Hacker News Reader

Comment by Waterluvian | Hacker News Reader

I don't think it's ever acceptable to make an "if I didn't do it, someone else may have done something worse" defense.

Which is part of what causes tragedies of the commons, yes. I totally get your point, and it's valid, but it's being demonstrated right now that the current appropriate strategies have failed rather spectacularly.

When appropriate measures have massively failed, what are the alternatives? Vigilante actions are one option, as is "watch the whole thing burn down", and probably an infinite variety of stuff in the middle and along different axes. What's your preferred option?

edit: also, it's not quite "may [do] something worse". Insecure IoT things are used as botnets. Frequently. It's not a hypothetical threat at all, it's just a question of scale / frequency.

I see like a food safety inspector going around shutting down unsafe restaurants. These IoT devices are a danger to society and should be shut down.

More like an unlicensed vigilante "food inspector" going round restaurants and burning them down on sight of a cockroach.

In a society where people refuse to have food inspectors and some are being harmed by food poisoning, I think one could argue that there isn't something wrong with that level of action.

I think it's more like firearms. These devices can be and are used as weapons to hurt 3rd parties on the Internet. It's more like firearm owners leaving their weapons in front of their barely-sturdy windows. Then, folks needing weapons keep breaking the windows before firing them at others. The homeowners and homebuilders keep letting it happen.

So, vigilantees concerned about damage to innocent people keep breaking into the windows, stealing the guns, unloading them, and tossing them into landfills. I'd be like: "Stop putting your guns in front of the windows. Be a responsible gun owner." Enough broken windows and stolen guns might incentivize them to do that.

Soft-bricking is hardly comparable to burning something down. More like adding an extra lock and throwing away the key. Inconvenient, but not destructive.

To you as a domain expert, yes. A typical user just tosses the device into the trashcan. For him it’s effectively bricked.

Food safety inspectors have an official remit to do this that is enshrined in statues and local laws. You don't get to just decide for yourself you will shut down some restaurants on a freelance basis.

DDoSes are as bad as food poisoning now?

When it causes millions of dollars of damage... Yeah. Sure. Why not? https://www.zdnet.com/article/the-average-ddos-attack-cost-f...

You measure your health in dollars? I dare say you won't find much common ground with most people.

You'll find it in tons of large-scale (e.g. governmental) decisions at the very least. "is it worth more to prevent X than to deal with the fallout" is a decision that has to be made at some point, and human life / injury are part of that equation.

So, in a way, yes. I do. So do lots of people when they go to urgent care rather than the ER, knowing that the ER could bankrupt them, and they'd rather risk the delay. I don't have numbers off the top of my head, but I don't think it's as uncommon as you seem to think it is.

Never seen the "meat chart" for folks injured in the US have you ?

You are priced per body part based on your income. Your health is most certainly defined in dollars.

The most critical part of my point was the subject(s) performing the pricing, which you guys are somehow completely dodging here.

Most people have wildly inconsistent treatment of health risks and are largely reactionary. Not sure they are a good basis for determining what is ethical/moral actions.

What if you work in a job where you're paid by the hour and need to take time off due to illness?

I daresay that this situation even applies to "most people", or at least a very sizeable proportion of the global workforce.

That's a misleading representation of the defense. "If I didn't do it, they would eventually have become a public nuisance in the form of nodes in a botnet" captures the supposed intent more fairly, and with the intent to target every known vector used by Mirai and Qbot it seems quite realistic that these systems would eventually become botnet nodes.

It's IMO somewhat comparable to culling high-risk farm animals to prevent widespread disease outbreaks.

There is a dead reply to this which I think asks a fair question.

> Where do you have legal authority to do a vigilante culling of your neighbor’s herd, because you decided something about them merited it?

I am not making the argument that this is legally defensible. You can by definition not have legal authority to engage in vigilantism. It's from an ethical and practical perspective that I draw the analogy.

On the matter of legality, the difference you point out applies, but also goes both ways. There is no legal framework around "culling" insecure devices, and very little regulation.

Okay, I accept your analogy.

Where do you have legal authority to do a vigilante culling of your neighbor’s herd, because you decided something about them merited it?

Reply on news.ycombinator.com