6 ms·

This person was an absolute clown. I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. Th

This person was an absolute clown. I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. The new computer crime proposals are worse. Every couple of years we get the occasional story about licensing security professionals. It is because of exactly this type of clownish behavior. There are consequences for the attention seeking type of behavior. This idiot is catnip for government regulation. It isn't exactly his fault though. Our community has been doing this to garner press attention for the sake of the attention. He is following the pattern that has long been set. Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention.

tokenizerrr 12y ago
> Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention. Good. Maybe they'll actually start caring about security instead of obscurity through law.
- Joeri 12y ago
  They don't want to be secure, they want to feel secure. That's why when somebody shows how insecure people are the common reaction is to want to punish that person. They didn't make people less secure, but they made them feel less secure.
- droopybuns 12y ago
  This is exactly what I am trying to call attention to. I have tremendous sympathy for the sentiment you are expressing. Unfortunately, the splash damage of flasy exploitation publicity as an incentive for vulns remediation is government regulation of security professionals. The flashy stories have been happening for close to 20 years now. Are vulnerabilities becoming more rare?
forgottenpass 12y ago
I think the infosec community needs to grow up. Vauge non-specific demands of a loose and fluid group with little to no control over it's members set the group up for inevitable failure. Without critical thought, it appears to be a reasonable request. Which is why the people who never want to listen to The Cavalry or EFF say it, and why the rest of us propagate the idea. But it's a trap.
- pyre 12y ago
  > little to no control over it's members There is some amount of control when you are accepting and possibly celebratory in response to behaviour that should be discouraged. For example, if you never sexually harass someone yourself, but you are silent while other do so, you are ceding a control that you have over the situation. If more people that were respected in the community called out these behaviours when they happen, you may see them happen less (though this isn't an absolute control, so they wouldn't go away completely).
  - hobs 12y ago
    At the same time, you can always claim that "the community isnt doing enough" because "enough" and "the community" as so ill defined that you can always castigate "the community". It is a complete waste of time.
    - Karunamon 12y ago
      Somewhat OT, but this is something I wish people could understand about groups like Occupy and GamerGate. The criticisms of both are often measured in such a way that the targets of the criticism can never do "enough".
tptacek 12y ago
Every response to this I've seen from "the infosec community" (my connection to that community tends sharply towards vulnerability researchers, since that's my background) has been critical of this guy. I can't think of anyone I've seen cheerleading him. I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him. But you're taking things too far by casting aspersions on all of "stunt hacking". The problem with this idiotic tweet is that, if there is a vulnerability in the electronics of an airplane, this is exactly the thing you'd expect to see before some moron accidentally forced an emergency landing by tinkering with it. Vulnerability researchers disrupt and disable systems all the time without trying to. The same is not true of people using logic analyzers on car CANbus systems (the archetypical example of stunt hacking). The real criticism I've seen of stunt hacking is that (a) we don't learn all that much from it and (b) it's not particularly difficult ("look at this debugger debugging", as a friend of mine summarizes most stunt hacking talks).
- larrys 12y ago
  "I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him." Perhaps it's entirely possible that the EFF is just like any other organization that needs to find ways to justify their existence. The same with security researchers cloaking many of the things that they do in some quest for the greater good (the "if it wasn't for us" argument). You know locksmith tools are available for purchase over the internet. But that's not enough! We should teach lock picking in schools so that people develop new and better ways to prevent their own locks from being picked and invest in more security against people that have been trained to pick locks. Because disclosure and transparency makes everything better and nobody thinks there is any value at all in obscurity or making things a bit more difficult by not being so out in the open. Pretending that finding some security flaw is not about capturing the flag and all about saving humanity really bothers me to no end.
  - nitrogen 12y ago
    With physical locks you are exposed to the few people that can walk up to the lock without attracting attention. With digital security, you are potentially exposed to every connected system on the planet. An invisible attacker can't pick your lock, but could hack your security system. That is why digital security is paramount. Robots are not going door to door picking locks, but that is exactly what happens every second of every day to every system on the Internet. It only takes one, and there are lot of disenfranchised smart people around the globe.
appleflaxen 12y ago
The fact that somebody scares the uninformed public shouldn't be the determining factor for whether it's appropriate. Especially if it's true: "a hacker can bring down the plane" is an important claim to investigate. Even if you disagree with how he said it (and I certainly do), it shouldn't be forbidden just because it's sensational. The appropriate sanction is the professional scorn that he's already beginning to receive.

tokenizerrr 12y ago

> Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention. Good. Maybe they'll actually start caring about security instead of obscurity through law.

Joeri 12y ago
They don't want to be secure, they want to feel secure. That's why when somebody shows how insecure people are the common reaction is to want to punish that person. They didn't make people less secure, but they made them feel less secure.
droopybuns 12y ago
This is exactly what I am trying to call attention to. I have tremendous sympathy for the sentiment you are expressing. Unfortunately, the splash damage of flasy exploitation publicity as an incentive for vulns remediation is government regulation of security professionals. The flashy stories have been happening for close to 20 years now. Are vulnerabilities becoming more rare?

forgottenpass 12y ago

I think the infosec community needs to grow up. Vauge non-specific demands of a loose and fluid group with little to no control over it's members set the group up for inevitable failure. Without critical thought, it appears to be a reasonable request. Which is why the people who never want to listen to The Cavalry or EFF say it, and why the rest of us propagate the idea. But it's a trap.

pyre 12y ago
> little to no control over it's members There is some amount of control when you are accepting and possibly celebratory in response to behaviour that should be discouraged. For example, if you never sexually harass someone yourself, but you are silent while other do so, you are ceding a control that you have over the situation. If more people that were respected in the community called out these behaviours when they happen, you may see them happen less (though this isn't an absolute control, so they wouldn't go away completely).
- hobs 12y ago
  At the same time, you can always claim that "the community isnt doing enough" because "enough" and "the community" as so ill defined that you can always castigate "the community". It is a complete waste of time.
  - Karunamon 12y ago
    Somewhat OT, but this is something I wish people could understand about groups like Occupy and GamerGate. The criticisms of both are often measured in such a way that the targets of the criticism can never do "enough".

tptacek 12y ago

Every response to this I've seen from "the infosec community" (my connection to that community tends sharply towards vulnerability researchers, since that's my background) has been critical of this guy. I can't think of anyone I've seen cheerleading him. I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him. But you're taking things too far by casting aspersions on all of "stunt hacking". The problem with this idiotic tweet is that, if there is a vulnerability in the electronics of an airplane, this is exactly the thing you'd expect to see before some moron accidentally forced an emergency landing by tinkering with it. Vulnerability researchers disrupt and disable systems all the time without trying to. The same is not true of people using logic analyzers on car CANbus systems (the archetypical example of stunt hacking). The real criticism I've seen of stunt hacking is that (a) we don't learn all that much from it and (b) it's not particularly difficult ("look at this debugger debugging", as a friend of mine summarizes most stunt hacking talks).

larrys 12y ago
"I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him." Perhaps it's entirely possible that the EFF is just like any other organization that needs to find ways to justify their existence. The same with security researchers cloaking many of the things that they do in some quest for the greater good (the "if it wasn't for us" argument). You know locksmith tools are available for purchase over the internet. But that's not enough! We should teach lock picking in schools so that people develop new and better ways to prevent their own locks from being picked and invest in more security against people that have been trained to pick locks. Because disclosure and transparency makes everything better and nobody thinks there is any value at all in obscurity or making things a bit more difficult by not being so out in the open. Pretending that finding some security flaw is not about capturing the flag and all about saving humanity really bothers me to no end.
- nitrogen 12y ago
  With physical locks you are exposed to the few people that can walk up to the lock without attracting attention. With digital security, you are potentially exposed to every connected system on the planet. An invisible attacker can't pick your lock, but could hack your security system. That is why digital security is paramount. Robots are not going door to door picking locks, but that is exactly what happens every second of every day to every system on the Internet. It only takes one, and there are lot of disenfranchised smart people around the globe.

appleflaxen 12y ago

The fact that somebody scares the uninformed public shouldn't be the determining factor for whether it's appropriate. Especially if it's true: "a hacker can bring down the plane" is an important claim to investigate. Even if you disagree with how he said it (and I certainly do), it shouldn't be forbidden just because it's sensational. The appropriate sanction is the professional scorn that he's already beginning to receive.