Trusting Trust: Ken Thompson on supply chain security (1984)
dl.acm.org
dl.acm.org
"I have watched kids testifying before Congress. It is clear that they are completely unaware of the serious- ness of their acts. There is obViously a cultural gap. The act of breaking into a computer system has to have the same social stigma as breaking into a neighbor's house."
I've got mixed feelings about this. I loved the WarGame movie for a reason...
I'm not sure how Ken Thompson feels about the current climate, but judging by the harsh punishments that are being handed out for computer crimes, I think we've swung the pendulum far too much in the direction Thompson argued for here.
United States v. Swartz comes to mind, where Swartz was facing up to 35 years in prison downloading academic journal articles.
I don't think it's a well defined pendulum anymore. Our computer systems used to be little hermetically sealed boxes where network activity was the exception, not the rule. "Breaking in" was a rather well defined thing. Things are different now.
The modern web would look to people in the 80's like one giant remote code execution exploit. There are so many cases where commonly used apps phone home for updates and instructions (and for some reason, we're ok with this). Last time I installed Windows it tried to get me to set up a Microsoft account which I could use to manage it. Unless you've taken steps to opt out of this, your device isn't so much "your" device as it is the part of the vendor's fleet of devices which happens to be assigned to you.
Betrayals of trust still happen, and they're still serious, but "unauthorized entry" is an outmoded way of thinking about them.
Educational. Legal. Most of the fun with none of the risk.
We no longer have a need to romanticize hacking real computers.
If your idea of fun is breaking rules, for any purpose you can name there are probably better rules to break. Though you'll forgive me if I don't sit here and start listing them.
But at the very least, if this is what you want to do, get hired by an intelligence agency and do it under their aegis and protection. Freelancing in this domain has become all sorts of bad idea.
No need to limit yourself. You can break other rules too, quite likely at the same time.
Poor security in some computer systems doesn’t equal unlocked - in the physical world many locks can be quickly unlocked by someone with only moderate training.
I doubt most would say that having an address is the same as having the keys, but it's plausible that it could be seen this way.
By that same token, if you put your keys in your mailbox but the door is locked, it does seem different for a kid to enter that door vs a totally unlocked door, even though anybody could do it easily. The locked door is a signal, "this is not meant to be public."
I guess this is why we have judges, though. To make judgments.
It depends on what you call public. URLs sometimes contain keys, for example Nextcloud shares or CryptPad documents. Or Jitsi Meet rooms (and virtually all videoconferencing system for that matter).
> I guess this is why we have judges, though. To make judgments.
Absolutely. I also think that we should not really try to view this stuff in technical terms, but rather in terms of intent. Is the thing we are considering obviously not supposed to be public?
Now, regarding Aaron Swartz, I do think civil disobedience is an important thing, and that public research should be public. It sounds so tautological it almost feels stupid to say it.
"It should not matter that the neighbor's door is unlocked."
My counterargument is that a poorly secured system is exactly what most locks are. It's not actually a different thing despite what the argument was implying.
So yes, people shouldn't go to a neighbours house just because it's unlocked or has an easy-to-pick lock. And they shouldn't breaking into a poorly secured computer system, either. But that's a tangential argument to what I am trying to say.
When is a computer broken into and when is it left unlocked?