Hacker News Reader

Comment by knowaveragejoe | Hacker News Reader

So, rootkits are okay then...?

Rootkits are a thing. They're neither good nor bad. That value is supplied subjectively within different contexts, no?

Would I want the RIAA/MPAA to install rootkits in media files that are distributed to customers? Absolutely not.

Would I want the ability to install rootkits in engineering schematics and documentation that are never intended to be distributed outside of my organization and are only activated in cases where data theft has occurred? Absolutely.

I would also want the ability to shoot anybody I dislike at will, but make it so no one else would have this ability. But fortunately for our civilization, it is not rules by what I like. That's why if you suspect somebody stole a car from you, you can not just make it blow up - you have to call the police. If you suspect somebody stole a software from you, should you be allowed to blow up their computer? In the same vein, definitely not. In the light of abundant copyright abuse we are witnessing now, I am astonished to see anybody even considers this idea to be sane.

Based on your comment, I can see that you have not read the paper. The section with rootkits is about thwarting active, targeted cyber espionage. Organizations should have the right to protect files on their own networks by any reasonable means. They are not proposing a mechanism by which organizations would be allowed to distribute rootkits.

I certainly have the right to disable my car remotely if it is stolen. I also have the right to lock the doors and take pictures of the assailant who stole it and send them to the police.

I also have the right to lock the doors and take pictures of the assailant who stole it and send them to the police.

Wouldn't locking the doors effectively be kidnapping?

Is it kidnapping when doors lock in robbers during bank robberies? I believe that it would be covered under citizen's arrest common law and statutes. Generally, a private citizen has the right to make a warrantless arrest during or after the commission of a felony or during the commission of a misdemeanor.

I doubt you have the right to cut off the engine while the car is being driven. Also in the example cases you mentioned you have the right to do something with property that is legally yours. The problem comes in the fact that someone else's computer is not your property so no you should not be allowed to install rootkits and take control of their computer. The best example of what your talking about is DRM which is already legal.

Sending pictures to the police is not the same as disabling the whole system on the suspicion of illegal access. Especially that copyright trolls' opinion of which information belongs to them may be very different from anyone else's, to which we have seen a lot of evidence. So I wouldn't want to have my comp locked up because some media company decided it absolutely needs to install rootkit on my machine to watch some legit movie I paid for and later that rootkit thinks I've downloaded some files to which they hold copyright. I appreciate that they would like this power very much - as they probably would like the power to conduct searches without a warrant or imprison and fine people on mere suspicion, without tiresome process of trial. That would indeed make punishing criminals and fighting crime much easier. The only thing that prevents it is that people have rights, and I'd very much like to keep them, even if it inconveniences some companies a little. I'm not living for their convenience and at their pleasure, so they'd have to find some other ways to protect their interests.

Sure, I agree entirely. However, is that what's being advocated here, by parties concerned by such a thing? If so, the headline is incredibly misleading.

The headline is incredibly misleading. Please read chapter 13 of the paper.

A major problem with this is liability the first time this causes major damage to systems because the rootkit had a bug or because someone in your organization legally redistributed the data outside your organization, with approval, but without realizing the consequences.

Especially as it is unlikely this would affect serious criminals: If tech like this becomes common, then nobody sane would open stolen files without ensuring it was done in a self-contained environment and with software that ought to be unable to execute any of this crap. It will be trivial to stop for all but people who are unaware.

You are arguing a different point, but I do agree with you. I am not arguing that the ideas are necessarily effective. I am just pointing out that the BoingBoing article is wrong about many points.

Reply on news.ycombinator.com