Hacker News Reader

Comment by defkev | Hacker News Reader

Then teach them how to build a lock, not to pick it. Teach them to build a secure infrastructure, not how to hack into one. Your "ethos of curiosity" is mostly practiced by not-so-ethical criminals in prison, where they teach other prisoners their "skills" Whats next? Teach them to forge documents for identity theft?

View on HN

-To stay within this narrow example - how is one supposed to build a better lock if one doesn’t know how current ones can be defeated?

I see this as a brilliant move to foster the kind of curiosity which IMHO is essential to be a good engineer; as an added bonus, it teaches them from an early age that systems can be defeated. That goes a long way towards curing the blind faith in the security of, say, one’s cloud storage...

You cannot learn to make a secure lock if you don't know how to pick a lock.

Similarly, you can't build a secure system if you don't know how you'd crack a secure system.

Of course, you don't have to really know exactly which tools to use but you'd still have to know the common methods of attack, how they work, what type of tools people might use.

Once you know that, you can take steps to defeat the tools and workarounds.

What's a more interesting way to get people interested in IT, plopping them down in front of a VM and teaching them how to stand up a DNS service, or teaching them basic pen testing? People are only going to put in the time to learn the subject matter if they are intrigued by it. As an example, I sat through a few CS classes in college and thought they were painfully boring. A few years later I learned how to script and saw the power of software development, and I became interested in going back and learning the fundamentals to advance my skills.

Female programmer here: just about any of them would be more interesting personally.

As a topic it sounds cool, but it is not actually that interesting, not what attracted me and you won't be able to use those skills that much in real life or real situation. Not that practicality is standard, I like plenty of impractical things (like theory).

I mean, doing basic pen testing is repetitive mind numbing work that requires mostly rote learning. It gets interesting and challenging only later on. Fake hacking exercises can be fun, but that is not basic pen testing - that is game.

I can’t tell if you’re a really bad troll or a really bad teacher.

To be fair, if the goal was to craft a comment that would clash most egregiously with hacker culture, your man hasn't done too bad.

How exactly do you propose learning how to build a lock without learning about how to exploit their weaknesses?

The point isn’t to learn how to pick a lock. It’s about learning how things work.

I think we should stop teaching chemistry too, it after all teaches one how to build bombs and other chemical weapons. /s

This is downvoted, but I half agree with sentiment. I don't like glorification of hacking either and outright hate when lack of respect for boundaries (at mildest hacking is exactly that), willingness to cheat or harm others are treated as proxy for tech aptitude. That is all too common in our culture.

Through, here it is likely to be framed more as game and not real thing. When they shoot water pistols, they are not learning to kill either.

> lack of respect for boundaries (at mildest hacking is exactly that), willingness to cheat or harm others

One of those doesn't belong on this list. Lack of respect for boundaries in this context is really a lack of respect for authorities, and that is an extremely important thing for a society to have, and has absolutely zero intrinsic connection to willingness to cheat or to harm others, very much to the contrary: Only if you are willing to challenge authorities will you successfully counter authorities harming others.

You can learn how to subvert systems and at the same time how to use that skill to the benefit of society, be it by building systems that aren't so easily subverted where that is appropriate, or by defending people who unjustly are accused of things they didn't do due to unjustified trust in the reliability of an unreliable system.

I really meant and observed lack of respect towards others not just autorities. Reading other people's messages for lols or making cruel jokes on them did not challenged autorite - mostly powerless randoms. There is such a thing as awesome challenging autorities, but throwing temper tamtrum because autority told you not to be jerk to other kids is not that. These types were more likely to frame innocent person they disliked then stand up to defend someone else.

None of that has anything to do with kids toy hack exercises. Which are exactly that and are fine as long as they are fun.

Seems to me its a form of cargo-cult development: its what the ‘great’ hackers did, so we must do it to become a great hacker too.

Reply on news.ycombinator.com