network/2014/jun/24/giant-vagina-sculpture-public-bodies-pick-up-bill http://www.theguardian.com/local-government-network/2014/jun... http://hyperallergic.com/11146/8-deadly-works-of-art/ http://hyperallergic.com/11146/8-deadly-works-of-art/
  - Dylan16807 12y ago
    The integrity of the park against carrying junk into it is basically zero. Not an issue.
    - ics 12y ago
      Sorry, I'm not sure what you mean– litter? Or "junk" as in something hidden in the statue (far more conspiratorial than I intended this whole discussion to go)? Edit: I think I know what you mean based on your other reply to me; I'll respond there unless you want to clarify anyway.
      - decentrality 12y ago
        I think he's saying that if it weren't handled as a political statement, there's no realistic defense against trash being brought into the park. It's the responsibility of the maintainers to notice - not people to prevent the natural flow of life from happening. People leave cool stuff places. It happens. I mean how many times have cell phones been left somewhere on accident say, which if it was on purpose doesn't matter either -- OH NO, PARK BENCH SSL CERT MITM ATTACKED, PURGE YOUR LUNCHBOXES No, it's an object left/put there. So unput it there. That's what parks & recreation does all the rest of the time. Now it's a rad piece of art, not a cell phone, not an umbrella, etc.
plainOldText 12y ago
Absolutely, you can define this act as vandalism. And although I appreciate you framed your analogy such that it can be understood by the HN audience, it does not account for the nature of these two systems, Linux kernel vs social groups. You cannot always transfer the techniques or properties which work in one world, to another, and expect similar results. The Linux kernel represents a collection of modules, which are predictable and fairly reliable, and as such the Linux kernel is to a certain extent fairly deterministic. A small change compromises the integrity of the entire system, as defined by its checksums. People on the other hand are not as predictable and not at all reliable when compared to code bases. Therefore, a collection of individuals is a fairly probabilistic system. And as such, a small change in someone's, albeit not harmful behavior, will do little to compromise the integrity of our society. And by the say, the Linux kernel you were talking about (for which supposedly you have the checksums) is static, whereas you could better describe our society as a dynamic, ever evolving system. You wouldn't compute the checksums of a running program, now would you?
- ics 12y ago
  Indeed, the analogy is rough and probably reveals that I am not a programmer by trade. As with all analogies, one hopes that others can lift them into slight abstraction in order to find the meaning and reach a similar conclusion or line of thought at least. Even if I could be helped in improving it, analogies are virtually never airtight– in this case comparing a physical park to software is not without difficulty. Sadly I can't think of any prankware that would really get the message across here. Edit: Re-reading your comment I might have missed a few parts so I'll reply back while waiting for paint to dry (fun day). I wasn't trying to equate the two systems or their intricacies and behavior. Rather, we are given some system with rules which govern what we expect it to "be". (I could say do, but consider this the "state" of the system; if it is code, it is not executing but just lines of code in files.) When that system is changed in a way we do not expect by an action that we had prior expectations for, we generally try to revert that action. You are responsible for your system, so you can do what you like. Parks and Rec is responsible for this park, and all of its users and rightly intends to remove this unexpected modification, regardless of its origin or meaning. I'm just realizing what a missed opportunity to be hip it was– when you let a friend provision your vagrant images with unknown docker containers with [insert unexpected behavior] just before distributing it to thousands of users... (The potential danger of the thing would be a side-effect though so this one's not so good either. I tried!)
wantab 12y ago
I can't agree with you more and you gave an excellent analogy.
unethical_ban 12y ago
I think the point is that people are carrying binary blobs and littering the "kernel" (park) 24/7. That they were able to sneak a political statement onto a pedestal in a public place isn't shocking or fundamentally security-breaking. And they're in the right, so there is that.
forgottenpass 12y ago
There are wildly different risk and trust profiles at stake. Your analogy is incomprehensible.
berserkpi 12y ago
Is the park Mal-functioning because of this? I don't see how. Maybe if they had decided to place it on a swing seat... different story... a funny one I'd say.

by ics 12y ago

Dylan16807 12y ago

Depending on what you mean by "otherwise trusted", I would either not care or freak out worrying that I got something other than the Snowden blob. Just displaying an image would be easy to verify with a disassembler. And it's misleading to use 'binary blob' as an analogy to a simple statue. Most binary blobs are effectively impossible to examine fully.

ics 12y ago
By otherwise trusted I simply mean that it is included by default, not that you specifically trust the source. Is the the park's reaction much different from using a disassembler? They cover it up so until someone can come to inspect it and then remove it. You can't just look at it and say "yep, that's a perfectly normal bronze sculpture alright" without inspecting it (requiring removal).
- Dylan16807 12y ago
  The hiding is totally unrelated to removal, which is totally unrelated to realizing that it's a statue. So yes very different. And if they wanted to set up something dangerous, it would be easier to make it hidden. There's no good reason to suspect the statue is dangerous.
  - ics 12y ago
    No, it's the universal sign for "this is the thing that needs to be removed". Unfortunately they don't have cones which read "unauthorized object subject to removal immediately" which would get the point across while preserving people's ability to see it until it was removed or properly evaluated. That would make the whole issue of removal look even more Orwellian though, would it not? The reason why I brought up the potential danger of the statue is not because I or anyone expects it to be dangerous. (For a relevant incident though, remember the Boston Aqua Teen Hunger Force stuff... that got a terrible reaction, even though anyone who has ever played with electronics could tell that they were harmless. See http://en.wikipedia.org/wiki/2007_Boston_bomb_scare http://en.wikipedia.org/wiki/2007_Boston_bomb_scare ) I bring it up because it is both department policy and perfectly valid from the perspective of anyone who works to ensure safety in parks. If some circumstance, however crazy, causes someone to become injured by the installation then it's going to be a much bigger headache to Parks and Rec than a bunch of us calling them fascists/communists/whatever else is going on in here. Edit: In case I wasn't clear, the point of my analogy is that... as far as you know it's just an image on the boot screen. As far as you know, it's just a sculpture that's properly installed and isn't going to just roll off as soon as some kids try to climb it (park employees try to stop this too, but it's still common esp. at this park). If it was an official installation, presumably Parks and Rec would have enough confidence in the work itself to say "this is fine" and then take responsibility for it in the future. Perhaps a better analogy would've been if someone pulled a similar stunt on NYPL's public computers or something, shrug. (I have no righteous love for my own analogy here, I just thought it would make the issue a little more clear. I seem to have been wrong about that.)
    - Dylan16807 12y ago
avn2109 12y ago
>> "...easy to verify with a disassembler." Have to laugh at this, because only on HN is the use of a disassembler considered "easy." True story, I program computers for a living, and I have literally no idea how to verify anything at all with a disassembler. Or even approximately how one works.
- jarfil 12y ago
  And whose fault is that? As a professional you should at least be aware (just aware, no need to be any kind of expert) of the pipeline you use. Which in this case is anything from your high level language of choice, all the way down to the actual electrons. Knowing that, you should realize that a disassembler is just one or two of those steps reversed, the "assembler" steps, which should make if pretty much self-explanatory.
- Dylan16807 12y ago
  We're talking about a breach of a major distribution. It's the job of someone in charge to do the analysis, not every single end user. To them, it is easy. And I'm talking about looking at a 20 byte function; you could figure it out if you wanted.
  - ics 12y ago
    Read my analogy again (despite it's flaws). It isn't mainline kernel development has been breached. It is more like *Ubuntu accidentally set `APT::Get::AllowUnauthenticated "true";` and then thousands of users upgraded from a tainted mirror[1]. Regardless of how you lay blame, Canonical would have a responsibility to undo that action. [1] I don't use Ubuntu so maybe it doesn't fully apply here. On Arch using pacman, the list of mirrors/caches is mostly commented out so that people can choose their own. They are "trustworthy" essentially until they're not, but we have signature checking to fall back on. In the physical world we don't have this, thus the setup of my (again, flawed) analogy. Any more involved than that and it's missing the spirit of what I was trying to say, but I admit that the disassembler response made me chuckle.
    - 12y ago
shiggerino 12y ago
Any repository worth trusting would have exactly zero binary blobs, and a strong policy to ensure this. If you get your kernels from blob peddlers, displaying an image seems a lot more benign than something like iwlwifi. Disabling the former won't impact your work, the latter holds a part of your hardware hostage.

jjcm 12y ago

Vastly different. In this situation, it's very clear what you need to do to remove the addition to the sculpture park. In your example, the presence shows that the integrity of your system has been compromised. If this sculpture showed up inside of a high security museum display case, then your analogy would make sense.

ics 12y ago
Well as someone who lives right nearby, visits the park from time to time, knows people who work in the park... the integrity of their system has been compromised. Sure, the threat may be considered pretty mundane (by non-sculptors at least; anyone who has watched art students attempt large sculptural installations may get a twitch) but I think that you are massively underestimating the expectation of infrastructural safety in public parks. https://web.archive.org/web/20111221041147/http://www.artflaw.com/art/5-art-installation-disasters-mishaps-and-failures-4-and-3 https://web.archive.org/web/20111221041147/http://www.artfla... http://www.theguardian.com/local-government-network/2014/jun/24/giant-vagina-sculpture-public-bodies-pick-up-bill http://www.theguardian.com/local-government-network/2014/jun... http://hyperallergic.com/11146/8-deadly-works-of-art/ http://hyperallergic.com/11146/8-deadly-works-of-art/
- Dylan16807 12y ago
  The integrity of the park against carrying junk into it is basically zero. Not an issue.
  - ics 12y ago
    Sorry, I'm not sure what you mean– litter? Or "junk" as in something hidden in the statue (far more conspiratorial than I intended this whole discussion to go)? Edit: I think I know what you mean based on your other reply to me; I'll respond there unless you want to clarify anyway.
    - decentrality 12y ago
      I think he's saying that if it weren't handled as a political statement, there's no realistic defense against trash being brought into the park. It's the responsibility of the maintainers to notice - not people to prevent the natural flow of life from happening. People leave cool stuff places. It happens. I mean how many times have cell phones been left somewhere on accident say, which if it was on purpose doesn't matter either -- OH NO, PARK BENCH SSL CERT MITM ATTACKED, PURGE YOUR LUNCHBOXES No, it's an object left/put there. So unput it there. That's what parks & recreation does all the rest of the time. Now it's a rad piece of art, not a cell phone, not an umbrella, etc.

plainOldText 12y ago

Absolutely, you can define this act as vandalism. And although I appreciate you framed your analogy such that it can be understood by the HN audience, it does not account for the nature of these two systems, Linux kernel vs social groups. You cannot always transfer the techniques or properties which work in one world, to another, and expect similar results. The Linux kernel represents a collection of modules, which are predictable and fairly reliable, and as such the Linux kernel is to a certain extent fairly deterministic. A small change compromises the integrity of the entire system, as defined by its checksums. People on the other hand are not as predictable and not at all reliable when compared to code bases. Therefore, a collection of individuals is a fairly probabilistic system. And as such, a small change in someone's, albeit not harmful behavior, will do little to compromise the integrity of our society. And by the say, the Linux kernel you were talking about (for which supposedly you have the checksums) is static, whereas you could better describe our society as a dynamic, ever evolving system. You wouldn't compute the checksums of a running program, now would you?

ics 12y ago
Indeed, the analogy is rough and probably reveals that I am not a programmer by trade. As with all analogies, one hopes that others can lift them into slight abstraction in order to find the meaning and reach a similar conclusion or line of thought at least. Even if I could be helped in improving it, analogies are virtually never airtight– in this case comparing a physical park to software is not without difficulty. Sadly I can't think of any prankware that would really get the message across here. Edit: Re-reading your comment I might have missed a few parts so I'll reply back while waiting for paint to dry (fun day). I wasn't trying to equate the two systems or their intricacies and behavior. Rather, we are given some system with rules which govern what we expect it to "be". (I could say do, but consider this the "state" of the system; if it is code, it is not executing but just lines of code in files.) When that system is changed in a way we do not expect by an action that we had prior expectations for, we generally try to revert that action. You are responsible for your system, so you can do what you like. Parks and Rec is responsible for this park, and all of its users and rightly intends to remove this unexpected modification, regardless of its origin or meaning. I'm just realizing what a missed opportunity to be hip it was– when you let a friend provision your vagrant images with unknown docker containers with [insert unexpected behavior] just before distributing it to thousands of users... (The potential danger of the thing would be a side-effect though so this one's not so good either. I tried!)

wantab 12y ago

I can't agree with you more and you gave an excellent analogy.

unethical_ban 12y ago

I think the point is that people are carrying binary blobs and littering the "kernel" (park) 24/7. That they were able to sneak a political statement onto a pedestal in a public place isn't shocking or fundamentally security-breaking. And they're in the right, so there is that.

forgottenpass 12y ago

There are wildly different risk and trust profiles at stake. Your analogy is incomprehensible.

berserkpi 12y ago

Is the park Mal-functioning because of this? I don't see how. Maybe if they had decided to place it on a swing seat... different story... a funny one I'd say.