Hacker News Reader

One of the worst is the cyber-security political purist. The person who has drunk the kool-aid so badly and/or likes to use their knowledge to beat others round the head with it. The person who likes to talk about things like "risk/threat modelling" but actually doesn't:

a) Have a real understanding of the needs of the people they say they are trying to help

b) Have the courage to make tough calls related to ideal vs good security.

Working in the NGO security space we get these people all the time. Send them out in front of a bunch of African/Middle Eastern/Asian/Russian activists who have been risking their lives for years for democracy etc etc and all they do it spend three days showing off, berating people and then leaving. Telling everyone that TAILS/PGP/Linux/TrueCrypt etc etc is for everyone and that anything else "is gonna get people killed," so by extension shouldn't be done. There are people who have made entire careers around taking that attitude, which most of the time actually leads to demoralisation and a long-term decrease in security.

It's easy to recommend the hard "cover your ass" stuff because you don't like the NSA, it's harder to say "Hmm, ok we gotta assume some risk that the NSA doesn't care what we're looking at and use a solid Google two-factor here and see how we get on...now how do we stop the security guard from selling you out?"

This. If the Mossad/NSA/PLA thinks there is anything of value on our network, they either already have it or could trivially get it. It wouldn't be the end of the world if they had it, so I don't really care.

Yep, within reason - I don't buy into the "I have nothing to hide argument, so I have nothing to worry about." People like Trump or UKIP remind should remind us of the danger of that. Though we should remember, in a realpolitik world, the long-term interests of the NSA -> US Gov -> West etc is in supporting democracy activists for example. It's just a pity that the sensationalism of "counter-terrorism" interests in the short-term, actually damage the long game.

On a sidenote, as a digital and physical security training company for NGOs we manage to get a look at cases from both sides of the coin. Our very very rough guesstimate is that we see confirmed human penetration about 3 times more than we do digital penetration. Of course, this is very rough and has soooooo many other bias factors at play (numerical, cultural how many we see vs not see etc.). But I think it is a point that we keep having to reinforce. Too often powerful "infosec jerks" distort the the focus towards Western biases because of Snowden, Facebook, SnapChat, iPhone and this distracts time, money, energy, training and security measures from the human penetration aspect of things - which are very common in the developing world.

So I had to read that last paragraph twice. Could you explain what you mean by "human penetration"? And no, I'm not being dirty (though my mind did initially do a few mental flips when I first read that phrase, it's not my fault I never completely matured...) I'm genuinely asking what is meant by that. Do you mean that someone walks in and attaches a serial cable to a router and their laptop, or plugs in a USB stick into an unlocked workstation?

No, at it's most basic level I mean a spy or insider threat.

In the NGO contexts that I have seen that usually means someone who legitimately is works in an organisation but turns for the standard reasons. (More effective, faster and cheaper for an adversary that way)

To a slightly lessor extent, that means someone from the outside who has been placed on the inside. (Less effective, longer and more expensive for an adversary that way).

Sometimes both of these scenarios also include digital aspects, like stealing a USB drive or something but not always.

Before you ask, why do people do it in an NGO environment - fairly similar reasons as elsewhere (though I tend to order them differently based on experience):

US Method of Counter-Intelligence:

-Money

-Ideology

-Compromise or Coercion

-Ego or Extortion

or these days:

-Reciprocation

-Authority

-Scarcity

-Commitment

-Consistency

-Liking

-Social Proof

A good read for more info here: https://www.cia.gov/library/center-for-the-study-of-intellig...

Well that's scary as all fuck! I didn't realise NGOs were as susceptible to this sort of thing as commercial enterprises. I guess I was being naive and should have known better.

Thanks for the insights.

Honestly, in many cases NGOs actually have a far higher physical and digital security threat environment than corporations. Partly that's one of the things I love about my job.

I mean yeh, it's cool if you can get paid loads of money for a 9-5 job to throw a ton of resources and people at protecting your Pied Piper software company in suburban USA or Europe....But now take the exact same advisary (China gov for example) and try to think up ways to minimise their threats all while driving around with a hobbiest sysadmin (who the local gov may arrest, torture or disappear if exposed) with very little English in the middle of the night in darkest Africa/Middle East/Asia...The pay is crap or non-existent, it can be high stress but you get to make a real difference, which is rewarding.

Question for you, what company do you work for? I've really wanted to break into NGO security in particular for a lot of reasons. Spent a lot of years working in NGOs, and now do internal corporate security. Pay's better but it feels different. Could you possibly reach out to me? pdoconnell at gmail

Cool.

We run our own. It's here www.secfirst.org - email me rory@

All I know is that far too many "security guy" discussions sound like dick waving contests pronounced in the tone of The Simpsons' "Comic Book Guy".

It's sadly nothing at all like debates between people pushing different unit testing methodologies.

Also nothing at all like debates about static vs dynamic typing in programming languages!

It's an interesting categorization. I'd be in both categories given various activities. Yet, I disagree with category 1 as it seems like an accidental strawman. There's certainly those types of people literally. There's more of us, though, that see insecurity baked into almost everything we depend on even as a country. The state of the grid, banks, increasingly important mobile OS's, infrastructure protocols... you name it... has been shit for way too long. Unnecessarily so. You alluded to that with your DNSSEC example.

So, on top of engineering challenge, there's the need to fight for a greater baseline across the board. I'm just for doing it a different way than in OP where they call the dev's idiots. ;) More along the lines of convincing management to adopt whatever practices add great improvements to quality and security with little extra cost. Quite a few exist. The value is lower liability, more predictable schedules due to reduced debugging, quality/uptime differentiator vs competition, and possibility of charging extra for that.

Enough promotion of better-by-default in key areas will improve our baseline over time. There's actually been a lot of progress vs where we were in 90's. So, it's at least working a little. DARPA and NSF are also steadily funding strong stuff in variety of areas that has legacy compatibility where possible. More potential to push strong stuff in the future.

>they're the ones shipping grievously broken cryptography to try to "stop the NSA"

I don't understand this aspect of the strawman. Could someone help me out? In the context of the previous two examples of how members of group 1 act, is tptacek merely implying that members of group 1 are stupid?

This can probably be read as a dog-whistle to his war on the EFF Scorecard in general, CryptoCat in particular, and Nadim personally.

It's not complicated. Most of the world's really bad amateur crypto is written as a vanity exercise in saving the world. It's not like there's uncertainty about whether people have launched grievously, dangerously broken crypto software; they have. And those people do tend to be #1's.

Also, please do not try to represent my problem with the EFF's scorecard as somehow idiosyncratic. There probably aren't too many crypto engineers who don't share my opinion of it. You're probably giving me more credit than I deserve when you call it "my war".

> immortal struggle between good and evil

Immortal, maybe. I don't know about it being a struggle, so much as polarization. Think how fucked up angry memes can make things.

Security is discrimination. Keeping you out of my shit involves saying "these things here are mine" and "those things there are yours" and "I won't allow your things and my things to entangle". Someone who hacks that discrimination is for entangling things in a one way direction (your stuff entangles with theirs, but not the other way around). Manning hacked for everyone, wanting the entanglement to go both ways. (I taught Manning how to drive, FWIW.)

In Zen Buddhism, discrimination is considered to bring consciousness. Something that is aware of itself completely (all knowledge) is non-discriminatory in nature. Security, in contrast, is all about keeping things separate. If you understand that, you understand consciousness.

People who "get" security on another level will struggle to find a happy medium between these two polar ends of not knowing and knowing. What is the right amount of security? What data of mine is mine to keep? How can seemingly innocuous data be used in secret to bring lower levels of consciousness to a given group? Government surveillance springs to mind.

We could stand to have more tolerance for "jerks". They may be jerks because they understand the gravity of the situation. Others may not, and need to be given the information to understand it. We are in interesting times. If we do not guide the transition carefully in the coming years, there will be much suffering...due mostly to poor security.

This is a strange statement. Do you underestimate how many of your friends and respected peers are #1?

I think it's the #2s who are too quick to dismiss #1s that I tend to have a problem with.

I don't think jerkiness correlates with either of them even a little bit.

There are people who are both #1 and #2, but they're pretty rare. Or, at least, that's the perception I get, because I don't generally have to interrogate people to learn if they're #1s: they're all too happy to broadcast that fact.

Are you speaking from personal (statistically insignificant) experience or do you have some quantifiable evidence to share?

Your HN-karma & real-world accomplishments aside, do you honestly think you can psychologically categorize a group accurately enough that we should use your defined stereotype to improve ourselves and/or society?

I think it's pretty obvious I'm speaking from personal experience, and I'm not sure it matters to me what you choose to do with that information.

Would you consider the Wozniak/Jobs story part of the canon? The hero's journey from #1 to #2?

(i.e. #1 Cops & Robbers -> #2 Realpolitik)

>I think it's pretty obvious I'm speaking from personal experience, and I'm not sure it matters to me what you choose to do with that information

Everything is obvious to the person who has nothing to learn.

I'm sorry, I'm really not clear on what you're trying to say here. Do you disagree with the #1/#2 breakdown I presented? That's totally fine. But I don't think it's any less productive than the discussion about whether "infosec has a jerk problem".

The article show-cased common social problems and then shared ways of mitigating, even understanding, the "jerks". We could all be more kind.

Your post seemed to be focused on the details of those you dislike. That's it. No story about how you built camraderie or struggled to understand them. What lesson should someone learn from your post?

Huh. Fair enough. My comment is definitely about my issues, and probably not (now that I'm forced to reflect on it) in the original spirit of the post.

This particular issue is buzzing in my head this week because of the stupid grsecurity Twitter drama, which is really bugging me. I guess I'd like an "infosec community" that spends more effort thinking about engineering and less about community dynamics.

We could definitely all be kinder.

I can think of several people who fit firmly into both. Moxie, for instance. I fail to see how these two categories are mutually exclusive.

Hold on. The definition of my #1 category isn't a belief in good and evil; it's the idea that their primary function in the field is to save the world, not to perfect security engineering. Looking at Moxie's work, I don't think anyone can legitimately accuse him of not taking engineering seriously.

I understand that, but it's reasonable to suspect that for a significant number of #2s, #1 is the initial motivating factor that got them learning.

We see this all the time in software development, where excellent engineers are borne of trying to build a video game at age x, where x is a relatively low number.

Similarly, there's no reason that someone initially motivated to eradicate "evil" can't become a great security mind, and I suspect Moxie and many like him are of this ilk.

Again: you're rebutting me as if my argument was that anyone who believed in "good" and "evil" was a #1. That's not my definition of a #1.

Shouldn't there be a #3: people who are into security because it's important for their entity's constituents?

My #3 would be people seeking a low barrier to entry cushy corporate job. Unfortunately for me, I encounter way more #3's than #1 or #2's...