Slashdot Mirror


Inventor of Proxy Firewall Blames Hackers

An anonymous reader writes "SecurityFocus published an interview with Marcus Ranum, the inventor of the proxy firewall. It's an interesting reading, and the end is even better: Truly, the only people who deserve a complete helping of blame are the hackers. Let's not forget that they're the ones doing this to us. They're the ones who are annoying an entire planet. They're the ones who are costing us billions of dollars a year to secure our systems against them. They're the ones who place their desire for fun ahead of everyone on earth's desire for peace and the right to privacy."

101 of 742 comments (clear)

  1. its the hackers alright! by Prophetic_Truth · · Score: 3, Funny

    with their hair and thier clothes, and thier music! I can't stand 'em!

    --
    time is a perception of a being's consciousness
    time is your 6th sense, the wierd ones are 7+
    1. Re:its the hackers alright! by BlogPope · · Score: 3, Interesting
      Problem is, just like the phreakers, while the hackers showed the way, organized crime (and yeah, I think I'll lump CoolWebSearch in that group) has pushed them out. The number of attacks related to real hackers is minimal these days, though there's enough idiots writing the tools thats the equivalent to giving uzis to schoolkids.

      Suddenly we're all little piggiesliving in the big bad wolf's neighborhood and we're living in software houses built of twigs.

      --
      My other car is a Popemobile
    2. Re:its the hackers alright! by pixelpusher220 · · Score: 5, Insightful

      Actually I'd say the Hackers probably did us a favor in the long run. How bad would it be if everything were nice and rosy and then organized crime started playing hard ball?

      At least we've had time to learn and understand and actually build tools to help in the defense of our systems. Now if companies ignored the petty hacker attacks that's their own fault, but at least it started with relatively innocuous stuff rather than more heavy duty attacks...


      --
      People in cars cause accidents....accidents in cars cause people :-D
    3. Re:its the hackers alright! by Thangodin · · Score: 4, Insightful

      Yeah, but there's black hat and white hat. There are people who would hack into a system and leave a note saying "I was here, this is how I got in...fix this!" Then there were the ones who would hack in, delete everything or otherwise fuck it up, and then erase all signs that they were ever there. There are virus writers who write proof of concept worms and viruses to alert people to flaws in their systems, and then there are the script kiddies who have nothing better to do with their time but tweak existing viruses to beat the anti-virus signatures.

      I have no use for destructive hackers. It's much easier to find a hole in a system then it is to anticipate all possible angles of attack. If some ass-hat script kiddy wants to show what a clever boy he is, he should do something useful and become a security consultant. On the other hand, that would take brains and work...

    4. Re:its the hackers alright! by Dogtanian · · Score: 4, Funny

      Yeah, but there's black hat and white hat.

      What about the guy who broke into my computer, erased my copy of Windows and installed Fedora Core in its place?

      I suspect he was a Red Hat hacker, personally...

      --
      "Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
    5. Re:its the hackers alright! by InfiniteWisdom · · Score: 2, Informative

      You have no idea how evolution works, do you?

      Breaking legs doesn't alter ones DNA. Kids would be born with stronger bones only if bdit went around breaking the legs of a large fraction of the population, and the stronger legs among the population survived the breaking attempts. Also, you'd need people without broken legs to have more kids than people with broken legs.

    6. Re:its the hackers alright! by PHP+Addict · · Score: 2, Interesting

      You've got it 100% right. My family is all about outdoor activities: camping, hiking, fishing, and hunting. Every summer, my entire family would take a week-long camping trip, and my dad would bring a few guns and go hunting at least twice. They were always locked up, never loaded, and stored separately from the ammunition.

      We'd sit around the campfire at night and my dad would clean his guns from that day's use. As a child is naturally curious, I wanted to know what that thing dad had was. He didn't pull it away and say, "No! Bad!" He showed me what it was, described how it worked, and let me hold it (obviously unloaded and extremely supervised).

      For as long as I can remember, gun safety has been ground into me, so I have no problem with anyone owning a gun, as long as they're responsible with it (locked up, unloaded, and stored separately from the ammunition). It's the ass-hat that leaves a loaded pistol in his unlocked nightstand drawer that everyone needs to worry about.

      Guns don't decide how they're used. Guns don't choose to be stored in a drawer where a child can get to them. Dumbass people do. "Guns! Bad!" is the cry of the ignorant.

      Moral of the story: Guns don't kill people, idiots and assholes do.

      --
      Laziness, check. Impatience, check. Hubris, double check!
    7. Re:its the hackers alright! by Anonymous Coward · · Score: 2, Informative

      I'm not a big fan of guns myself, but statistically speaking, a kid is more likely to die in a swimming pool than they are from a gun-related accident.

      http://timlambert.org/2001/07/levittpoolsvsguns/

    8. Re:its the hackers alright! by Cromac · · Score: 2, Informative
      Have you looked any statistics lately? The USA is leading by a HUGE number in terms of deaths due to firearms. Other countries don't generally allow guns for the general public and, gee, lots less people are DYING there.

      Take a look at Switzerland, higher gun ownership than the US and less violence. The US is a more violent country in general than many other industrial nations, guns have nothing to do with it.

      I really hope you don't have kids at home since guns are wildly more likely cause harm accidentally than be used for self-defense.

      That's pure 100% Handgun Control Inc bullshit. Guns are used far more often in self defense than in accidental deaths. There are as many as 2.5 MILLION defensive uses of firearms every year in the US and less than 15,000 accidental deaths total, far less if you only count children, even counting "children" like HCI does up to age 24.

    9. Re:its the hackers alright! by Oriumpor · · Score: 2, Insightful

      As has been said by many much wiser than myself, all computer problems are fundamentally a people problem. Exploitable applications are the fault of developers, exploited applications are the fault of intruders.

      Why is the blame always pushed in one direction OR the other and not both?

    10. Re:its the hackers alright! by budgenator · · Score: 3, Insightful

      The biggest thing that needs to be done is to turn-off that which isn't used; allow what's needed, deny all do it in services, do it in the firewall rules at the host and routers.

      We need to get it through people's heads that everything that's running is a security risk, and if the benefits don't outweigh the risks don't use it, or install it and block it's ports.

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    11. Re:its the hackers alright! by 1lus10n · · Score: 2, Interesting

      You also have the responsibility to put forth an effort to protect your privacy.

      Have sex with a woman in a parked car on some random street. Anyone can stop and watch and they are doing nothing wrong.

      --
      "Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe." --Albert Einstein
    12. Re:its the hackers alright! by hempalicious · · Score: 2, Interesting

      The obvious exception is people who are *paid* to attempt a break-in because the property owner wants to know just how well they're secured things.

    13. Re:its the hackers alright! by bogjobber · · Score: 2, Insightful

      No, it's more like someone opening your door and watching you have sex with your wife. Just because you left your door unlocked and allowed them easy access to your house does not mean that they are doing nothing wrong by opening up the door and peeking inside. While I agree it is stupid for someone to leave their computer unsecured, security holes do exist and it is does not absolve a hacker of any wrongdoing just because it was easy to get in.

  2. Someone should patent blame deflection by _am99_ · · Score: 5, Insightful

    Truly, the only people who deserve a complete helping of blame are the
    hackers. Let's not forget that they're the ones doing this to
    us. They're the ones who are annoying an entire planet. They're the
    ones who are costing us billions of dollars a year to secure our
    systems against them. They're the ones who place their desire for fun
    ahead of everyone on earth's desire for peace and the right to
    privacy."


    Ok, but swap a hacker's desire for fun with a software companies
    desire to make money without properly taking responsiblity for
    securing their product and one could also write:

    Truly, the only people who deserve a complete helping of blame are the
    software companies. Let's not forget that they're the ones
    doing this to us. They're the ones who are annoying an entire
    planet. They're the ones who are costing us billions of dollars a year
    to secure our systems against them. They're the ones who place their
    desire for profit ahead of everyone on earth's desire for peace
    and the right to privacy."


    It is like a credit card company saying that if someone breaks into
    their systems and steals my credit card number, that is my
    responsibility - or maybe it is the hackers fault. Well sure, it is
    my fault for using a stupid bank, and the hackers fault for committing
    the crime - BUT SURELY the bank has to take some fault for making this
    whole possible - right?

    1. Re:Someone should patent blame deflection by nomadic · · Score: 2, Insightful

      Ok, but swap a hacker's desire for fun with a software companies desire to make money without properly taking responsiblity for securing their product

      A lot of hackers have "fun" causing other people pain. It's weird, I've never quite understood how that actually works, but I've met plenty of people who just experience joy at doing damage.

      Well sure, it is my fault for using a stupid bank, and the hackers fault for committing the crime - BUT SURELY the bank has to take some fault for making this whole possible - right?

      Yep, but not as much as people here seem to want to put on them. It's a lot easier to destroy than create;even the best systems will have some security flaws, no matter how good the creator is.

    2. Re:Someone should patent blame deflection by erroneus · · Score: 5, Insightful

      At first I was going to mod this +interesting or something like that but I think I'd rather just add to it.

      We're born into this imperfect world and should expect nothing less than we've already been born into. The lock was invented before anyone presently reading this was born. This is a clear indication of the state of things and in my opinion, the nature of humans... or animals for that matter. (Raccoons, monkeys and other creatures are famous for stealing things too!)

      The individuals responsible are individually responsible for their own actions and should be held accountable. But the reality that should be mentioned and understood is that we're in a world where people do shit to each other.

      In that climate, we look to software makers to make reliable products. We want them to be able to withstand the efforts of the rest of the world doing what it is that's natural for them to do. It is not an impossible task. It has been shown through the virtue of patches that it can be done and since it can be patched it could also have been done right the first time had they only taken the time and effort to write it correctly to begin with.

    3. Re:Someone should patent blame deflection by jedidiah · · Score: 4, Insightful

      No, it's the builders fault if the construction of the door was faulty to begin with. If a burglar can walk up to your front door, pound on the hinge side slightly and cause the entire door to fall in THEN THE BUILDER IS INFACT RESPONSIBLE.

      Cities have legions of building inspectors for just this purpose who's job it is to actually ensure that the tradesmen actually built their part of the house up to the standards set in the local building codes.

      They actually have standards in the construction industry.

      --
      A Pirate and a Puritan look the same on a balance sheet.
    4. Re:Someone should patent blame deflection by Dancin_Santa · · Score: 2, Interesting

      Closer to home (inasmuch as /. is "home"), I really hate people who come onto this site or any site, for that matter, for the express purpose of disrupting discussion. We call them trolls, but in the same way we try to differentiate between "hackers" and "crackers", maybe it would be good to try to differentiate between "trolls" and these despicable "troll jihadists".

      A logged in user may occasionally troll (who knows what kind of warped mind finds this "fun"?), but someone who logs in to drop bombs in a discussion with the express aim of causing confusion and conflagration is a "discussion terrorist".

      Such terrorism can only be combatted, but never squelched.

    5. Re:Someone should patent blame deflection by cavemanf16 · · Score: 2, Insightful
      In that climate, we look to software makers to make reliable products. We want them to be able to withstand the efforts of the rest of the world doing what it is that's natural for them to do. It is not an impossible task. It has been shown through the virtue of patches that it can be done and since it can be patched it could also have been done right the first time had they only taken the time and effort to write it correctly to begin with.

      Your original argument completely invalidates this insertion that it's "not an impossible task." Yes it is! Software developers are human too!!!

    6. Re:Someone should patent blame deflection by Skye16 · · Score: 4, Insightful

      If I push open your front door because the builder didn't even bother to put a door knob on it, much less a lock, then is the fault mine? Absolutely. Does the builder have responsibility in this too? Absolutely again.

      In a way, hackers are kind of pointing out that the emperor has no clothes.

      With that said, I, personally, find nothing wrong with a hacker trying to figure out an application / OS's vulnerabilities and sharing them with the developers. And if they do nothing about it, share it with the rest of the world to force them to. People deserve doors to have doorknobs and doors that have locks. People also deserve software that doesn't leave their anal cavity wide open for nefarious probing.

      However, the hackers who run amok trying to fuck things up as much as possible for the sake of fucking it up (more script kiddies than hackers, but to the average person, they're the same); they still need to be blamed. They're still the primary culprits. But software companies can be extremely negligent at times, and thus, they bear some responsibility too. Responsibility isn't finite; just because we have two parties doesn't mean the major culprit receives any less of the blame.

      And I'm rambling, again. I'm sorry.

    7. Re:Someone should patent blame deflection by FictionPimp · · Score: 4, Interesting

      Yea, but my house was built without doors, just big gaping holes. So how dare you come in and steal my stuff. I can't belive people would be so dishonest.

      At least a door is an effort at security. Most software makers make no effort. I can prove this by the large list of programs that require me to make hours of phone calls to find all the stupid places they put stuff so my users do not have to run in admin mode in windows.

    8. Re:Someone should patent blame deflection by pootypeople · · Score: 2, Insightful

      All the discussion of trolls pisses me off. Slashdot works well because it's anti-censorship- you have to have that to have a real discussion community. With that in mind, if you read comments at +2, you'll pretty much get rid of all the trolls and flame wars. Slashdot is what YOU make it. If you don't like trolls, you browse at +2.
      Just my 2 cents.

    9. Re:Someone should patent blame deflection by tyler_larson · · Score: 4, Insightful
      Ok, but swap a hacker's desire for fun with a software companies desire to make money without properly taking responsiblity for securing their product and one could also write:

      Perhaps you should RTFA--no, really. The article was very reasonable and well-written. The synopsis was not. Here's the context from which the quote you refer to came--

      If we consider the Internet as a big local network, we will see that some of our neighbours keep getting exploited by spyware, virus, and so on. Who should we blame? OS producers? Or our neighbours that chose that particular software and then run it without an appropriate secure setup?

      There's enough blame for everyone.

      Blame the users who don't secure their systems and applications.

      Blame the vendors who write and distribute insecure shovel-ware.

      Blame the sleazebags who make their living infecting innocent people with spyware, or sending spam.

      Blame Microsoft for producing an operating system that is bloated and has an ineffective permissions model and poor default configurations.

      Blame the IT managers who overrule their security practitioners' advice and put their systems at risk in the interest of convenience. Etc.

      Truly, the only people who deserve a complete helping of blame are the hackers. Let's not forget that they're the ones doing this to us. They're the ones who are annoying an entire planet. They're the ones who are costing us billions of dollars a year to secure our systems against them. They're the ones who place their desire for fun ahead of everyone on earth's desire for peace and [the] right to privacy.

      --
      "With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea...."
      RFC 1925
    10. Re:Someone should patent blame deflection by Enigma_Man · · Score: 2, Insightful

      That's not quite a good analogy. The hackers are "pointing out" that things are insecure the same way that thieves "pointed out" that automotive side-window glass is easily breakable, giving access to the entire vehicle, even though I locked the doors. Everybody is responsible, you can't point a finger anywhere. The software writers are responsible for writing shoddy code, the hackers are responsible for taking advantage of the shoddy code, and the users are responsible for both buying the shoddy software and letting the hackers at it. Why do people feel the need to pin the blame 100% on someone, it's dumb.

      -Jesse

      --
      Nothing says "unprofessional job" like wrinkles in your duct tape.
    11. Re:Someone should patent blame deflection by rainman_bc · · Score: 2, Interesting

      Uhm, let's take the tinfoil hat off.

      All corporations exist to make money for shareholders.

      Secondly, Banks exist to link people with money to people who wish to borrow money. You put your money in the bank. The bank pays you interest (pretty low interest today, but still). Then the bank lends it out at a higher rate of interest. The difference is the bank's profits. Its role is to act as an intermediary. Lending money yourself is risky. You put your money in the bank and the bank assumes all costs, and all risk. Your money is guaranteed by the bank, and (in Canada) it's insured by CDIC for up to $75k

      I think the OP meant that no one gets YOUR money without your permission. You are always entitled to the money in your demand deposit account.

      Let's face it though, where will you withdraw it to? If you make a $1 million cash withdrawal, the bank will look at you funny, and there isn't much reason for it. Try depositing it again and see the flack you'll get. You have to prove the origin. Not cool...

      Nay, most of the times you transfer the money to another bank - if you pay by check, it's still just a transfer to another bank. It's just an accounting entry, nothing more. The cash never movies, and the money probably doesn't really either.

      --
      09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
    12. Re:Someone should patent blame deflection by Itchy+Rich · · Score: 2, Insightful

      The significant difference between construction and software is that laypeople have some level of understanding of the physical world.

      If your builder leaves a hole in the wall, you can see it and get him to do the job properly, or take him to court. There's no thief as yet, so the blame can only land on the builder.

      If your software vendor leaves a big hole in your software, most people have no idea it's there until they get screwed through it, at which point there's a criminal for the software company to blame.

      It's simple profit over customer safety. They do what they think they can get away with without damaging their reputation too much.

    13. Re:Someone should patent blame deflection by rainman_bc · · Score: 2, Informative

      This alone doesn't necessarily create profit. It increases the money supply. The bank profits off the interest earned from these loans.

      Thing is the bank takes on risk too. All it takes is for another depression for the banks to lose everything... Look, today we're at a MASSIVE credit bubble... Huge, unlike nothing we've ever seen before in our lifetimes. Personal debt is the highest per-capita it's ever been. A spike in interest rates is all it takes to create defaults on loans. Those defaults are a direct hit to the bank's bottom line.

      --
      09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
    14. Re:Someone should patent blame deflection by Jafafa+Hots · · Score: 2, Insightful

      There has been a lot of discussion in the last few days about the rape victim in Aruba and what she should or shouldn't have done to "prevent" her rape.

      Just like those idiots, YOU are the one doing the blame deflection. If you are raped, the only one who is to blame is the rapist.
      If you are mugged the only one who is to blame is the mugger.
      If your house is broken into by a burglar, the burglar is 100% at fault.

      If your system is hacked into, the only one to blame is the hacker.

      Yes, you can take reasonable precautions in all of these cases, but the bottom line is that a person who decides to commit a crime is wholly responsible for their behavior. You can never fully protect yourself against somone deciding to be an asshole and attack you, and to suggest that it is anyone's fault but theirs is simply giving them an excuse.

      --
      This space available.
    15. Re:Someone should patent blame deflection by Anonymous+Custard · · Score: 4, Insightful

      Blaming "the hackers" for finding and exploiting insecurities in your software is like blaming barking dogs for your insomnia. The dog is just being a dog. Hackers or dogs may or may not be providing you with a service, by alerting you to real trouble coming your way.

      I appreciate my dog who barks when strangers approach the house - hey, it might be a problem, and early warning is useful.

      Similarly, I appreciate hackers who find security holes and report them to the companies responsible.

      I do NOT appreciate dogs who bite my arm and give me rabies just because I wasn't wearing a kevlar protection suit.

      I do NOT appreciate hackers who install spyware on my machine just because I was a day late in applying the latest security patch.

      Just because's a guy isn't wearing a cup, doesn't mean you should walk up and kick him in the groin.

    16. Re:Someone should patent blame deflection by Excelsior · · Score: 2, Insightful

      At least a door is an effort at security. Most software makers make no effort.

      Most software makers? This is modded interesting? Interesting! Why not mod it insightful while you are at it? Holy crap.

      That is a terrible generalization with absolutely no basis in fact, and no evidence behind such a bold statement. If you really studied this, I seriously doubt you'd find that 51%+ of software makers make no effort to develop secure software. But like you, I have no proof. At least I'm up front about it.

      Few houses are impenetrable. You can build a nice lock, and I can come through your window. You can put bars on your windows, and I can break down your door. You can get steel doors, and I can use a chainsaw on your wall. You can build build steel walls, and I can bring a blowtorch.

      No security is 100%. Kevin Mitnick often talks about the biggest source of security holes being the social holes. He would call someone at a company, lie about his identity, and often be given a password over the phone. There will always be ways in. At some point, society has to say "We aren't going to allow this crap." At some point, the blame must be on the people perpetrating the crime, the punishment must be sufficiently harsh to deter the occurence, and the likelihood of being caught must be high.

  3. Blame Canada by Anonymous Coward · · Score: 3, Funny

    Blame Canada

    1. Re:Blame Canada by hullabalucination · · Score: 3, Funny

      I hold the Northwest Territories personally responsible for this terrible situation. Also, I believe that we ought to disconnect many third-world countries from the Internet. Places like Zimbabwe, Cambodia, Mauritania and New Jersey don't need to have Internet access.

  4. let's not forget by g0bshiTe · · Score: 4, Funny

    bieng the inventor of said firewall they have most asuredly paid your bills for sometime.

    --
    I am Bennett Haselton! I am Bennett Haselton!
  5. I agree... by cheezemonkhai · · Score: 3, Interesting

    How dare a large american mega-corperation that wants to keep our private data on their systems and make money off selling it have to spend any money protecting it.

    Yes hackers are a pain in the arse, so are spam merchants. Thats life, live with it.

    In other news the inventor of the Yale lock blames thieves for the invention of the lock, which irritates us daily.

    1. Re:I agree... by Southpaw018 · · Score: 5, Insightful

      If I'm reading that right, you have it backwards - like a lot of people, I think. If, let's say, someone left their front door open and you saw some nice lookin shiny thing while walking down the street, and you went in and took it, then got caught...what would the police say? "Oh, it's not your fault. After all, they left their door open."

      No, while they were idiots for leaving the door open, you were the only one who broke the law.

      The same thing applies here. Because someone or something leaves doors open doesn't mean you can or should enter them. No one has to live with spam merchants - that's why we're taking measures to combat spam on many levels (from the national do not call registry to spam filters on the email system at the office). No one has to live with hackers, either. That's life, but not how you put it; this time, I applied your logic to both sides.

      Can you live with that?

      --
      ACs are modded -6. I don't read you, I don't mod you, I don't see you. Don't like it? Don't be a coward.
    2. Re:I agree... by Xugumad · · Score: 2, Insightful

      I agree entirely. In particular, I think there's a lot of people who think something is okay, unless it's specifically made hard.

      People NEED to take more responsibility for their actions. If I left my systems with the default passwords, didn't patch them, and had no firewall, it still would not by fault if someone broke in. It would be irresponsible of me, but that's is a different matter.

      There needs to be more of a realisation that responsibility lies with the person who CHOOSES to break the law.

    3. Re:I agree... by arose · · Score: 2, Insightful

      What if you would pay someone to lock your door and he forgot?

      --
      Analogies don't equal equalities, they are merely somewhat analogous.
    4. Re:I agree... by swv3752 · · Score: 2, Informative

      Actually it would be your responsibility. In the the there is this thing called inticement. If you leave your keys in plain sight in your car, and someone steals your car; you will be held liable. If a cop sees that you left you key in plain sight in your car you can get a ticket.

      --
      Just a Tuna in the Sea of Life
  6. and interestingly enough... by Mz6 · · Score: 4, Insightful
    they're also the ones that keep you and I employed.

    "They're the ones who are annoying an entire planet. They're the ones who are costing us billions of dollars a year to secure our systems against them."

    --
    Hmmm.
    1. Re:and interestingly enough... by Anonymous Coward · · Score: 5, Insightful

      But if they weren't keeping you and I employed we could both be employed doing more productive things.

      It's like saying the vandal who goes around smashing windows is a good guy because he keeps the window repairman employed.

      Old and crusty falacy...

    2. Re:and interestingly enough... by WhatAmIDoingHere · · Score: 4, Insightful

      No, it's not quite like that. It would be more like: If the window repairman developed newer windows that were harder to break. If the vandal never broke the original windows, they would still be as easy to break as they originally were. But now, thanks to the Vandal, they're improved and rock-resistant.

      The "window" tech. isn't standing still as the Vandal runs around breaking them.

      --
      Not a Twitter sockpuppet... but I wish I was.
    3. Re:and interestingly enough... by Zwets · · Score: 4, Funny

      This new kind of window would provide eXtreme Protection. I guess would be called 'Window XP'.

      --
      One of the lessons of history is that nothing is often a good thing to do and always a clever thing to say. - Will Duran
  7. He is 100% right by Dancin_Santa · · Score: 3, Insightful

    He is also 100% wrong. No one wants to live in a world where we have to lock our doors. Everyone wants to live freely without worry of being taken advantage of. It is absolutely the fault of the "evildoers" that we must put locks on our windows and worry about the footsteps following us down the dark, reeking alleyway.

    But it is also our own responsibility to be sure that we can prevent people from taking advantage of us. This means that we must have those locks and firewalls. To neglect this is to essentially invite attack and intrusion. And if it isn't at the hands of one group, it will be at the hands of another.

    We don't live in a perfect world, so it's important that we have adequate locks.

    1. Re:He is 100% right by clontzman · · Score: 4, Insightful

      I don't think he's arguing that. He's just saying that the people who are making this trouble are the problem, not the people who are making the software that tries to protect people.

      Just because you park your car in a mall and only protect it with a piece of glass that's easily broken and an alarm that everyone will ignore doesn't make it your fault if someone breaks in and steals your car. It seems like a lot of folks, though, would blame GM for not making steel shields for your windows.

      The virus/worm writers are the problem; how can anyone possibly defend them?

    2. Re:He is 100% right by Daniel_Staal · · Score: 5, Insightful

      He agrees with you. That quote was the last paragraph of the last answer in the interview. Here's the full question/answer:

      If we consider the Internet as a big local network, we will see that some of our neighbours keep getting exploited by spyware, virus, and so on. Who should we blame? OS producers? Or our neighbours that chose that particular software and then run it without an appropriate secure setup?

      There's enough blame for everyone.

      Blame the users who don't secure their systems and applications.

      Blame the vendors who write and distribute insecure shovel-ware.

      Blame the sleazebags who make their living infecting innocent people with spyware, or sending spam.

      Blame Microsoft for producing an operating system that is bloated and has an ineffective permissions model and poor default configurations.

      Blame the IT managers who overrule their security practitioners' advice and put their systems at risk in the interest of convenience. Etc.

      Truly, the only people who deserve a complete helping of blame are the hackers. Let's not forget that they're the ones doing this to us. They're the ones who are annoying an entire planet. They're the ones who are costing us billions of dollars a year to secure our systems against them. They're the ones who place their desire for fun ahead of everyone on earth's desire for peace and [the] right to privacy.

      His point: there is pleny of blame to go around, if you want to spread the blame. The hackers who break in are the reason the rest of the blame matters, but the rest is still there.

      Just in case someone thought you disagreed with him. And because now everyone has read the full context of the quote we are discussing, which will be a rarity on /.

      --
      'Sensible' is a curse word.
  8. Good God... by aendeuryu · · Score: 5, Insightful

    Rome builds shitty wall, Emperor blames failure on existence of barbarian hordes.

    It'd sound fucking ludicrous to read that in a history book, it's no less ludicrous to read that in a modern context.

    Dude, grow a pair.

    1. Re:Good God... by Foolomon · · Score: 2, Insightful

      You are correct, but he is as well. It's the malicious intents of others that cause the headache in the first place. Granted, you could choose to ignore the headache, take some placebo (i.e. use a crappy OS with little protection) or take something effective (Oxycontin LOLOLOLOL), but the fact still remains that the headache is the cause of the problem. Just because you are ineffectively dealing with it doesn't mean the headache doesn't exist.

    2. Re:Good God... by ajs · · Score: 3, Insightful
      Slashdot hordes react without reading TFA, film at 11....

      He's not deflecting blame, he's pointing out that blaming your neighbor or your vendor is fine, but the lion's share of the blame for intrusions belong's square in the lap of the intruder.

      To quote TFA:
      [...]some of our neighbours keep getting exploited by spyware, virus, and so on. Who should we blame? OS producers? Or our neighbours that [...] run it without an appropriate secure setup?

      There's enough blame for everyone.

      Blame the users who don't secure their systems and applications.

      Blame the vendors who write and distribute insecure shovel-ware.

      Blame the sleazebags who make their living infecting innocent people with spyware, or sending spam.

      Blame Microsoft for producing an operating system that is bloated and has an ineffective permissions model and poor default configurations.

      Blame the IT managers who overrule their security practitioners' advice and put their systems at risk in the interest of convenience. Etc.

      Truly, the only people who deserve a complete helping of blame are the hackers. Let's not forget that they're the ones doing this to us.
      However, I'd like to point out that I disagree with something fairly fundamental in what he's saying. The people who are "annoying us" make us build better security, and I'm much rather have a numbskull try to poke at my security for bragging rights than have nothing for years and then a series of well-organized, well-hidden attacks that gain long-term access to sensitve data. I don't enjoy having to secure networks against boneheads, but I don't blame them for having to build good security, that should have been done from the day the first machine sent out a set of voltage modulations that could loosely be called "IP".
  9. "Desire for fun"? Oh please.. by Entrope · · Score: 5, Informative

    Perhaps five or ten years ago it would have been plausible to say that computer criminals were largely breaking into others' machines for fun -- but even then, as Clifford Stoll discovered, there were exceptions. Then it turned into more of an organized enterprise. People controlling most of the infected machines on the Internet are NOT doing it out of curiosity or fun: They are doing it for power, and exploiting that for criminal enterprise.

    In the past years, we have seen profit-seeking criminals discover how useful insecure systems are to them. The major disruptions now are not caused by simple thrill-seekers.

  10. He means crackers right? by dtfinch · · Score: 2, Informative

    programmer => hacker
    criminal hacker => cracker
    criminal non-hacker => script kiddie

    1. Re:He means crackers right? by rikkards · · Score: 3, Insightful

      According to Society:
      criminal hacker == hacker therefore
      criminal hacker == hacker

    2. Re:He means crackers right? by WormholeFiend · · Score: 2, Funny

      I thought "cracker" was a racial slur for a white person...

  11. Didn't I just read the Onion? by wubboy · · Score: 4, Funny

    "Truly, the only people who deserve a complete helping of blame are the hackers. Let's not forget that they're the ones doing this to us. They're the ones who are annoying an entire planet. They're the ones who are costing us billions of dollars a year to secure our systems against them. They're the ones who place their desire for fun ahead of everyone on earth's desire for peace and the right to privacy."

    Is it just me or does this sound like a Onion story?

    --
    Sit... Speak.... Shake.... Good Dog!
  12. There's an old Saying.... by hcob$ · · Score: 2, Insightful

    "Locks only keep honest people honest." Such is the same with all security measures. Anything that is created by man can be defeated by man.

    --
    Cliff Claven
    K.E.G. Party Chairman
    Founding Leader of: Koncerned for Egalitarin Governance
  13. Could not be more wrong by joshv · · Score: 4, Insightful

    Virus writers, crackers and their ilk are the predators and pathogens of the Internet ecosystem. They kill off the weak and make the rest stronger.

    What would you prefer? An Internet full of weak hosts, with a wealth of unexploited security holes and weakly configured security systems, where your security is left up to the good will of others (everybody just play nice now)? Or one where leary vendors and service providers stand in constant vigilance over security issues, because they have to. The wolves are circling the herd.

    What would happen if all the 'hackers' just went away? Everyone would get complacent. Security holes would proliferate, until the temptation just became too large and someone takes it all down in one fell swoop.

    1. Re:Could not be more wrong by Forbman · · Score: 3, Insightful

      Jihadists, whacko environmentalists, right-wing extremists and their ilk are the predators and pathogens of the modern global ecosystem.

      No, these are the ticks, the mosquitoes, the starlings. They annoy the shit out of the system, occaisionally cause or induce actual harm, but are for the most part really just benign, in the grand scheme of things.

      The real wolves are the RIAA/MPAA, corporate agriculture, "Free Trade" advocates, Brazilian soy bean farmers, squeeky wheel Revelationists, neo-Talibanists in the US, etc., a culture that seems to know the price of everything and the value of nothing, and Congresses (US and EU) that values their corporate ties more or less above all else, and has forgotten that its job is not to get itself reelected, but to serve the people of the US and country, not serve the companies that serve the people.

  14. boo-hoo-hoo by lennart78 · · Score: 2, Insightful

    I don't know where to begin on this one.
    If there weren't any burglars around, I wouldn't have to lock the doors of my house.
    If everyone would abide traffic rules, the need for airbags etc. would vanish.

    This guy is not only complete missing any connection with the outside world, he also forgets that there are thousands of people working in the (IT) security industry, making a living. It may sound silly, but we keep our economy going this way. This is why there are so many economists/therapists/lawyers/communication advisors/etc. around.

    I feel like feeding the troll here. Time to knock it off...

  15. Lord of the Walls by Alarash · · Score: 2, Funny
    We only wants our precious proxyses! Trixie, nasty hackeeses! We wont let them behind our precious!

    *gollum, gollum*

  16. "Perfect World" by myrick · · Score: 2, Insightful

    As nice as it is to think that the world would be in perfect harmony without hackers, it is little more than a pipe dream. Throughout history, humanity has been plagued by the selfish nature of its constituents ('human nature' just does not jive with the 'common good'), and that is a fact I would argue is on par with Death and Taxes. We as a society have to be realistic here, and we as the geek community, the developers of software, have to take the responsibility to make high quality, secure software, because you just can't trust the public. Wasting our efforts by complaining about hackers is foolhardy.

    --
    I'd rather be cycling.
  17. Re:Here we go again by Axfish · · Score: 3, Insightful

    I agree with you. Sadly though (in this particular instance), languages change, and word usages evolve. (Anyone remember when you could actually use the word "gay" to mean "happy"?) The hoi polloi have taken the word away from the Hacker (in the traditional sense) community, and made it into something else. We just have to move on, I guess. Given that you're already no longer allowed to correct people's spelling, grammar, syntax, be it on the Internet or even at work, might as well let semantics go down the drain with the rest of it all... /vocabulary nazi off

  18. Re:Here we go by Xcott+Craver · · Score: 2, Insightful

    Well, I guess they did prepare us for more serious infrastructure threats, e.g. information warfare, organized crime etc.

    I'd rather have an army of citizen-lamers spend decades breaking into our computers for fun, prompting us to build up an immune system.

    Xcott

  19. Focus on the Process by halbert · · Score: 2, Insightful
    Marcus had the right idea, but then he went for the media spin about hackers. His best quote was actually :

    There's enough blame for everyone.

    Blame the users who don't secure their systems and applications.

    Blame the vendors who write and distribute insecure shovel-ware.

    Blame the sleazebags who make their living infecting innocent people with spyware, or sending spam.

    Blame Microsoft for producing an operating system that is bloated and has an ineffective permissions model and poor default configurations.

    Blame the IT managers who overrule their security practitioners' advice and put their systems at risk in the interest of convenience. Etc.
    Sure hackers, as he and the media uses the term, are to blame, but what about the others he mentions? I bet half of the "hackers" wouldn't even have started if it wasn't so darn easy in the first place, and that is where the rest of the blame starts. I am not trying to defend "hackers", or start a holy war about whether finding flaws are in software is good or bad.

    I see every day the results of poor practices, shoddy software, and just plain old stupidity when it comes to security. Fix those first, then worry about the hackers.

    --
    LOAD "SIG"

    RUN "SIG"

  20. Hackers = Canaries in the Coal Mine by thelizman · · Score: 5, Insightful

    Obviously this guy has never heard of espionage. *Most* (not all) hackers/crackers get in, poke around, and leave. I've known a few that actually fix shit on the way out, and leave friendly notes (though I think more highly of the do no harm crowd).

    The *REAL* danger are corporate spies who not only want your secrets, but also plant spyware, or destroy infrastructure to hamper a competitor. There is also the growing instances of state-sponsored computer cracking whereby poorer nations (particularly the axis-of-evil states) seek to leverage the power of attacking information infrastructures instead of the physical infrastructure. Remember, the US didn't take down the Soviet Union by dropping bombs and shooting bullets. We bankrupted their ass in a nice game of 'keeping up with the neighbors'.

    1. Re:Hackers = Canaries in the Coal Mine by demachina · · Score: 2, Insightful

      "Remember, the US didn't take down the Soviet Union by dropping bombs and shooting bullets. We bankrupted their ass in a nice game of 'keeping up with the neighbors'."

      Your forgetting that a really significant contributor to the downfall of the Soviet Union was their "Vietnam", the war in Afghanistan. The U.S. did supply the bullets and in particular the Stinger missiles that were used by proxies to kill their draftee soldiers and created a couple generations worth of veterans who were completely scarred in their youth and worked to bring down the government that did it to them, you know tramautized them for life and turned many in to indiscriminate killers. There is, I think, a similar generation being bred in Chechnya today. Its certainly possible a similar American generation is being bred in Iraq though it not as extreme a quagmire as Afghanistan was for Russia.
      If you feed large numbers of young people in to a meat grinder for no particularly good reason you run the risk they will eventually be motivated to topple the people that ruined their lives while they played power politics in Washington and Moscow and were indifferent to all the people they were killing.

      Oh and most American's forget one of those proxies we armed, supported and help train was Osama Bin Laden and what would eventually become Al Qaeda.

      More on topic I really doubt state sponsored crackers are really much of today's problem. I'm pretty sure its more a delightful mix of organized crime, script kiddies, virus writers doing it so show off their skillz, and a whole bunch of people desperate to make money, especially in places where their economies are a smoldering hole in the ground like parts of Russia, Eastern Europe and Africa. If you can steal someones credit card or bank account information and make thousands of dollars in an instant, with little chance of being caught, versus working all day everyday for cents per hour, assuming you can even find a job, and barely survive which choice would you make?

      As long as you have people with lots of money and who throw around ridiculously insecure keys to get at that money on the Internet you are going to have people lining up to try to steal it. That is the root of the problem, and a prime motivator, that is not going away anytime soon.

      As far as identity theft goes the most basic problem is we are still using simple sequences of numbers and letters, to access credit cards and bank accounts, and that info is sitting ALL OVER THE PLACE in the clear. You want to stop the criminals trying to get rich through hacking, you need to move bank accounts and credit cards public key ento some kind of public key encryption so only the person who knows the key can authorize transactions, 3rd parties never store the key, and great pains are taken to protect the key when its entered.

      --
      @de_machina
    2. Re:Hackers = Canaries in the Coal Mine by HiThere · · Score: 2, Insightful

      This is true, but the massive potlatch called the arms race definitely played a part. Unfortunately, it degraded the US as much as it did the USSR, and that plays a large part in explaining why people are as satisfied as they are with the current foreign policy: They've been trained not to think of it for nearly a century.

      OTOH, if you go back that century, you find the same motivations present in Washington, and around the country. You find Hearst using yellow journalism to create a war. You find Teddy Roseveldt with his "big stick" policy. Etc. The outward facing foreign policy is nearly the same, but it's much larger. (OTOH, the internal policy has become much more totalitarian, and much less libertarian. This is probably because of the disappearance of the frontier. Now if somebody doesn't like it where they are, there's no place for them to take off for. Now if somebody doesn't like their current government policy, there's no place to escape from it.)

      Laws aren't any real protection from the corruption which is centralized politics. That the current president is worse than most is only a matter of degree. Pick the one you think most highly of, and if you look closely you will see that he acted to unrighteously steal power from the individual, and give it to the centralized bureaucracy. (OTOH, if you approve of this, then congratulations, and welcome to your Brave New World.)

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    3. Re:Hackers = Canaries in the Coal Mine by demachina · · Score: 2, Insightful

      Bin Laden doesn't like infidels (non Muslims) invading Muslim nations (like Afghanistan, Saudi Arabia and Iraq).

      When Russia invaded Afghanistan they united the muslim world to throw them out. In a mutual case of the enemy of my enemy is my friend the CIA and Bin Laden formed a partnership of convenience. Bin Laden and company were given big bags of money and arms by the CIA, the stuff they needed to beat the Russian's in Afghanistan, especially the stinger missiles which were used to turn the tide again Soviet helicopter gunships. The CIA got to mortally wounded the Soviet Union using a proxy so no Americans died. Proxy wars were fought throughout the cold war and the U.S. and U.S.S.R destroyed country after country, and killed millions of people, in the process. It wasn't really a cold war, the U.S. and U.S.S.R just never shot directly at each other they mostly killed each others partners in the third world.

      Bin Laden didn't really turn on the U.S. until the U.S. put a large army of infidels(Christian and Jew) and liberated women in the heart of the Muslim holy land, Saudi Arabia during the first gulf war and more than a decade following. Putting thousands of culturaly insensitve American teenagers in Saudi Arabi, a VERY conservative culture and home of Islam's holiest sites, for years, was a pretty good way to turn Islamic fundementalist wrathe on the U.S. just as it did when Russia invaded Afghanistan only more so because Saudi Arabia is the home of the holiest places to Muslims. Hindsight being 20/20 the U.S. should have toppled Saddam in the first gulf war and gotten the hell out of Saudia Arabia soon thereafter. Unfortunately the Bush dynasty made a fatal mistake then, just as little George did when he tried to put it right in Iraq only 10 years to late.

      Bush administration rhetoric about them hating our freedom doesn't really hit the mark, they hate our culture and religion, they hate the U.S. trying to force its culture on them much of which runs counter to their religion, they hate at least a century of western powers stealing their resources(oil) and treating them as flunky colonies, and they really hate infidel nations occupying Muslim nations. If you have a long view the anitpathy goes back at least as far as the crusades, and American actions in the middle east today do in a lot of ways resemble a modern crusade, though a proxy, the state of Isreal is being used to occupy Jerusalem, the histroical objective of the crusaders.

      I can see the flaws in both cultures. Fundementalist islam is oppressive but you can see some sense in their harsh prohibitions on alcohol and drugs, they are really destructive of people and cultures when abused. Islam does really derprive women of a lot of rights but then to they don't debase women as much as Western culture can, for example through pornography. Women have been "liberated" in the West for a very brief period and the current trend by the west to compell the same liberation on ancient and conservative cultures overnight, at the point of a gun, predictably incites a violent backlesh among conservative Muslim men.

      --
      @de_machina
  21. Re:Guns don't kill people by pregister · · Score: 2, Insightful
    Excellent horseshit analogy! Well done.

    The idiot who comes in with a lit cigarette is doing nothing wrong and, supposedly, didn't intend anything evil. You're a moron for spreading kerosene all over the house. The cigarette dude isn't to blame. This is just an unfortunate incident caused by owner neglect and stupidity.

    Not so with the hacker. The hacker might know the owner neglected to have decent security on his system but he's still entering the system with malice in mind.

    You can call a home-owner ignorant for not locking the doors of the house but the thief who waltzes in the front door and steals the TV is still a prick and is the one who should be punished.

  22. And the ones that ensure we can feel safer... by kandresen · · Score: 2, Interesting

    Even though I am on the defensive side, trying to keep my servers safe from crackers, script kiddies and so on, I do apreciate these groups for existing.

    If they didn't exist, I would really have felt much more unsafe from espionage and the prying eyes of national and international bodies.

    From my stance, confidential information must be very well protected, and if you put available on the internet, you better have secured it or face the consequences.

    By knowing that crackers exist, you might hessitate to put important and confidential information online, imagine how it would be if everybody only talked about cracking as teoretically possible!!! Spies would never tell what they do, they would be everywhere! Knowing your accounting, your secret papers, everything, for nobody would care to improve the security of their products from something that was only teoretical... All the good guys would have no privacy whereas only the black hats would be able to move around as they liked.

    Face it - the world have all kinds of people - angles, devils, and all sort of people in between. To be hit by someone who expose you is many times better than to be hit by those who simply abuse the information without any words.

  23. In a related story by AtariAmarok · · Score: 2, Funny

    In a related story, the designer of the Great Wall of China blames Mongols.

    --
    Don't blame Durga. I voted for Centauri.
  24. Re:Article is not particularly insightful, really by JWW · · Score: 4, Insightful

    What I really find interesting about this Thievs/Hackers analogy is that you never hear people telling the victims of Theives that they should have had three deadbolts on the door, or saying "shame on you you don't have bars on your windows, of course you'll get broken into."

    It never ceases to amaze me how much blame is laid at the feet of the users. I know running an email attachment executable is really stupid, but alot of other exploits are the equivalent of using a crowbar to break your windows. Thieves get serious jailtime and the police work to find them and they are considered the only ones to blame. In the PC realm, hackers go largely uncaught and unpersued by the athorities, and the user gets told its their fault.

  25. Criminal Responsibile for the Crime by zoomba · · Score: 4, Insightful

    He's correct in his assessment of blame. The people who hack systems, break stuff, spread viruses and bot networks etc are 100% responsible for their actions. They are violating laws left and right with no regard for others.

    Yes, insecure code, a lack of a firewall or antivirus software opens you up to potential attacks, or not having the latest security patches. However that doesn't excuse an actual attack.

    By the reasoning of most of the posters here, unless your home is as secure as fort knox, anyone who breaks in and steals stuff isn't really to blame... I mean, come on, you could have protected your house better. Put in pressure plates and motion sensors. Try a laser grid on the floor. Armed guards, time sealed doors, attack dogs etc. Anything less and, geeze, you're practically inviting them in to take your stuff!

    That's what the Internet is like. You really have to lock up your system like Fort Knox to keep yourself safe. Even then, the burglar could find a spot in the security system that isn't fully covered and get in that way.

    The ONLY secure machine is one that is sitting in the corner, surrounded by a lead box, not connected to any network or power supply. A useless machine really.

    Those who attempt to maliciously exploit vulnerabilities deserve every once of blame you can possibly assign to them. I personally want to kick the guy in the balls that did the Blaster worm... took weeks to get my old workplace cleared of that thing. Just because it is POSSIBLE to exploit something does not mean you SHOULD exploit it. Too many people online use the reasoning that if it's possible it should be allowed.

  26. Re:What the above poster doesn't realise by fishbowl · · Score: 2, Informative

    > Have you never heard the saying "Your freedom ends
    > where my nose begins"?

    "The right to swing my fist ends where the other man's nose begins."
    -- Oliver Wendell Holmes

    The actual quote implies that a spirit of self-restraint is necessary in order for the concept of "rights" to be applicable to all.

    The common misquoting as reflected in your post turns the individual responsibility around.

    --
    -fb Everything not expressly forbidden is now mandatory.
  27. Say hello to evolution by maraist · · Score: 2, Interesting

    To say hackers are evil is like saying germs, viruses, and carnivores in general are evil. By merely acting out Adam Smith's society being benifited best by each acting in his own best interests (adapted by John Nash to include societal interests for best outcome), we are keeping in step with mere nature.. A dog will forage for food, defend it's food, and kill it's food, so that it can stay alive. A rabbit will defend against other rabbits if need be (though they'll generally run away from anything else).

    A patron is looking for a good deal, and will expend effort to maximize their deal, so sloopy wording on a sign on your store-front are invites to a natural onslaught of fiscal frustration. By natural, I mean there is no evil intent in people trying to keep you for your word in maintaining a good bargain (that you didn't intend).

    If there is money on the street, it is conceivable that:
    a) the original owner will never find it again
    b) someone else will take the money

    So you justify taking the money yourself.

    If you are hungry, you might be inclined to take two samples at a free food-sample kiosk. It's unfair as it goes beyond the intent of "sampling" and takes away from other's (since there is usually a set amount of sample provided for the day).

    In reality, those that are sheltered from such harsh survival of the fittest environments will EVENTUALLY meet with that environment.. It is impossible (short of death) to avoid it. Thus the question is not IF we will meet our challenges, but when, and how quickly will the difficulty level rise.

    For those with assets we fear to loose (time,money,posessions,intellectual property, etc), it is natural for them to be saught by others. Having a public wiki is valueable advertising real-estate (or a personal repository for globally accessible content). So grafiti, being merely a primitive form of marketing, is bound to happen. Bank accounts are an obvious point of content.. If you happened to come across money on the street, you are more than likely to take it. If your ATM machine started allowing you to withdraw cash w/o deducting from your bank account, there is a better than likely chance that you'll take advantage (anonymous theft when it is considered to not overwhelmingly harm someone else - proportionate loss/gain - is often self justified). There isn't much difference from taking from that ATM machine and taking from an online bank account that you've happened by. Yes there is a greater issue of proportionality (you might be stealing from someone poorer than you), but you might think to yourself (I'm teaching them a lesson).. What-ever the cause, an otherwise moral man may find themselves tempted.. To say nothing of the mafia.

    And ultimately organized crime is the tyrannasauras of our internet age. The mafia being only one form of it (unfriendly governments being an even more serious threat). The age of mafia and internet "WAR" (literally between nation-states) is only a matter of time.

    So if our "evolution" through natural selection and adverse environment does not "toughen" us enough to sustain such natural phenomena, then we will die (or at least the medium will die).

    So lets look again at these "evil" hackers. Many of the hackers were self-professed white-hackers, or anonymous exposers. If you are inclined to see if a WEB-INF directory or IIS-specific file-set are visible on a public site, you can either email their sys-admin who might sue you for hacking, or simply ignore you (like MS tries to do with serious security alerts so long as the general public is oblivious), or you can make it a priority for them... Deface their web site, delete lots of their database records.. Make it too expensive for them NOT to resolve the issue.

    These are altruistic people. Slightly less altruistic are those that advertise themselves 3l33t hacker-names advertised here and there. As they have the fun and recognition-factor of it all (especially if they get CNN coverage).

    Embrace th

    --
    -Michael
  28. The "hackers" debate is beside the point... by Butterspoon · · Score: 2, Insightful
    Let's just face it, [h|cr]ackers are here to stay, and so is information security. But Ranum has a more important message that got obsured by the flamebait: forget about trying to enumerate and block every type of evil packet and concentrate on permitting only what people on the network should be doing. As TFA puts it:
    Anti-virus, Intrusion detection, Intrusion Prevention, Deep Packet Inspection - they all do the same thing: try to enumerate all the bad things that can happen to a computer. It makes more sense to try to enumerate the good things that a computer should be allowed to do.
    --
    pi = 2*|arg(God)|
  29. You mean deviants right? by aussie_a · · Score: 2, Funny

    happy => gay
    homosexual => deviant
    closet-case => priest

    Yeah, go on. Mod me -1. I've got Karma to burn, and if you're so easily offended, perhaps you should turn your computer off. This is a humorous post to demonstrate that words change over time and the OP should learn to deal with it or move to France (where they have a department to try to keep the language pure).

  30. "Blaming the hackers" won't get you anywhere by browncs · · Score: 2, Insightful

    The "bad guys" (don't want to call them hackers because of the debate about that term) are not going to just go away because we give them mean looks and call them poopheads.

    There are three types of motivation:

    1. The excitement and fulfillment that comes from understanding a system and finding the holes in it, and often leaving your mark so others know you were there.

    2. Political and ideological motivations -- a desire to educate people, and punish the "enemy".

    3. Economic motivations. This includes both advertising, and theft/scams.

    The trends started at (1) and are increasingly moving towards (2) and (3). Ironically, the technology generated by (1) is being used by those whose motives are very different than the type (1)s.

    The only way to fix this is to reduce the openness and anonymity of the Internet.

    I repeat:

    The only way to fix this is to reduce the openness and anonymity of the Internet.

    Just as we had to find a balance between privacy and security/integrity in every other aspect of society (e.g. telephones, credit cards, ...), we will have to do that on the Internet.

  31. Re:"Desire for fun"? Oh please.. by Simulant · · Score: 3, Insightful

    "The major disruptions now are not caused by simple thrill-seekers."

    Please name one serious, high-profile hacking case (to include authoring viriii & worms) in which the perpetrator was caught and didn't turn out to be a teenager or a still adolescent 20 something.

    Inside jobs don't count.

    I'm sure there must be a few but I honestly can't think of any.

    Not to say that there aren't real bad guys out there... they just don't seem to get caught despite all the money thrown at computer and network security.

    Speaking as a sys admin for almost 20 years, most hacking has been a source of annoyance (and sometimes amusement) rather than serious damage. The oft quoted "billions & billions of damage due to hackers' is a load of crap as far as I can tell. Kind of ike the y2k bug was.

    They don't frighten me. The internet was never designed for privacy to begin with. If that's your aim then paying to "hack in" extra security is the price you pay.

    And you know what...? sometimes the cure is even worse than the disease.

    I read somewhere recently (sorry, can't remember where) where someone (a security "expert"?) criticized a nuculear power plant's network security by saying something along the lines of "they're so backward they aren't even connected to the internet". Sounds like good security to me.

  32. blame everybody by Monofilament · · Score: 4, Insightful

    Security isn't about stopping somebody who wants to be malicious to a system and have fun with that.

    Its about protecting information that you otherwise don't want unauthorized people to have access to. its about espionage, its about privacy. Its about making sure you know if somebody is just looking on your system. Honestly a server can be replaced if it gets fried by some hacker trying to hurt it, and there are backups. But you'd never know if somebody went in and just invaded your privacy and looked at all your things and then left it completely clean right?, not without something like a firewall or some sort of logs and security system set up.

    So yeah go blame hackers for making us think of the idea .. but don't say we wouldn't want it otherwise. Firewalls are a good thing...

    --


    Who makes you Sig?
  33. Biting the hand that feeds... by rdurell · · Score: 2, Insightful

    Why in the world would he be bitter-- hackers and criminals keep him employed and have made him somewhat of a known figure. I understand his frustration at the lack of real morality in some people, but the bitterness is a bit over the top.

    Let's look at it another way-- do you really think Batman would be happy if Gotham (or the world) were rid of crime? What would he do?

    Or yet another point of view-- hackers are actually helping the economy. They have created a new market in security which creates jobs, revenue and all the other economic benefits. As Gordon Gecko might say "Hacking is good!"

    To expand this a bit-- without crime there would be no need for a police force. Without war there would be no need for a military. What would we do with all that excess production capacity?

    *tounge firmly planted in cheek*

  34. Inventor of proxy firewall - takes another toke by mr_z_beeblebrox · · Score: 3, Insightful

    They're the ones who place their desire for fun ahead of everyone on earth's desire for peace and the right to privacy

    How can someone be clueful and clueless all at once... Desire for fun....that did not steal 40 million credit card numbers. Everyone on Earths desire for peace and right to privacy? Tell that to the Chinese who are told what ports they can or can not secure to allow for "public monitoring" This guy is lost.

  35. bullshit by cahiha · · Score: 3, Insightful

    Computer criminals and black-hat-hackers are as much a fact of life as rain showers in Seattle, earthquakes in California, flus in winter, and accidents on highways.

    Security isn't an accidental byproduct of software, it is one of its primary functions; if software doesn't provide security, then it is defective. That's just like if you buy a padlock, you have an expectation that it actually works as a lock. The padlock manufacturer can't say "oh, well, our padlock doesn't work, but that's really the criminal's fault".

    Any vendor that puts out software that contains easily avoidable security holes (like buffer overflows, backdoors, ...) is very much to blame. In fact, it should be possible to hold liable for negligence.

  36. arms race by crabasa · · Score: 2, Insightful

    The problem, as I see it, is that since "software" is such a new concept (compared to houses, locks, etc) that people and society haven't settled on REASONABLE steps to secure things vs. UNREASONABLE steps.

    For example, if I wanted to, I could easily break into the average person's home. It just isn't that hard. Does that mean they "failed" to secure it? I would think not.

    There is no such thing as "perfect" security. It will always be an arms race between malicious people (or misguided non-malicious hackers) and the people trying to protect their systems.

  37. Hacker Justification by Mulletproof · · Score: 3, Interesting

    Now this is just a sad justification and can easily be turned the other way-- If it had been organized crime that started hacking, the governement would probably take it more seriously than it is now, with laws and penalties to match. The tools would have been developed anyway, so it's really a non-issue.

    Besides. Hackers have been doing serious damage from day one. Besides just breaking into networks for "curiosity sake" they've been planting worms, trojans, trolling entire credit card data bases, commiting DDoS attacts, etc etc. No, not all of them, but enough to make the OPs point a ridiculous one to even attempt to justify.

    --
    You need a FREE iPod Nano
    1. Re:Hacker Justification by marquis-cablewitch · · Score: 2, Funny

      Trolling entire credit card databases eh? "Hey you, yeah you! You've got a poor credit history! I bet the other accounts laugh behind your back!" Well I'm knackered, best gag I could come up with.

  38. Re:Article is not particularly insightful, really by jcinnamond · · Score: 2, Funny
    you never hear people telling the victims of Theives that they should have had three deadbolts on the door


    I often go out and leave all the doors open and piles of money lying around and it's amazing how few people are sympathetic when someone steals all my stuff.
  39. Blame vs responsibility by MrLint · · Score: 3, Insightful

    Technically his statement is correct, however prima facia, its a foolish one. As its been said elsewhere in the comments it implies that if it were not for 'hackers' systems would be 'safe'. However as is the case with companies looking to cut every conceivable cent, there would be no security otherwise. "Why bother locking the doors there are no criminals to steal my possessions!"

    This sounds merely like an argument for altruism and security thru obscurity (which of course doesn't work). Why would a company try to harden against problems, even if caused my a mistake, if there is never any pressure to think there would be a need?

    Would a civilization wonder if there is anyone else out in space if they can see no stars? Problem is without external pressure, people get sloppy. Of course people are sloppy to begin with. Imagine the extent of the credit card problems we have seen in the past months if there was no security at all? Its a poor argument really.

    1. Re:Blame vs responsibility by proberts · · Score: 2, Interesting

      No, you're wrong. It doesn't imply that things would be safe, it implies that if people didn't do bad stuff, then that subset of bad stuff wouldn't happen. The fact is that we're dealing with social issues, which don't have technical solutions. Social solutions fix social problems, and part of the solution is to make criminal activity socially unacceptable.

      The fact is that people have been kidding themselves that they have some level of security for a long time, and if there was no security at all, then the base problem would have likely had a lot more attention paid to it, especially the transitive trust part that Marcus talks about. But because people think "We have a firewall, so we're safe!" the real base problem doesn't get addressed.

      Paul

      --
      http://www.pauldrobertson.com
  40. Re:straight from Hazlitt by eventDriven · · Score: 5, Insightful

    The grandparent and parent both touch on something important. The vandal/repairman example comes straight from Hazlitt and is indeed an old fallacy. People see the new improved and rock-resistent glass and they say 'now that's progress'. What they don't see is the resources the shopkeeper had wanted to purchase with the money that had to go to the new window. The shopkeeper could have spent that money to become more efficient or expand. Or as in Hazlitt's example, bought a new suit. Then the tailor would have had more resources to put into play.

    The window repairman, much like the parent poster, probably thinks rock-resistant windows and proxy firewalls are an excellent investment. When we look at the long list of technologies that changed the 20th century, many/most were developed at least in part to help wage and defend warfare. One might deduce that warfare is a creator of value. Yet war is always a destroyer of value. It is the allocation of resources that could be more suitably employed.

  41. "Hackers" vs Crackers by flajann · · Score: 2, Insightful
    I am so tired of our good name being smeared this way, and everyone here should know better!

    Let's set the record straight: "Hackers" refer to those of us who do wonderful things with the hardware and software. "Crackers" are those who seek unwarranted entry into other people's systems, usually for malicious intent.

    I am a born bonafide *hacker*, and have been so for the past 27 years. I, on the other hand, am NOT a *cracker*, and I would like to see them on the business-end of a (insert your favorite weapon here). Recovering from the damage crackers have caused me and others is no fun, eats valuable time, and forces me to focus on things that are not productive, but necessary to keep them out.

  42. UberMUD & UnterMUD by Macka · · Score: 2, Interesting


    Thought I'd mention a bit of history (long since forgotten) that Marcus Ranum was also the author of the UberMUD and UnterMUD, mud engines. Two very nice mud cores, written in K&R C that ran on Ultrix. Both had their own strengths and weaknesses. UberMUD was my favourite, as it had its own scripting language called "U". UnterMUD didn't so it was harder to develop on, but its filestore backend was much smarter than Uber's. A union of the two would have been the perfect MUD engine IMO.

  43. This strikes me as whining... by rpdillon · · Score: 2, Insightful

    I mean sure...the crackers DO cause all the problems, but you have to develop a system that allows for the existance of the inevitable. Yeah, communism is a great idea, but unless it can be modified to account for the fact that there will be people trying to leech off the system, it won't go very far. Similarly with computers: it's a bit foolish to complain that we wouldn't have to have information security if we didn't have all those darn criminals cracking our computers. There will always be people who want to leech because they're selfish, and there will always be criminal crackers. Part of running a society, or a computer system, is making it resilient to those that don't follow the rules.

  44. Due Diligence and Criminal Behavior by jglen490 · · Score: 2, Insightful
    If someone exercises due diligence and does what he can to protect his house/car/computer from illegal entry or damage, that still won't stop the criminal from trying, and perhaps succeding in, illegally entering or damaging the property. But by exercising due diligence there is a good chance that there will be no question about the owner being able to repair/reclaim the property (i.e., insurance).

    The criminal, on the other hand, is still a criminal in this scenario because he violated the owner's house/car/computer, and no plea of "trying to protect by demonstration of vulnerability" is possible. In other words, breaking and entering is never a "favor" rendered.

    When you buy a product, you expect the same due diligence in quality, truth in advertising, and utility of the product. If the producer deliberately produces an inferior product, lies about it, or if it does not live up to its utility, that producer may be subject to at the least, ridicule, and at the most, financial or criminal liability. On the other hand, someone who deliberately breaks a product has a reduced, and probably no, claim against that producer.

    A hacker who draws attention to a weakness in a product may actually be a hero; however, one who deliberately breaks things or breaks into places without permission is nothing more than a criminal.

  45. Re:Article is not particularly insightful, really by JWW · · Score: 2, Interesting

    You should be expecte to install updates on your system, as the basic precaution.

    To follow along with this analogy. But with my house when I install a new deadbolt I'm done. With a PC users need to install a new "lock" every month.

    I just find the amount of crap users are expected to do just to keep their machine usable is amazing. Everyone is expected to be an expert and they're not. In the real world Brinks will outfit your house with a security system, install it, manage it , the whole nine yards. With PCs the user has to do all the maintenance, all the management.

    It suprises me that there aren't more ISPs offering a fully blocked and monitored service to customers (wait I should patent that idea ;-). This way they could ease the users burden in the defense of their PCs. Of course their users would complain that their really cool (spyware laden) browser toolbar doesn't work anymore, and they'd get angry. Wait, I was defending the users wasn't I? Oops.

  46. Re:Article is not particularly insightful, really by Raphael · · Score: 2, Insightful
    [...] you never hear people telling the victims of Theives that they should have had three deadbolts on the door [...]

    It depends on where you live. In some cities/countries/parts of the world, you are expected to have three deadbolts on the door, or some other security features. Otherwise you end up paying very high insurance fees.

    Thieves get serious jailtime and the police work to find them and they are considered the only ones to blame. In the PC realm, hackers go largely uncaught and unpersued by the athorities, and the user gets told its their fault.

    There is one thing that you forgot to mention in your analogy: collateral damage. If a thief breaks into your house and steals stuff, then you may have lost something but your neighbors should still be relatively safe. But with the Internet, if some cracker breaks into your PC and adds it to his botnet, your PC will soon be inflicting significant damage on your neighbors. Although the cracker is the one to blame for starting it, the lack of security on your PC will have contributed to the collateral damage.

    Let's take another analogy and replace thieves with fire: let's imagine that because it is cheaper or easier, you decide to build your house using highly flamable materials. You live in a densely populated area and several of your neighbors decide to build their houses from highgly flamable materials for the same reasons (or some company starts selling prefab houses made of flamable materials and even gets a near-monopoly on that). Now comes a pyromaniac who sets your house on fire. Bad luck, in a few hours the whole city is destroyed or damaged. Now do you really think that the only one who will be blamed is the one who started the fire? I expect that some people will also complain about the damage caused indirectly by their neighbors.

    You could think about other analogies in the same vein, for example if houses could be built easily without solid foundations and if they could start falling down on each other like dominoes. I expect that some people would not be happy to have their neighbor's house falling on their own house, regardless of who pushed the first domino.

    --
    -Raphaël
  47. lame blame game by maryjanecapri · · Score: 2, Informative

    consumers want to blame companies
    companies want to blame hackers
    hackers want to blame developers
    developers want to blame users
    users blame whoever the media tells them to blame.

    there is some truth to what is being said here. sure early hacking showed the developers they had to pay some attention to security. but couldn't that be done in a controlled environment? why? because that way innocent people wouldn't be put out. there are people losing identities and money because of theives (i say 'thieves' becuase a hack where you steal is a theft - sorry everyone but that's the law).

    so continue to point your own finger when a finger is pointed at you but at some point some culpability must be had.

    --
    nature loves variety::society hates it get your variety at http://www.monkeypantz.net
  48. 600 Fucking Posts and Nobody RTFA! by Master+of+Transhuman · · Score: 2, Informative


    Get over the last paragraph, morons, and RTFA!

    It's FAR more insightful than any of the comments I've seen bitching about the "blame hackers" paragraph - which was preceded by "blame everybody else" sentences anyway.

    You guys sound like the big media press whenever somebody gets caught faking or running false stories - "Oh, woe is us! Somebody is blaming us for being idiots! We're such a poor, put-upon industry!"

    Deal with it!

    --
    Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
  49. Re:"Desire for fun"? Oh please.. by sphealey · · Score: 4, Interesting
    There is this thing out there called Google News. You might want to give it a try:
    (IsraelNN.com) The first charges in the "Trojan Horse" mass industrial espionage case, which implicates many of Israel's economic powerhouses, have been filed with a Tel Aviv Magistrate's Court today.

    The charges were filed against the private investigator alleged to have obtained sensitive business information from Israeli businesses illegally by means of a Trojan Horse computer program. He then sold the information obtained to the targeted businesses' competitors.

    It is in fact not teenagers, but directed industrial espionage at best, international espionage at worst.

    sPh

  50. Re:straight from Hazlitt by SatanicPuppy · · Score: 2, Interesting

    In a perfect world, maybe. But everything in the world we live in is driven by conflict and competition, not the betterment of our fellow man, not the betterment of our world, not even the betterment of ourselves.

    Until that changes, war is indeed a creator of value, because it's unlikely that many of those advances would have been made otherwise. All we know of space exploration is founded on advances that were originally made to kill people. Nuclear power came after nuclear weapons.

    It's nice to imagine a world where there is o conflict and there is no competition. That world is probably also without technology, however.

    --
    ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
  51. Re:If I may state the bleeding obvious by spectecjr · · Score: 2, Insightful

    It is NOT "hackers" causing all those problems with the internets that Dumbfuck McCumstain so laments. (Yes, I AM being really insulting and offensive to Marcus Ranum! He's been really insulting and offensive towards me and my fellow hackers.)

    It is thieves and vandals causing all those problems.

    Hackers invented the micro/home/personal computer. Hackers invented the diverse protocols that allowed these machines to talk to one another. Hackers invented the operating systems. Hackers invented the Internet. A hacker invented the World Wide Web.

    Thieves and vandals merely took advantage of what hackers have invented and shared with the world. Took advantage and turned these tools to an evil purpose. Not hackers, THIEVES & VANDALS!


    The language changed some time around the early to mid eighties, when Hackers became synonymous with Crackers.

    If you can't handle a 20 year old change to the English language, you shouldn't be allowed near computers. Unless you're only planning on programming in Cobol.

    Get over it.

    --
    Coming soon - pyrogyra
  52. Most Importantly... by sallgeud · · Score: 2, Insightful

    They're the ones who are responsible for companies needing to buy the software that the company who employs me produces... thus giving me a job.

    To the hackers:
    Though you annoy me... my lifestyle thanks you.