4 ms·

What an overreaction from the EFF. Use a bit of judgement and realize it isn't a smart idea to talk about hacking an airplane full of passengers.

by itg 11y ago

cm2187 11y ago
Particularly for a "security researcher". If he is, he should know better.
kragen 11y ago
The way we keep airplanes full of passengers from falling out of the sky is that we talk openly about the risks up front, so that the people who created those risks get fired or demoted, and their bosses (or, failing that, regulatory authorities) make sure the risks get fixed. It isn’t a smart idea to short-circuit that process; that’s how we ended up with things like the Ukrainian famine, the Great Leap Forward, Lysenkoism, and presumably Windows Vista. Use a bit of judgement; we’re trying to have a civilization here, Nero.
- gcr 11y ago
  Nero?
- ghshephard 11y ago
  What would your response be to the person who "joked" that they were pissed off with United Airlines, and would like to remind them that his house was on the approach path to SFO, and the next time United lost his luggage, he would be more than happy to repay them by taking a few potshots at their 747s with his trusty .22? Sometimes the way we keep airplanes full of passengers from falling out of the sky, is by looking for, and engaging, potential bad actors. The way to determine if someone is a bad actor, is by looking for signals of such intent. And, I think all things equal, this guy probably was throwing off signals that he was a bad actor, even if it's obvious to anyone who knows him, that he's just being a jackass.
  - simoncion 11y ago
    Me? I would laugh at him. Everyday FOD [0] will do far more damage than an impact with a .22. [0] Foreign Object Damage. In this case, at-speed impacts with grit, ice, and whatever.
    - ZanyProgrammer 11y ago
      Way to miss the point.
      - simoncion 11y ago
        One can't investigate every threat. You have to prioritize. Part of prioritizing is determining how much damage can be done with the resources available to the person. If someone says "I'm gonna bring down the Golden Gate Bridge with this 12" stick of balsa wood." you don't give them a second thought. They may have hostile intent, but they clearly lack the understanding of how to, or the means to[0], cause harm to the bridge. If someone says "I'm the operator of this container ship full of high explosives and I'm going to ram it into the GG Bridge and detonate the explosives.", then you investigate that, as the person very probably has both the intent and means to cause actual harm. We -as a society- used to refuse to be terrorized. We used to laugh off incredible[1] threats as the insanity, bluster, or cathartic ranting that they clearly were. We (or maybe just our investigative and enforcement organizations) freak out much more over much smaller things these days. Our society is poorer and weaker because of this. I hope that encouraging people to learn to put threats into perspective will help reverse this trend. Perhaps a calm, level-headed populace will calm its over-reactionary leaders, investigators, and enforcers. [0] Or both. [1] I mean this in the "in-credible" sense.
  - kragen 11y ago
    I’d tell him that if he wants to waste law enforcement’s time, he’d need to come up with a more realistic threat, and suggest that maybe instead he ought to try going dancing, or maybe relax on the beach. Also, maybe call him up next time there’s a falling bullet injury in Hunters Point.
- DanBC 11y ago
  Yes, talking about potential security risks is a good thing. Doing so while on a plane full of people is not a good idea.
- tptacek 11y ago
  "I am on a plane messing with what I believe to be control systems" is a threatening message, even if it isn't intended to be. Moreover: every computer system in the world is vulnerable. The process of finding those flaws is disruptive. It can't be the case that knowing in the abstract about those flaws is a predicate to allowing people to disrupt systems to find specific instances of them.
  - kragen 11y ago
    You are right.

What an overreaction from the EFF. Use a bit of judgement and realize it isn't a smart idea to talk about hacking an airplane full of passengers.

by itg 11y ago

What an overreaction from the EFF. Use a bit of judgement and realize it isn't a smart idea to talk about hacking an airplane full of passengers.

cm2187 11y ago

Particularly for a "security researcher". If he is, he should know better.

kragen 11y ago

The way we keep airplanes full of passengers from falling out of the sky is that we talk openly about the risks up front, so that the people who created those risks get fired or demoted, and their bosses (or, failing that, regulatory authorities) make sure the risks get fixed. It isn’t a smart idea to short-circuit that process; that’s how we ended up with things like the Ukrainian famine, the Great Leap Forward, Lysenkoism, and presumably Windows Vista. Use a bit of judgement; we’re trying to have a civilization here, Nero.

gcr 11y ago
Nero?
ghshephard 11y ago
What would your response be to the person who "joked" that they were pissed off with United Airlines, and would like to remind them that his house was on the approach path to SFO, and the next time United lost his luggage, he would be more than happy to repay them by taking a few potshots at their 747s with his trusty .22? Sometimes the way we keep airplanes full of passengers from falling out of the sky, is by looking for, and engaging, potential bad actors. The way to determine if someone is a bad actor, is by looking for signals of such intent. And, I think all things equal, this guy probably was throwing off signals that he was a bad actor, even if it's obvious to anyone who knows him, that he's just being a jackass.
- simoncion 11y ago
  Me? I would laugh at him. Everyday FOD [0] will do far more damage than an impact with a .22. [0] Foreign Object Damage. In this case, at-speed impacts with grit, ice, and whatever.
  - ZanyProgrammer 11y ago
    Way to miss the point.
    - simoncion 11y ago
      One can't investigate every threat. You have to prioritize. Part of prioritizing is determining how much damage can be done with the resources available to the person. If someone says "I'm gonna bring down the Golden Gate Bridge with this 12" stick of balsa wood." you don't give them a second thought. They may have hostile intent, but they clearly lack the understanding of how to, or the means to[0], cause harm to the bridge. If someone says "I'm the operator of this container ship full of high explosives and I'm going to ram it into the GG Bridge and detonate the explosives.", then you investigate that, as the person very probably has both the intent and means to cause actual harm. We -as a society- used to refuse to be terrorized. We used to laugh off incredible[1] threats as the insanity, bluster, or cathartic ranting that they clearly were. We (or maybe just our investigative and enforcement organizations) freak out much more over much smaller things these days. Our society is poorer and weaker because of this. I hope that encouraging people to learn to put threats into perspective will help reverse this trend. Perhaps a calm, level-headed populace will calm its over-reactionary leaders, investigators, and enforcers. [0] Or both. [1] I mean this in the "in-credible" sense.
- kragen 11y ago
  I’d tell him that if he wants to waste law enforcement’s time, he’d need to come up with a more realistic threat, and suggest that maybe instead he ought to try going dancing, or maybe relax on the beach. Also, maybe call him up next time there’s a falling bullet injury in Hunters Point.
DanBC 11y ago
Yes, talking about potential security risks is a good thing. Doing so while on a plane full of people is not a good idea.
tptacek 11y ago
"I am on a plane messing with what I believe to be control systems" is a threatening message, even if it isn't intended to be. Moreover: every computer system in the world is vulnerable. The process of finding those flaws is disruptive. It can't be the case that knowing in the abstract about those flaws is a predicate to allowing people to disrupt systems to find specific instances of them.
- kragen 11y ago
  You are right.