Ask HN: Why are hackers today so insecure?
Reading through HN's headlines it is hard not to notice that most discussion is generated around countless "threats". The government, the NSA, piracy, patent trolls, banks, other countries' governments, big corporations, etc., etc., etc. This is not what one would expect from a creative community. A hacker is supposedly someone who is enlightened about the power of their own creativity. If you are focused on creating something, none of these "threats" would matter. So what's the reason for attributing so much power to these external "forces", none of which have ANY intrinsic power beyond what you give them?
51 comments
[ 4.3 ms ] story [ 45.9 ms ] threadBesides, hacking isn't just "making stuff". We can hack politics.
Government and NSA actually have power. They have it because we gave it to them. They have power because they have drones, tanks, guns, and armies of people willing to use them at their command. Refusing to recognize the authority of a government, even one you aren't a citizen of, even one whose borders you aren't within, seems naive at best.
If the US government decides, tomorrow, to kill you, that isn't a threat that you can shrug off... or at least, not one that you can shrug off and expect to live a long life.
Sure, perhaps government intervention won't interfere with my creation of something, but in many cases, that isn't even necessarily true. In order to succeed as a business, I have to obey the laws, or be subject to its retaliation. I can't ignore paying taxes, or obtaining appropriate license, or cease and desisting when the FDA tells me to, etc. Pretending that it doesn't exist isn't really an option.
The simple answer is because Microsoft disallows you from modifying hardware that you own. This is a very real power. I personally do not have the capability to produce my own hardware.
The more complicated answer is that the big guns (Microsoft, Google, Apple, etc) have manipulated the government into allowing them these powers. So now we don't just have a technological problem, but a social problem. When we have an entire society of people running to the store asking them to put the glossy digital handcuffs on them, we encourage that kind of behavior. We make it economically viable for a corporation to oppress a large number of people. Circling back to my original point, this makes it difficult or impossible for someone to hack on a new hardware platform that's been locked down.
Imagine if there were a ban on the color green. Artists would be completely deprived of a large part of their pallette, and their art would suffer for it. Tivoized hardware hurts hackers in exactly the same way.
This is the first example that came to mind, there are definitely plenty of others. Basically it boils down to societal problems that manifest themselves as technology.
From: http://en.wikipedia.org/wiki/Windows_8#Secure_boot
Microsoft's certification requirements eventually revealed that UEFI firmware on x86 systems must allow users to re-configure or turn off secure boot, but that this must not be possible on ARM-based systems (Windows RT).
Actually, you can. Here is a link for installing vanilla Ubuntu: http://www.geek.com/microsoft/how-to-install-ubuntu-on-the-s...
This same process will work fine for Arch because it simply disables the secure boot. The only issue I could see is drivers, but the article mentions the only one they had to worry about was WiFi. At least it's a Marvell chip and not a Broadcom.
There's something to be said for both views though. The problem is that everyone is right. You can't trust everyone but you have to trust someone. Terrorism is not the end of the world but it isn't a non-problem either. You can't let everyone sit around all day and not work but you also can't let them starve while working to death for low wages, either, or die of an illness they can't afford to treat.
I think the fundamental lie of adversarial democracy is that we can't both be right at the same time. We are all a little bit right, but none of us can see that because we get hung up on relatively minor differences.
Just because you're paranoid, it doesn't mean they aren't out to get you. (Curiously, the reverse is also true, and I suspect that's what OP is reacting to.)
[1] https://www.youtube.com/watch?v=a1rK4PsP0zY
I'm in your boat, you can't have a free market if one side has all the goods and all the power. "Let them eat cake" is a better recipe for a revolution than for a free and prosperous market.
WRT revolution, observing an epic fail and discussing it doesn't include supporting or enjoying it.
Ultimately the best way to have a robust society is for everyone to be 100% self-sufficient. It's like process isolation; if there are problems with one process it doesn't bleed over into other ones. That's not terribly efficient from an economic perspective. But as far as robustness goes it's excellent.
Specialization in society is more efficient at the expense of robustness. If you're a wine-maker and people suddenly develop a taste for beer you're SOL until you re-train as a brewer. That's a non-trivial process. But so long as wine remains in demand it's far more efficient for there to be only a few thousand (or 10's of thousands or whatever) wineries than 100 million or more. And the wine produced will likely be of higher quality.
Many of the questions we're dealing with today are where exactly to strike the balance between robustness and efficiency. During a boom everyone is gung-ho about specialization, as the downturn sets in people are more focused on self-reliance.
Ultimately like you said there's truth to both sides otherwise society would have shifted entirely one way or the other.
Personally I'd like to see a more robust society as that means that downturns hurt the country as a whole less, and those individuals that are hurt are also hurt less. Yes it's at the expense of growth but as we've seen in the housing and higher ed markets, growth isn't a panacea.
Furthermore, there are (presumably) lots of ways to be fragile, so there may be some other implications not considered here. ... (perhaps if I sleep on this for a few days I might think of something).
A relevant application domain for this analytical approach:
The explosive growth in the rate of production of information and data, combined with the equally explosive growth in it's availability and dissemination combines positively with the world's currently increasing population of educated, involved, and connected individuals. These factors are trending upwards together, inevitably resulting in a dramatic increase in the volume and complexity of available information; posing new challenges for organisation, analysis, digestion and action -- all of which seems (perhaps) to presage a dramatic increase in intellectual specialisation.
In simpler terms: Given that we have access to more information than we know what to do with, a key competitive differentiator is and will continue to be how organized we are at selecting & processing that information.
Human beings tend not to be diversified in their skills portfolio because the efficiency gains of specialization has strongly encouraged people to specialize by way of greater income or profits. Most years this is excellent as the demand for goods and services tends to change fairly slowly. That makes it possible for supply and demand to roughly line up and for people to be gainfully employed. But when there is a demand shock it wreaks havoc upon industry as the highly tuned, efficient machine (or group of people) can now produce 2x or 3x the demand.
There are some who do have a diverse set of skills who I would argue are resilient to demand shocks. Someone who is a carpenter and a mechanic is less affected by the demand which is out of his control and more affected by the decisions he makes for which skill to offer on the market. The demand for fixing cars and carpentry is likely much less correlated than the demand for carpentry and carpentry (perfect correlation) or the demand for carpentry and plumbing (highly correlated).
Now obviously it isn't easy or free to be both a mechanic AND a carpenter and over a single year it's obviously a waste of time to pursue both. But over 10 years or a career it would likely be beneficial. The time spent learning a second trade is effectively an employment insurance premium. It's a costly one to be sure but you could look at it that way.
Society benefits from this skills diversity as well. Aggregate demand is higher with full employment and full employment is easier to attain when people can recover from job loss in days instead of months.
This explains, for instance, why the liberals encode everything in an endlessly proliferating set of laws that are never complete, while libertarians seek to trust people to function like adults in an adult world.
Ahem.
I'll accept that the left values society and the right values self-reliance. But I think your problem is thinking libertarianism is "Right". It's not. It's "not-Left", but it's not "Right" either.
The left wants the government to be everyone's Mommy; the right wants the government to be everyone's Daddy; populists want the government to be everyone's God; libertarians want everyone to act like adults.
Left vs Right is also a popular divide and conquer strategy. Not terribly hard to find something to distract them about other than real issues.
I don't agree with the argument, but the best one line summary of how the divide and conquer does its division is given the classic Reagan quote "trust, but verify" the mainstream right left distinction simplifies down to which side of the comma gets emphasized. Its surprising how well those three words and a comma, can enforce the distraction, err, summarize the difference, or whatever.
I suspect many of those who care about such things care about creating a better society, a better world.
"The platonic nature of the internet, ideas and information flows, is debased by its physical origins. Its foundations are fiber optic cable lines stretching across the ocean floors, satellites spinning above our heads, computer servers housed in buildings in cities from New York to Nairobi. Like the soldier who slew Archimedes with a mere sword, so too could an armed militia take control of the peak development of Western civilization, our platonic realm.
"The new world of the internet, abstracted from the old world of brute atoms, longed for independence. But states and their friends moved to control our new world -- by controlling its physical underpinnings. The state, like an army around an oil well, or a customs agent extracting bribes at the border, would soon learn to leverage its control of physical space to gain control over our platonic realm. It would prevent the independence we had dreamed of, and then, squatting on fiber optic lines and around satellite ground stations, it would go on to mass intercept the information flow of our new world -- its very essence even as every human, economic, and political relationship embraced it. The state would leech into the veins and arteries of our new societies, gobbling up every relationship expressed or communicated, every web page read, every message sent and every thought googled, and then store this knowledge, billions of interceptions a day, undreamed of power, in vast top secret warehouses, forever. It would go on to mine and mine again this treasure, the collective private intellectual output of humanity, with ever more sophisticated search and pattern finding algorithms, enriching the treasure and maximizing the power imbalance between interceptors and the world of interceptees. And then the state would reflect what it had learned back into the physical world, to start wars, to target drones, to manipulate UN committees and trade deals, and to do favors for its vast connected network of industries, insiders and cronies."
http://cryptome.org/2012/12/assange-crypto-arms.htm
If something is helpful to women in tech, it has to be harmful to men, right?
One example would be something like this: http://articles.latimes.com/2013/nov/11/entertainment/la-et-... . I'm neither condoning or accepting of piracy in this statement, I'm only stating that the MPAA is a part of the environment and it affecting education.
Then we can take a look at some of the "cultural" (I am lacking in words at this moment) factors that are in government when watching some of Lawrence Lessig's talks about removing the influence of money from government. Because of that influence of money corporations can influence legislation which can fundamentally change the rules that the market abides by.
An example of this would be reverse engineering. Without which, I might add, the computing market would look dramatically different today. Or does no one still remember the thing with DVD players? I know I had to pony up in order to play Blu-Ray(R or TM) on my computer.
Those kinds of headlines one _should_ expect from a community. A community should seek to protect itself and inform its members of threats both real and imagined. If I don't see any articles about threats in the future I'm going to think I'm in some kind of dystopia and they've managed to infiltrate HN.
I don't understand what this is supposed to mean. Some of those "forces" which you condescendingly put in quotes have actual armed forces behind them.
When your adversary is a foreign government, they have very real power that had absolutely nothing to do with your consent.
You're making a lot of assumptions here...
> Reading through HN's headlines it is hard not to notice that most discussion is generated around countless "threats".
Why did you put quotes around threats? You seem to imply that the NSA, piracy, patent trolls, banks, other countries' governments [and how they integrate with ours], and big corporations do not warrant our awareness. In fact, you don't even believe they are threats apparently by your continued use of quotation marks.
> A hacker is supposedly someone who is enlightened about the power of their own creativity. If you are focused on creating something, none of these "threats" would matter.
Where did you discover the following rules? (a) a hacker is an enlightened creator (b) when focused on creative pursuits, threats do not matter
Could you prove them for me? If not, then why do you use them as reasonable premises for your concluding argument? In fact, you might have an easier time arguing that a creator is more highly aware of threat because they don't want to see everything they worked for go to waste. Programmers naturally become skeptics; not because they want to get down on people but because they immediately look for the holes in the logic. Because, um, it's our job!! Are you surprised when you meet a compassionate nurse? How about a sly politician? No? Then maybe you're starting to get it. The lens we see through the world through is different than the nurses's, and so we have our own stance on say, the NSA, or Obama's re-election, or congress shutting down, or any other human event that takes place. It makes sense that we would use this community to talk about that outlook amongst other fellow craftsmen who have the same kinda lens.
Some, not all, care what's happening around us. We're not this fantastical creative hacker secluded from society. The idea that we are, coupled with the idea that we shouldn't be concerned with threats, is insulting. It puts us in a box and gives rise to the "us vs them" attitude. Whether you idolize us or demonize us, you miss the underlying fact that we're humans too.
>So what's the reason for attributing so much power to these external "forces", none of which have ANY intrinsic power beyond what you give them?
Now for the grand-daddy of stupidity. Apparently the NSA and any other big world power is just an external force that doesn't have any intrinsic power besides what we give it! I forgot!
You're not stupid enough to believe this, I know this. You're just saying it to give greater power to your already weak argument that hackers are insecure. This is a very intelligent, progressive, and open-minded community. We regularly debate things in a way congress wishes it did. You have the audacity to put us in a box, call us insecure, stamp a cute label "enlightened hacker", and question why we should ever be concerned about politics. Get the hell out of here with that nonsense. I'll say it again: we're humans too. We're allowed to have other interests besides programming (though at times I wish my boss knew that!).
What is sad here is not that those subjects are discussed but the sometimes fearful and shrill tone in which they are discussed. Sadder still is that there are a lot of comments on HN that seem just as afraid of hacks like Soylent or Bitcoin or AirBnb.
So what's the reason for attributing so much power to these external "forces", none of which have ANY intrinsic power beyond what you give them?
You seem to be playing fast and loose with the distinction between "you" meaning me as an individual and "you" meaning a society that includes myself.
I, personally, don't necessarily give the NSA any power. Unless you're saying that apathy in a democracy does give them power. But therein lies the switch from individual to collective "you".
If I alone dedicated my entire life to removing their intrinsic power, I still wouldn't be able to remove it's power. Snowden threw away his life to try and remove the power behind the NSA. He was uniquely positioned to challenge their power and only managed to get egg on their face and start public discourse.
Societal things like this necessitate discussion, because that's the only way the power drawn from a large number of people can work to counter that power acting towards it's natural incentives.
Or are you going to argue that because I am able to to completely withdraw from society and live in a cabin in the woods I'm opting into the power exerted by governments and corporations? By that logic my continued decisions not to commit suicide are approval of whatever government rule happens to be the status quo. Rhetorical power of death aside, I do find that to be both quite true and utterly irrelevant to a conversation on the type of world I'd like to live in beyond the barest of bare minimums.