Hacker News Reader

Comment by thewebguyd | Hacker News Reader

> It is the young people that are growing up conditioned to press accept

It's really alarming, actually. I run the cyber security training & phishing simulations at my work, and it's the younger employees that struggle the most. It's like they just assume that everything on the web is trustworthy.

It's not hard to see why though. They grew up with app stores & locked down devices. No concept of a file or file system, no concept of software outside of the curated store & webapps. People that never had to take responsibility for their own digital safety because "someone else" (Google, Apple) always did it for them.

View on HN

> It's like they just assume that everything on the web is trustworthy.

> It's not hard to see why though. They grew up with app stores & locked down devices.

When we create a safer world, people’s defense mechanisms naturally atrophy or are never developed in the first place.

The problem is, we haven't really created a safer world. We created an illusion of safety by taking away agency.

We might be safer in terms of vulnerabilities, root exploits, RCEs, etc. but the internet is still full of malware, scams are still just as rampant. Vigilance is still very much required, but is no longer taught.

Look at all the malware available on the Play Store. The curation does nothing but create an illusion of safety.

It’s absolutely safer browsing the internet now than it was when I was a kid. Getting a virus or equivalent on your phone is no small feat

The late 90s internet was filled with predators, skeeziness, and viruses that would break your computer and require a reformatting.

That stuff is still there if you look for it, but it's not on your social media feeds or in any of the apps provided through app stores.

They don't break your computer. They still do all the other bad stuff.

It's really not the same magnitude at all. It's much harder to run into those problems now.

Yeah I don’t understand what these other people are saying. There are definitely more barriers to harming your computer online now than there were 20 years ago. Even just email clients preemptively flagging suspicious emails is a huge leap lol

Is it that much different? In the past if you downloaded the wrong file, you could get ads opening constantly, a new toolbar taking over your browser, data scraped and sent off to a mystery server, or have some process maximise your compute.

This accounted for most of the risks on the wild west internet, but the worst case scenario of permanently losing data or having to reinstall Windows was actually rarer than it was made out to be imho.

These days the common risks are the same, except they're no longer risks - all of those have been built into the fabric of everyday internet usage and criminals have been replaced by businesses. It's like the cliche about Vegas being better when it was run by the mob.

It happens all the time, and its as easy as sending a phone a text, or a packet, or escaping a sandbox, but you'll rarely be aware of it when you're infected because unlike the old days where malware would fill your screen with ads or something today they just silently collect your data or use your internet connection for careful port scans or DDoS attacks. NSO Group spyware (or similar) could be on your phone right now.

Hell, cellphones these days ship with spyware pre-installed. Samsung being the one of the worst for filling their phones with their own apps which spy on you constantly.

No nation state actor is going to waste a 0day on a random nobody. Even the recent Notepad++ exploit was only used against specific political targets. Any actor smart enough to be able to have an arsenal of 0days at their disposal is also smart enough to use them only where they are worthwhile because they will only get to do it once.

Believing you are more under threat from sophisticated government hackers rather than unsecured IOT devices, unvetted npm packages or hijacked download links is just LARPing for people who want to sound more important than they actually are IMO.

We've seen examples of phones being hacked which belonged to journalists, producers, editors, activists, staffers at NGOs, lawyers, security researchers, doctors, CEOs, HNWIs, government workers, and even their families and friends. You can bet there are people here on this site which would easily be considered valuable enough targets and because the people those targets associate with are also being hacked you can bet that there are lot of "random nobodies" caught up in it. It's also not just governments using attacks on cell phones, those just tend to be the most dangerous.

That's the philosophy behind Safety Third.

Just curious, what come first and second in this use of the phrase applied to computer security? I came to know the expression from fire circus performance and adjacent circles, where first and second are safety of the audience and the venue, and third is your own. I use it often when I'm about to knowingly do something sketchy or potentially dangerous without applying safety practices required "by the book", acknowledging the present danger to myself and accepting the risk. I never saw it used in infosec context.

Interesting, I haven't heard of safety third from circus circles, I've always known it as more along the liens of if safety were actually the number one priority, no one would actually do anything because it's too risky.

In terms of cybersecurity, I see it as "security first" culture means people rely on the system to keep them safe. "Safety third" (or security third) emphasizes that everyone should already know they are operating in a risky and dangerous environment and take security as a personal responsibility.

It's just a reminder that no one cares about your life more than you do, so stay vigilant and take personal responsibility.

edit just realized I didn't actually answer your question on the first and second priorities.

I suppose First would be the reason the system exists in the first place (buy something online, for example). Second would be the user experience of doing the thing. Security should help you take calculated risks rather than prevent you from taking any risks at all.

When I joined my last job I noticed that their email settings were misconfigured... EVERYTHING was going straight to the inbox, not even the most basic of spam filters were in place.

When I got filtering on observe-only mode I saw users were getting up to a dozen phishing emails every day.

We quickly did a hard simulated phishing test and most users opened the email but zero users clicked through.

Two years later, after we had excellent email filtering in place, our simulated phishing test had a 30% fail rate.

Take from that what you will!

Immune system exercise, interesting point. At least you’ve kept up the checks.

In some sort of weird sense, it makes me appreciate the 'free armor trimming', 'alt F4 helps block attacks in pvp', and similar people in RuneScape. It gave young me a very low stakes environment to learn about scams, losing only what amounts to a little bit of my time. I wonder if there is an argument that we should encourage a certain level of scamming in video games just for the lessons it teaches at low cost? Alas, this isn't generalizable to society at large.

Maybe we should make young learners in primary school use "infected" Windows XP so they can dodge spam popups and learn what and what not to click.

Growing up I had a "computing" class in high school. It's where I learned to type, but also learned the basics of using both macOS(9 at the time) and Windows.

It was also drilled into me that the default state of anything on the internet is to be untrusted and potentially harmful.

It also helped that you could actually tinker with things, and there were plenty of foot guns around to drill that lesson home.

Somewhere along the way that message got lost and didn't get communicated to the young ones, and I'm not even that old (38).

They'd just click it away every time, when my nephew got a gaming laptop he'd play mindcraft and the windows sticky keys popup would be firing constantly must have seen him dismiss it 15 times before I offered to show him how to get rid of it.

Just remembered, even more distressing he first said "No it's ok" until I insisted it had to be solved if he wanted to game on it and could be easily solved.

> They grew up with app stores & locked down devices. No concept of a file or file system

I think almost every Android user has thise concepts.

But on the trustworthy web assumption, I agree. The only effective remedy is a personal calamity.

Are you really exposed to those concepts for daily Zoomer usage? I mean, you can spend your whole normie life using an Android phone never going to the file manager.

(fwiw it's been a while since iOS also have those concepts)

People are also struggling to think about what is computed or stored where or what different wireless interfaces do. Imagine what sort of data people enter into LLMs!

Absolutely. With many lawyers, it is client personal data.

That's an exaggeration. Young people on average have grown up with drastically greater understanding of what a file is than any other generation that has come before them. They grew up using Chromebooks or laptops in school, constantly interacting with the local file systems, uploading files to Instagram and TikTok from the file systems on their smartphones, browsing their phones for files constantly. They know what a file is, they use & manage files more than any other generation prior.

No other prior generation comes close.

Compare them to people growing up in the 1980s. The average person at that time was overwhelmingly oblivious to computing very broadly, their grasp of a "file" as a concept would have been close to non-existent. That was just 40 years ago.

In the mid 1980s a mere 10% of US households had home computers. And that was a high mark globally, it was drastically lower in nearly every other country (closer to zero in eg China, India at that time). The number of people routinely using office PCs was still extremely low.

Today young people have a computer in their hand for hours each day, and they knowingly manage files throughout the day.

You don’t upload a “file” in a “folder” to TikTok. You upload a “video” from your “library”. Consumers have been conditioned to stop thinking about files especially when it comes to media since iTunes and the iPod in 2001.

> files especially when it comes to media since iTunes and the iPod in 2001

As a non-Apple user, this is not something that happened to me. I literally have a "Files" app on my Android phone and my laptop/desktop.

Both iPhone and iPad have an app named "Files" too.

But it gives you access to almost none of your actual files

So exactly which of “your actual files” do you need access to?

The Files app cannot access images in the Photos app or music in the Music app. The only way to add music to the Music app is to copy the files onto the iPhone from a computer. You can however install VLC player and copy the files into the VLC folder. I guess VLC player is more trustworthy than Apple Music considering it's less isolated. Or Apple really wants you to pay the Music subscription, who knows. Want to give another app access to these files? You'll have to duplicate them, using up more storage space.

I get that it's supposedly about security, but this is not the only secure way. It is however the most convenient secure way for Apple, as now the only simple method of backing up and syncing files through all those isolated containers is iCloud.

That’s a fair point. I was expecting the typical HN geek answer that you can’t access system files on iOS and you don’t have root access

Is that typical? I've seen complaints about lack of root access, and complaints that apps don't work with files in folders, but I haven't really seem them conflated the way you're describing.

Right as an Android user you don’t have a separate photo library where pictures go to? (yes I know this isn’t true).

Yes there has been a Files app on iOS devices for well over a decade

> Right as an Android user you don’t have a separate photo library where pictures go to

Yes, which gets autosynced to my immich instance

As a technical person, who only ever used Android, I have no idea how files really work on my phone. I even used adb a few times but still. From my PoV there are no "files", just photos, videos, screenshots, downloads, application data, applications and system data - all completely different kinds of data.

In my files app i see "downloads" "images", "videos", "apps", "starred", "safe folder". In "images" i see pictures tagged "downloads", "camera", "DCIM", "screenshots" and one odd "2024-12-03_description_here" that I clearly names myself but don't remember doing that.

I have no clue how that maps to a physical phone filesystem, even though I know it's there. I'm sure teenagers don't know that too.

That's what the file browser is called on iOS as well :)

There may be some demographic groups located between people who were young during the 1980s and people who are young during the 2020s, time periods which are 40 years apart.

That's also a stereotype. Gen Z (born 1997 to 2012) is roughly 2 billion people. Among them are the technorati, and the tech literate. The influencers and the influenced. It's fair to compare what was available to them growing up, vs yourself (I learned to program before there was Google), but it's hard to say things that are going to be universally true across that many humans that are interesting. Most of them will have two arms and two legs but will most be able to navigate /etc/systemd/user/? Can't say.

>(I learned to program before there was Google)

I learned to code on a Sinclair ZX Spectrum machine!

"Those were the days, next n" ( https://m.youtube.com/watch?v=-d8UfQn3BEg&list=RD-d8UfQn3BEg... )

And yet, it's the generation that struggles the most with managing files on their work laptops and on SMB shares.

They know app silos, not file system hierarchy. Ask a teenager where a file is on their phone and the will tell you the name of an app. Ask them how to copy it somewhere else, and they'll use the share sheet and send it to another app.

High adoption doesn't equate to high literacy.

> Ask them how to copy it somewhere else

To be fair, at least Android and presumably iOS grant apps by default no access to your files in modern versions.

The only way to get, e. G., an attachment downloaded via Thunderbird to a PC or another app is the share dialogue. A user does not access to the isolated app storage by default on an unrooted Android phone. For better or worse the young user is actually making the right choice here for their platform.

(This is also why making a backup of an Android phone is a nightmare when you aren't using a first party option. ADB is sometimes able to bypass it)

I mean on iOS you do have a raw home storage path you can save arbitrary binary data stuff to, although Apple generally just has the option of "Save to Files"--but you have at least some basic folder structure there you can use and have full access to.

It's just not commonly used for the reason the other person mentioned (share buttons between apps that are file type aware)

That was only recently made the case

True, it's all abstracted away and you don't even get access, but that's part of the problem. We (the industry) are teaching people that proprietary formats inside of app silos are the only way to store your data, making the default state being no control over your own stuff.

Note taking apps are a prime example of this, using a proprietary localdb for notes, inside of app storage you can't access, forcing you to transact with your own data exclusively through the app (and whatever subscriptions or upcharges that come with it). We've trained out the idea that these could just be local text files in a directory you can access and do with what you want.

I've watched discussions around open file formats fade away into obscurity along with the rise of mobile, and now we have to fight on whether we should be so graciously allowed to install software on the devices we own or not.

Not everyone needs to be a computer science student, but some basic level of curiosity or education around how tech works should be required in school, at the very least a warning message of "Your data isn't safe if it's not under your control."

> We've trained out the idea that these could just be local text files in a directory you can access and do with what you want.

But have you considered that a meaningful number of users actually want functionality that plain text simply can’t provide?

I understand files and file systems, I’ve worked in IT for decades, mostly in open source. I still choose a non plaintext note solution because it delivers capabilities that plain text cannot, especially across devices.

As long as the data can be exported to open formats, why would I voluntarily limit the value and functionality my tools can provide?

> To be fair, at least Android and presumably iOS grant apps by default no access to your files in modern versions.

That's exactly the point!

The file system is hidden from modern users. Kids brought up on this now have no idea or concept of where their data resides.

That's exactly the problem. Digital natives have, by and large, grown up with computing devices which try their best to be the opposite of general-purpose: their skills are siloed to the few apps they rely on, and e.g. files, keyboard shortcuts, the command prompt are not part of the "API" they learned.

I use lights every day, but I know way less about electricity than my grandparents, two of whom who could remember when their town was electrified as children and who therefore treated it as the marvel it truly is. And also because we've worked out a ton of bugs in electricity and it often just works.

My kids will know way less about filesystems than I do, because I had to learn DOS commands to navigate around the operating system if I wanted to play computer games, which led to a lifelong interest in how computers actually work at a level they can (and, so far, do) happily ignore.

Or in your scenario, understand the concept of 8.3 file names and why they existed, and when they were removed, and how :P

Sheesh, trigger warning please! I remember the how.

Maybe they do more intuitively think of things as virtual objects, but it seems like the issue is they don't have a deeper understanding of how the mechanisms behind the abstractions work and can easily get fooled into accepting terms they wouldn't if they properly understood.

> easily get fooled into accepting terms they wouldn't if they properly understood.

And easily get sold add-on services. How many people hit the 5GB iCloud limit for backups and just pay without stopping to think that it might be possible to do local backups to your computer and you don't really have to pay for extra storage?

Just hit them with the scary language "You are at risk of losing your photos forever if you don't pay!" because that concept of "Oh, photos are just files in a directory and I can copy those anywhere I want" doesn't exist. To many, those photos are part of the gallery app, not a separate file from it and since that app only runs on the phone, surely it must not be possible to copy them anywhere unless I pay for the storage.

> They grew up using Chromebooks … in school, constantly interacting with the local file systems

While it is possible to interact with the local file system on a school Chromebook, it’s certainly not the default. School interactions with Chromebooks seem to consist of logging with highly secure passwords like “strawberry” and using Google Docs. And playing games with heavy PvP components and paid DLC (paid by parents whose kids beg for it, not by schools) that call themselves “educational” because they interject math problems needed to use those juicy spells, make no effort whatsoever to teach anything, but produce a nicely formatted report correlating scores to numbered elements of the Common Core standards.

> They know what a file is, they use & manage files more than any other generation prior.

Unfortunately, they don't.

They might have had a computer in their hand for hours each day, but they barely know anything about it. The ones who do tend to be those who grew up playing on PC, as opposed to console or mobile, because the latter - despite falling under the "digital natives" aegis - are really shockingly ignorant of even basic concepts.

> drastically greater understanding of what a file

No, they do not. First, simply using something does not mean you understand it at all. Secondly, because the devices they've become the most accustomed to work very hard to hide all those details from the user.

> Young people on average have grown up with drastically greater understanding of what a file is than any other generation that has come before them.

I totally disagree!!! Yes, everyone works with computer, phone, tablet, whatever, nowdays!

But does generation z "knows" about what a computer is?

Absolutely not!!!

While tech has advanced and graduated IT personal know more than previous generations (obviously!), all the rest, while they do know how to do their jobs, they know nothing about computers!!! They are pretty much like everyone else that didn't know what a computer was in generations x and previous!!!

However, contrary to previous generations, because they do interact with the tech, they represent a higher security risc for them and for others!

... Because they know nothing about it!!!

It's like giving a box of matches to a neanderthal in the middle of the woods...

Almost everyone in the "Gen x and previous" that interacted with the tech, did know what they were doing (past the initial learning phase)!!!

This does not happen after gen x!

I agree, but I'd push that to anyone after millennials rather than gen x. I was born in '87 (Millennial) and our generation was the last one to bridge the analog->digital divide, having grew up in both worlds, I think it gave us a kind of unique understanding and relationship with tech that younger folks don't have.

I'm sorry, that's actually what I meant!

It's a comparison between

Gen Y and Gen Z

and NOT Gen X and Gen Z!

It's people born after 1995 that are completely unprepared! Worst: they almost all tend to think they are prepared and that they even know more about it than previous gens (and because tech has evolved they actually accomplish more, but unfortunately they understand a LOT LESS about the underlyings of it!!! Naturally, there are exceptions! Few, however!)

I was in kind of a hurry and messed it up!!! (however, I do tend to think of Y as a transitional generation where late borns - think 92 or after - won't actually remember much of theirs "last analog generation")

So, I do agree with you!

I've tried to edit it but I'm no longer allowed to!

Thank you for pointing out my mistake!

Also, I'm kind of amazed you do remember the analog days! Being born in 87 makes you aware of it around 92 or 93! Past 95 things start to flip and after 00 all hell broke loose (what's analog again?!)!

Most people don't old up much to their 13yo memories! Keep that up! It really makes a difference "today"!

Still it does depend where you live in! This "generations" timeline work well in US cities! But if you change country or if you don't live in a city that timeline doesn't hold up that well! Tech arrives latter and the ways of life get altered later! That's why many people tend to identify more with the previous generations! Specially if you're born on a generation edge!

Yeah... scientists try to put all in one simple bag but the truth ain't that simple!

To disagree and recycle some past writing:

> Yeah, I have a particular rant about this with respect to older generations believing "kids these days know computers." [...] they mistake confidence for competence, and the younger consumers are more confident poking around because they grew up with superior idiot-proofing. The better results are because they dare to fiddle until it works, not because they know what's wrong.

Ah-ah!!!

You nailed it! Simple and short!

GREAT COMMENT!!!

I couldn't think of a better way to put it!

Well done!!!

Ahahah

> Young people on average have grown up with drastically greater understanding of what a file is than any other generation that has come before them. They grew up using Chromebooks or laptops in school, constantly interacting with the local file systems, uploading files to Instagram and TikTok from the file systems on their smartphones, browsing their phones for files constantly. They know what a file is, they use & manage files more than any other generation prior.

This argument is like saying you understand nutrition because you eat food every day and haven't died yet.

Reply on news.ycombinator.com