Hacker News Reader

Comment by ssl-3 | Hacker News Reader

There's no legitimate purpose in bringing crayons and a coloring book, or a box of paperclips, either.

We should probably see to it that nobody brings any of those things in, as well.

This isn't an exercise in cataloging all worldly items. The criteria for the list is very obviously:

[no legitimate purpose] + [identified as a potential threat or disturbance vector] + [described in a way useful for laypeople who will be consuming said list]

The fact that these items were thought to satisfy your item number two, while more dangerous items did not, indicates that someone's feeding bad information to security, or alternatively, that was not the criteria. There is also some indication of Mr. Robot style fantasies about the power of individual computers.

What do you think is missing?

If there was a legitimate purpose for banning SBCs (there is not), then all computers with wifi would have to be banned. The external fact is that raspis are not a security risk. The internal contradiction is that raspis are computers. It's their whole selling point - they're ordinary PCs.

Also need to ban any Android phone models which can unlock the bootloader.

I don't think you understand the threat profile of a large public event. The typical threat to events like this are idiots who mimic crap they see on YouTube. Public safety isn't an exercise in evaluating every theoretical threat, because that list is too long to address with limited resources. It is an exercise in evaluating which threats are most commonly to be exploited, and the easiest to protect against. This is how you most effectively protect an event with limited resources. It is different than the theoretical threat evaluation that someone doing computer science might think about.

Raspberry pis are not a "likely threat," because they are not a threat. It's hard to get away from that fact when evaluating the absurdity of the ban.

Idiots running script-kiddy exploits on any device is a threat. The list says "Raspberry Pi" because of the utility in communication to the parties reading the list, not because it is technically accurate.

Cops are going to turn you away from this event if you carry in something that looks like circuit boards and wires.

A raspberry pi is a computer. It had HDMI ports on the back. You can put one in a box. Come on, man.

And? There’s a lot of things that people could theoretically do. The few seconds that someone is going through event security isn’t going to stop a competent attacker, nor is it reasonable to expect them to be able to do that.

The point is to stop the most common attackers who are sloppy idiots.

No incompetent person could feasibly use a Raspberry Pi to do any harm, and I invite you to find any examples to the contrary. It is easier to abuse a phone.

This is the point.

It is solving for the wrong problem. An idiot with a Pi or Flipper Zero isn’t the actual threat any more than Star Simpson was.

And if you don’t agree the stupidity that Star was put through was absurd, then we simply won’t agree on the matter.

There’s a difference between security/intelligence and theater. Too many people mistake the two, because they’ve been trained by folks like the TSA to mistake theater for security/intelligence.

You are all spot on with in terms of a technical information security evaluation here.

Unfortunately, the reality is there are not enough information security specialists in the world to hire them as event security for every large public event. And even if there were, the logistics of such an event would not allow for enough time for a proper information security screening.

What you're asking for is not theoretically wrong, it's just impossible to implement.

I agree.

My argument isn’t that every event can and should build an intelligence apparatus. That would be impossible, though it would actually provide security. I agree.

My argument is that banning flipper zeros does not do anything to improve security, even if they wish it did. If they actually cared about security, it would cost them a lot more time and money. Instead, they’ve chosen theater. I don’t even have a problem with this necessarily, if it makes some people feel safer; I have a problem with anyone pretending it is security, and not theater.

When someone is given a placebo during a clinical trial, they are informed and unblinded after the trial so that they do not think they were on the actual medication; this is because otherwise, they would draw the wrong conclusion from the trial for themselves.

This is theater; that’s okay, maybe, but let’s not pretend it’s something it isn’t.

Anyway, I think we’re repeating ourselves, and I’m happy to agree to disagree.

You're really missing the forest for the trees here. It's arguable which one has more theoretical exploits. This is an issue of practicality. Phones are allowed because it's normal for everyone to have one in their pocket and impractical to ban them.

With respect (I mean that in earnest), I think you may be the one missing the forest for the trees.

Nobody is arguing we should ban phones. The argument is that banning flipper zeros doesn’t accomplish anything meaningful toward security.

Yeah, they are probably a disturbance at best. Like pets, large signs, beach balls, and alcohol alcoholic beverages, which are other things on the list.

"security" is a lot more broad than just "preventing terrorist attacks"

You don't need to be a super l33et h4x0r to disrupt an event -- you could knock around a beach ball or turn off a display with the IR blaster on a flipper zero. Not everything is life or death.

What’s more likely? That they were banned due to misunderstandings of what these devices are, or that they were banned they are “causing a disturbance”? Can you find an example of such a case? I’m not sure why this feels so important to defend.

There are several definitions of security, but the most relevant (in this context) are:

1. the state of being protected against or safe from danger or threat.

2. the safety of a state or organization against criminal activity such as terrorism, theft, or espionage.

3. procedures followed or measures taken to ensure the safety of a state or organization.

I fail to see how these devices fall into those definitions. I also don’t see how beach balls do either.

So if your argument is changing to: it isn’t security, but rather preventing people from getting in each other’s way (large signs, strollers, beach balls) I once again don’t see how that applies.

I agree those items have nothing to do with security either.

I'm not changing anything -- my root comment in this thread specifically mentioned "disturbances". Mitigating disturbances to the proceedings of an event is plainly a part of event security. The "threats" evaluated in event security are not solely to life and limb but also to the proceedings of the event itself. I didn't think this required elaboration; I thought most people would be familiar with this function of event security.

It is obvious how a beach ball could’ve a disturbance. What precisely can I do with a pi that would cause a disturbance?

Any of the same infrared or RF shenanigans that are done with a flipper zero, and potentially mess with the equipment of organizers or media.

So… basically cloning somebody’s keycard without them knowing could cause a disturbance… ok.

LF keycards aren’t very common today.

Idiots runnings script kiddie exploits on their Android phone is also a threat. And?

Absolutely. The difference is that phones are in everyone's pocket.

Again, public safety has nothing to do with the elimination of risk. It is a practical exercise in the mitigation of risk.

> Again, public safety has nothing to do with the elimination of risk. It is a practical exercise in the mitigation of risk.

Sometimes. Sometimes, it is theatre.

> There's no legitimate purpose in bringing crayons and a coloring book, or a box of paperclips, either.

Do you genuinely think that a parent with a small child does not have a legitimate reason to bring crayons and a coloring book to an event for adults or are you being hyperbolic? Cause this suggests either bad-faith or a profound lack of clarity about the issue and neither is good for your argument.

Good point. There's probably no legitimate reason for non-voting children to be present at such a political event, either.

And by way of the process of excluding these children, the motivation for bringing other items without legitimate use like crayons, coloring books, and paperclips will be greatly diminished.

It's win-win. Thank you for the excellent insight!

Voting adults can’t necessarily afford or arrange childcare which is a legitimate reason to bring their non-voting children. Effectively all non-voting children will one day be voting adults. Exposure to politics before participating in politics is valuable not only for them, but for everyone who will be eventually governed partially by their vote. Legitimate reason #2.

Regardless of the lack of vote, non-voting children are still governed by elected officials, giving them legitimate reason #3 to interact with politics, even if they can’t do so in the form of a vote yet.

You’ve picked a poorly thought out hill to die on.

That's a very well-reasoned argument. It is perhaps a shame that it's been placed against the most absurdly sarcastic train of thought I could come up with ("Coloring books have no legitimate purpose at such an event, and therefore nor do children"), but your take remains well-reasoned nonetheless.

---

I won't be in NYC tomorrow. But if I were planning to go then there'd be a good chance I'd pack my usual way for a short-duration trip: A backpack with a laptop, a change of clothes rolled up tight, and a Raspberry Pi.

Some people bring things like cards or a [coloring] book, but those are not my preferred styles of distraction.

SBCs like that don't take up much space. They pack fairly well and give me something out-of-band to goof around with when I'm traveling and bored, where my usual household distractions don't exist.

I get some pretty creative systems stuff done on them sometimes by creating some whimsical problem, working out the steps for a solution, and then implementing it and seeing how it plays out -- in the field, away from my usual pile of resources. It's fun for me.

There's almost certainly some manner of Pi already in my bag right now, left over from my last trip -- probably housed in one of those cheeky red-and-white plastic cases that the Pi Foundation offers.

It would not be a huge loss if I had to dumpster it like a forgotten nail clipper at the airport after 9/11, but it sure would be surprising. It's not a particularly devilish device and has never attracted any sort of attention, and I would never have reasonably expected it to do so.

>There's no legitimate purpose in bringing crayons and a coloring book

Presumably there might be children (or very bored adults) at the event?

Perhaps so.

But that's not a legitimate use.

And the crayons' delicious nature can be used to distract and bribe the constabulary.

But there isn’t a risk either if you bring them. It’s about potential damage.

And the winner of the "could you be more obtuse award", ladies and gentlemen

Reply on news.ycombinator.com