Humans Not Evolved for IT Security

Stony Stevenson writes to tell us that at the recent RSA Conference security expert Bruce Schneier told delegates that human beings are not evolved for security in the modern world, especially when it comes to IT. "He told delegates at the 2007 RSA Conference that there is a gap between the reality of security and the emotional feel of security due to the way our brains have evolved. This leads to people making bad choices. 'As a species we got really good at estimating risk in an East African village 100,000 years ago. But in 2007 London? Modern times are harder.'"

Comments

Lets think about this.

[bigattichouse]

So the modern equivalent is "What I can't see won't eat me" ... seems to be the same mistake. More likely, if 99.99% of your senses tell you that you are safe, then worrying about meteors or lightning strikes is a waste of energy. Plus you gotta think "selfish gene". Is I *feel* "secur-i-ness", I can proceed with making babies... while you're so worried about lions, you fail to impress the ladies.

Re:Lets think about this.

[Opportunist]

So that's why my common sense tells me I don't need to hide under my bed from the bad, bad terrorists, it's just that I can't see them anywhere and not that it's overblown hype.

I'm kinda scared now.

Re:Lets think about this.

[lazy_playboy]

No, no, it really is overblown hype ;-)

Re:Lets think about this.

[CompMD]

> You are alone in a dark room and cannot see. You are likely to be eaten by a grue.

Actually, sounds like what you can't see WILL in fact eat you.

Re:Lets think about this.

[magisterx]

More to the point, people are bad at estimating certain types of risks, and they are focused on certain types of risk. Historically, people are most worried about immediate threats to life and limb. Naturally that will always be a concern, but in an era where there is (comparatively) little immediate threat to life, we are not overly prepared to deal with subtle threats to information or technology. We are prepared to react to predators that want to eat us and starvation, but ill prepared to deal with people that want to defraud us and steal possessions that may not be immediately with us.

Re:Lets think about this.

[joto]

but in an era where there is (comparatively) little immediate threat to life, we are not overly prepared to deal with subtle threats to information or technology

If somebody breaks into my computer, will I die? No. Will I become sick of temporarily disabled? No. Will I lose money? Possible, but unlikely, and in any case the insurance company will get them back for me. Should I therefore hire a security consultant? NO!

I believe most people get this analysis right.

We are prepared to react to predators that want to eat us and starvation, but ill prepared to deal with people that want to defraud us and steal possessions that may not be immediately with us.

More importantly, we are unable to plan for long-term security. If the planets ecosystem is under attack from global warming, creating and/or spreading lots of new diseases (harming us, our food, or in some other indirect way), do we stop emitting pollutants contributing to global warming? No. Do we invest money into biological research and education so we can handle the new diseases? No. Do we invest significantly in technological countermeasures, such as painting Sahara white, building dams against floods or the rising ocean, or even storing CO2? No. Do we do anything at all? Not really, unless you count selling quotas to each other.

Re:Lets think about this.

[jotok]

You're totally right that people don't think out the long-term, far-reaching implications of their actions.

For example, the Russian Business Network is getting money from somewhere. Probably their #1 tool for doing so are botnets comprised of home users. RBN makes a lot of money extorting companies which eventually pass the (lack of) savings on to the consumer.

So, no, you don't need to hire a security consultant, but it would help to listen to them now and again.

Re:Lets think about this.

[joto]

Touché

really

[snarkh]

As a species we got really good at estimating risk in an East African village 100,000 years ago.

I wonder how many days would that guy last in an East African village 100,000 years ago.

Re:really

[Anonymous Coward]

There were east african villages 100,000 years ago?

Re:really

[Anonymous Coward]

I wonder how many days would that guy last in an East African village 100,000 years ago.

Or today for that mater.

Re:really

[Gabest]

depends... raw, smoked or cooked?

Re:really

[apparently]

Last time I walked through Harlem, the hoodz said I had to fucking PROVE my wealth and whitenses before they would even consider robbing me. I showed them paystubs, my Discover card, even an ATM receipt, and still they doubted how rich I was! And don't get me started on the "white" thing, apparently they don't go by complexion any more, you gotta keep a DNA sample on you with a notarized letter from a scientist stating that he confirms your race.

Us white, rich folk never had it so tough.

Also, you really ought to be awarded with some sort of "waste of a condom" trophy.

Re:really

[mstahl]

Come on. Bruce Schneier is like the Chuck Norris of the IT industry. He'd outlast us all!

Remember. There are no prime numbers, only numbers that Bruce Schneier doesn't want you to factor!

Re:really

[Anonymous Coward]

He says we GOT really good, not we (STILL) ARE really good. RTFA.

Re:really

[cytg.net]

i dont get it. was it a black condom ?

Re:really

[Agripa]

I wonder how many days would that guy last in an East African village 100,000 years ago.

If he had grown up in that environment I would guess he would do fine. None of his ancestors died without having successful children.

Re:really

[angus_rg]

Bruce Schneier cracked BD+ in 3.14159265 seconds.

In an effort to better mankind, Bruce Schneier traveled back in time and fathered Dennis Ritchie, Brian Kernighan, Larry Wall, Richard Stevens, and the Arpanet.

Bruce Schneier eats W32/Bagle.bb@mm for breakfast.

Bruce Schneier does not sleep. He prempts everything.

Re:really

[PseudoLogic]

my Discover card And there's your problem!

Re:really

[tehcyder]

Thanks, it's posts like yours that make up for the mindless racist drivel that infests slashdot.

Re:really

[Monkey]

I heard that while Bruce Schneier is calculating and displaying pi through his continuously blinking eyes, he also plays Arecebo telescope radio noise samples on his iPod and processes seti@home work units in his head.

do you want to check my shoes?

[User 956]

He told delegates at the 2007 RSA Conference that there is a gap between the reality of security and the emotional feel of security due to the way our brains have evolved.

Which is why, a lot of times, you end up with security theatre, instead of real security.

Re:do you want to check my shoes?

[Kjella]

And don't forget CYA security - security rules that aren't being followed and aren't being enforced either - but that exist solely so that when shit hits the fan, the bosses can say it was against policy. These are usually extremely draconian, impossible to implement or practicly impossible to follow while getting work done. But hey, it looks good on paper...

Re:do you want to check my shoes?

[Mursk]

Not to back the TSA or anything, but "likely to explode" is by no means the only definition of volatile.

Re:do you want to check my shoes?

[martijnd]

How about nuclear weapons security? The first thing everyone said when that bomber crossed the US was
"this is impossible" ; "there are so many layers of protection to avoid this"; "we have insane levels of highly structured protocols to make this highly unlikely"

Turns out that the field people decided to "optimize" things a little bit to be able to get some work done before they went off-shift.

Funny, makes you wonder how serious you have to take the statements saying "even if they dropped them, they would have been unarmed and harmless" , "there are many layers of protection build to avoid it going 'life'"

Re:do you want to check my shoes?

[AndersOSU]

Yeah, but why would a substance with a high vapor pressure be a problem to a would be terrorist? Either the vapor pressure is so high that you literally could not combine small containers without most of it evaporating, in which case all your containers are going to have to be thick walled pressure vessels to begin with in order to contain it. I'm not one to put too much faith in the TSA myself, but even I would think that they'd notice a 1Q plastic zip-lock bag with seven 3oz. high pressure containers. The other possibility is that the fumes are highly noxious, and any attempted mixing would knock out or kill anyone opening the containers. Unless it is an immediate effect, I don't think a terrorist with a mind for taking down a plane is going to care that he is going to die from being poisoned in a few hours. If it could immediately incapacitate someone - to the point they couldn't assemble a bomb, then you don't need a bomb, you just need to open the container near the cockpit door, and wait for the plane to drop out of the sky.

Re:do you want to check my shoes?

[Mursk]

To be clear, I'm certainly not arguing your main point, which I took to be that the TSA's statement leaves a lot to be desired. I guess I'm just willing to give them the benefit of the doubt until they clarify what exactly they think "volatile" means; maybe that's my mistake right there. ;)

Re:do you want to check my shoes?

[AndersOSU]

I'm pretty sure volatile is code for, "blah blah blah experts blah blah science." Isn't that all Joe Public should need to accept something that at is least counter-intuitive, and at worst physically impossible, all because Uncle Sam says so.

So yes, volatile can mean something other than will explode immediately, but no other meanings make their statement make any sense either

Ms Abacha?

[Mr_Icon]

Looking at the number of people falling for Nigerian scammers, I'd say that our ability to "estimate risk in an East African village" is not so hot either. :)

Re:Ms Abacha?

[nelsonal]

But that's a west African villiage, totally different risk profile. Well played.

Re:Ms Abacha?

[SterlingSylver]

As a celebration for his victory, we are established for your beneficiary a large bank account in a small East African village. Effect payment of charge processing to the bank account to be listed later in order to receive your monies.

Re:Ms Abacha?

[tehcyder]

Looking at the number of people falling for Nigerian scammers, I'd say that our ability to "estimate risk in an East African village" is not so hot either. :)

But that's a west African villiage, totally different risk profile. Well played.

At least he got the right continent...

Humans Not Evolved for IT Security

[Daimanta]

Thank God I was intelligently designed for this kind of thing ;)

Re:Humans Not Evolved for IT Security

[gammygator]

That's because in Soviet Kansas, nothing evolves...

Re:Humans Not Evolved for IT Security

[sm62704]

Thank God I was intelligently designed for this kind of thing ;)

Too bad Windows isn't.

Re:Humans Not Evolved for IT Security

[wilper]

In Soviet Kansas is not you anymore.

Bad Analogies Abound

[eldavojohn]

"The brain is still in beta mode, it's got all sorts of patches and workarounds. It's not perfectly created, it's clearly evolved up." Wow, just ... wow. I'm not even a biologist but I know that's a terrible analogy. You can't compare the brain to software. We can control software and decide when it 'goes live,' there are no prototypes in nature or evolution. Every attempt is an iteration of the process and the process is never ending. Furthermore, the existence of an absolute of 'perfectly created' is debatable on any level in regards to any process or system.

Exaggerate uncommon risks -- for example, air travel is safer than cars but because car accidents are common they are seen as less risky Maybe because everyone involved in an air plane crash usually dies. Automobile deaths are much less. There's this idea of risk = probability * impact. In the case of automobiles, probability is high but the impact is low. It's the other way around in aircraft failures.

Personified risk -- Osama Bin Laden is scarier than a faceless threat How in the hell does this relate to IT security? I think IT administrators are more afraid of the people they don't know hacking their systems then the people they actually employ doing the same. In the end, I'm sure more attacks come internally or from an ex-worker than someone unknown. Maybe the face you know should be more scary than the face you don't at the office?

Risks that could be controlled -- The DC sniper caused a few deaths but the response was way out of proportion. Please elaborate, I know of the John Lee Malvo incident but I have no idea how this relates to IT security. Are you telling me that shutting down a system to protect a database from a possible threat or virus is overkill? I would respond with that varying on a case by case basis but at my job, offline databases are worth maintaining the integrity of the data inside them.

I know I'm really coming off as a jerk when I say this but I don't think this article helped me in anyway. All I saw was someone over simplifying a complex problem--thereby making them seem smarter to the people they were explaining it to.

Don't read this article, it has nothing to offer you. If you don't know this subject, I believe this article will only add to your confusion and lack of understanding.

Re:Bad Analogies Abound

[SatanicPuppy]

This is actually a hot psychological topic right now; humanities tendency to poorly conceptualize risk. We're far more worried about diseases we're unlikely to catch, than ones we are. Plane crashes are scary because planes aren't familiar to most people; poor understanding of the risks magnifies fear. People always worry about the stereotypical malicious strangers, when most assaults come from people you already know.

I think mostly he's just pointing all this out as background to the tendency to poorly appreciate risk. He's basically saying, "People apply more worry to splashy things that aren't likely to happen, and therefore we have these huge data breaches because who cares about SSNs when the terrorists could be blowing up a nuke plant?"

The only place where I think he's totally off base is calling the brain "a patchwork". It's not, in fact. It's extremely finely tuned to do what we need it to do...It makes us ferociously competitive animals, and that is proven rather than disproven, by all the security problems that we've been having. If we weren't competitive, we wouldn't have problems. The fact that not everyone works at the same level is irrelevant.

Re:Bad Analogies Abound

[eison]

Plane crashes are scary because we feel out of control. We overestimate our own competence, so if it feels like we have some control over a situation, we assume we can handle it.

Re:Bad Analogies Abound

[antifoidulus]

Exaggerate uncommon risks -- for example, air travel is safer than cars but because car accidents are common they are seen as less risky

Maybe because everyone involved in an air plane crash usually dies. Automobile deaths are much less. There's this idea of risk = probability * impact. In the case of automobiles, probability is high but the impact is low. It's the other way around in aircraft failures.

Not to mention the whole "I'm such a good driver I can get out of any jam" mentality. Whether true or not, many people think that when they are in a car they are skilled enough to avoid accidents, however in an air plane once that door closes you have about 0 control of your destiny till the plane touches down. That bothers a significant number of people.

Re:Bad Analogies Abound

[Lurker2288]

In the sense that brains in general started off in a much simpler state with no need to handle many of the things it's currently capable of (binocular vision, manual dexterity, doing calculus) and it got to where it is one incremental improvement at a time, then yes, it most certainly is a patchwork. You can see it in the gross structure: you've got the reptilian hindbrain that keeps your body functioning in a narrow homeostatic envelope all the way at the bottom, atop which sits a cerebellum that allows for things like emotion (great for pair bonding and knowing to run away from big things with pointy teeth), and atop all of that you've got the cerebrum that enables most of your higher intellectual activity.

The fact that this magnificent hodgepodge seems to be so perfectly attuned to our needs is almost definitional, as well as being a kind of survivor bias. That is, our brains are great at what we need them to do precisely because they evolved to do those things; brains that were evolved to do other things, or that did the same things, but not as well as ours, died off. Schneier's point is that the modern world has changed a lot faster than our brains are able to, and as a result, we're maladapted for some of the tasks facing us today, like assessing remote risks.

Re:Bad Analogies Abound

[SatanicPuppy]

That's part of it, but you're still more likely to die in a bus or taxi accident, and they're not viewed with the same unreasoning fear though they also lack control.

We are all soothed by familiar routine. This is the purpose of disaster drills, so if your building does catch fire, your mind will move into that pre-built track, and move effectively, without being paralyzed by the need to act conflicting with the fact that you have no idea of what to do. Planes are not only outside our control, they're outside most people's experience, so an event which is no more significant than a bus running through a pothole, elicits a greater level of fear due to it being an unknown, rather than a familiar, occurrence.

Re:Bad Analogies Abound

[Relic of the Future]

Why can't we compare software to cognitive processes? It's a common analogy, and I'm surprsied you haven't run into it before. Also, "every attempt is an iteration of the process and the process is never ending," which you claim as an example of how evolution is not like software, is a perfect match to how security software (actually, a lot of software) is written these days.

Also, while there are many non-fatal car crashes, more people do DIE in car crashes than in plane crashes, but "fear of dying in a plane crash" is still more prevelant than "fear of dying in a car crash." And that is non-sensical.

Re:Bad Analogies Abound

[SatanicPuppy]

The problem with defining the brain as a patchwork is that there is no conception of what a brain would look like if it were designed. It's like calling an airplane a patchwork, simply because it's made of different parts that are all attached to each other, and all do different things.

There are certainly a lot of ways in which our bodies are capable of adapting that would benefit us in the modern age. As for the perception of risk, I don't see it. Risk perception will never "evolve" to extend to the realm of the abstract, simply because it's much more beneficial to the body as a whole to have a designated response set for concrete risk...The kind that will kill you right now. People have proven to be able to train their instinctive risk-responses to a variety of situations, and that is what is going to apply to this sort of risk; training, and education, not evolution.

The evolution argument is disproven by Schneier himself; how could he be thinking about it if we hadn't already evolved to make it possible? It's like saying humanity had to evolve to have the correct response when someone pointed a gun at them; it was a new threat, presumably the first person to be shot didn't see it coming, but the guy standing next to him learned to jump for cover in record time.

I think the problems we're dealing with are of that nature. Most people aren't used to visualizing risk on the sort of scale that they're seeing it. It's not that they're unable, it's that they're uneducated.

Re:Bad Analogies Abound

[Sax Maniac]

It's pretty obvious that people estimate risk badly, and I agree with you.

But don't try and actually tell anyone this. You will be labeled a bad parent (because you don't worry about stranger kidnappings as much as car accidents), un-American (because you don't worry about turr'ism as much as dying from heart disease), or a host of other things. Do not try to explain to anyone why. People tell gravely tell you "I don't need proof, know in my heart that the world is a more dangerous place today" despite that crime has been going down for the last 20 years.

Keep it to yourself, and just be happy that you're smarter than your average bear.

Re:Bad Analogies Abound

[CyberLord Seven]

That's part of it, but you're still more likely to die in a bus or taxi accident,

I don't know about this. Buses are safer by virtue of their size if nothing else. Unless they careen over an embankment or bridge, or get hit by a train, they are pretty safe. I have read about a lot of bus accidents over the years. Few have had fatalities.

Taxis I can agree with you on. They are nothing but cars anyway.

Re:Bad Analogies Abound

[OldSoldier]

And furthermore... is the reason because of how our brains are wired or something else? Where's the proof that this sort of response is due to our brain's evolution?

I think at least some of this is due to not having adaquate information. A plane crash makes big news. The daily death toll in automobile accidents does not and very few people bother to go and research this before hopping on an airplane or driving in a car. They just assume from the information they have at hand.

I conjecture that if we had better access to information we'd get a lot more mileage out of how our brains are wired than Schneier is giving us credit for.

and furthermore... what's his point?
I've read TFA and previous posters are correct... the article is like a /. summary of his (hopefully more detailed) speech. I'd like to know what more was in that speech. So what if we're wired poorly to assess threats in an IT universe... WHAT IS HE SUGGESTING WE DO? Start an evolution research program to make our brains better? Believe in our algorithms more than we otherwise intuitively would? Schneier's recommendation, if he had any is not in TFA. Hopefully it was in TFSpeech.

Re:Bad Analogies Abound

[Vellmont]

Wow, just ... wow. I'm not even a biologist but I know that's a terrible analogy. You can't compare the brain to software.

You can't compare anything to anything else if you take it to far. The analogy was only to illustrate that the human brain isn't fully adapted to the modern world yet, just like beta software isn't quite ready yet. You're really trying to draw too much out of the analogy.

Maybe because everyone involved in an air plane crash usually dies.

I'd be willing to be you have a much higher chance of dying in an auto crash than in a plane crash, time wise. People think plane travel is risky because the media reports on every plane crash for days on end, but hardly ever reports on car crashes. So our brain gets stuffed with emotion laden pictures of planes on fire, sobbing relatives, etc, all connected to plane travel (and not car travel). Is it any wonder a lot of people are afraid to fly?

Please elaborate, I know of the John Lee Malvo incident but I have no idea how this relates to IT security.

The article was rather poorly written and far too brief. I don't know what Schneier thinks the connection is, but my own assessment is that people assess risk by what the hear about. The media went crazy-time mad about the dumb sniper guy, to the point where millions of people were afraid of buying gasoline. How does that relate to IT security? Well, the media does the same thing with IT stuff too. You hear about viruses viruses viruses, so people clamp down and buy anti-virus software. Is that the big threat to your information? I don't know, but I'd guess that more money is wasted from simple hard drive crashes and failed backups than viruses. Viruses certainly are a threat, but personally I've lost data to a lot more HD crashes than any viruses.

Re:Bad Analogies Abound

[Anonymous Coward]

Exaggerate uncommon risks -- for example, air travel is safer than cars but because car accidents are common they are seen as less risky

Maybe because everyone involved in an air plane crash usually dies. Automobile deaths are much less. There's this idea of risk = probability * impact. In the case of automobiles, probability is high but the impact is low. It's the other way around in aircraft failures.

This is a great illustration of how perception overrides reality. The fact of the matter is that most of the time an airplane crashes, everyone lives. The reason you don't know this is because crashes where everyone lives don't make the news. Airplane crashes are just like car crashes. There's a wide spectrum from "minor bump" to "flaming horrible death to all" and, just like car crashes, the majority of incidents are at the bottom of the spectrum. Unlike car crashes, people don't have any immediate experience of airplane crashes, and so they only see what gets on the news, and the only thing that gets on the news is stuff where a lot of people die.

Re:Bad Analogies Abound

[Vellmont]

The evolution argument is disproven by Schneier himself; how could he be thinking about it if we hadn't already evolved to make it possible?

Schneiere isn't humanity, he's just Schniere. One guy can have the skills and ability to do something, while the vast majority of others do not. Anyway, I think he's really trying to say that risk assessment of the modern world doesn't come naturally to people, like it did to risk assessment of being eaten by a tiger 100,000 years ago.

I don't know if the evolutionary theory about risk assessment is right, but I really doubt you do either. Neither of us have any data to show much of anything.

Anyway, I think you're trying to take his comments too far. It seems to me Schneire's ideas are really more of a way of thinking about why people are bad at assessing risk rather than a predictive theory that can be picked apart and examined. The ideas aren't really well developed enough for that kind of assessment.

Re:Bad Analogies Abound

[Lurker2288]

Your airplane analogy doesn't really work because unlike the human brain, the airplane was designed all at once, and assembled in accordance with that design. In contrast, the brain has evolved in a stepwise fashion that incorporates new elements as they become necessary and discards the old as they become superfluous. If you look at the brains of reptiles, and lower mammals, and primates, and finally humans, you can plainly see the development of more complex structures piled on top of the old ones. It's this incremental appearance that I'd label patchwork. We may not have a concept of an 'ideal' brain, but we can see clearly different steps that have been reached along the way.

The ability to conceptualize abstract risk and the ability to understand it intuitively (at a gut level, if you like) are two different things; Schneier never says we can't do the first--as you pointed out, we can think very easily about the risk of rare events. However, abstract risks don't pose a threat day to day--as a result, there's no selection pressure that would drive us to evolve the kind of neural wiring we'd need to do it.

Re:Bad Analogies Abound

[pokerdad]

We are all soothed by familiar routine.

Exactly. You'll find that people who for whatever reason are on a hundred plus flights a year, almost never have a fear of flying. On the other side of it, the fact that people get into a car so many times without having an accident is exactly why they feel cars are so safe.

(without commenting on any particular speed limits or enforcement of such, I have tried with little success to explain to people over the years why the faster you go, the greater danger you are in; the fact that these same people have regularily sped without crashing makes them feel that reaction distances and physics don't apply to them)

Some numbers I was able to find googling:

There were nearly 6,420,000 auto accidents in the United States in 2005. The financial cost of these crashes is more than 230 Billion dollars. 2.9 million people were injured and 42,636 people killed.

The average number of airline-related fatalities varies from year to year, but 1200 is about average.

Re:Bad Analogies Abound

[SatanicPuppy]

I just think it's a poor way of stating it...It lets people off the hook. It's not their fault, they're insufficiently evolved.

He's using "risk assessment" to mean two different things. Being eaten by a tiger isn't a common problem anymore, but avoiding auto crashes, electrical shorts, etc, all fall into that category, and we react perfectly well to those things. What the bulk of people don't react well to is risk that they can't touch or see; the reason for this is that the body has an instinctive risk-response for things that pose immanent danger, and it doesn't have an instinct for things that pose potential or hypothetical threats. Why would it? Do we really need a fear response over a potential threat? Makes no sense.

I think most people of average or greater intelligence are smart enough to at least understand what is at stake with regards to potential threats. We need to give them education and training, and not just play on their fear of the unknown.

Re:Bad Analogies Abound

[SatanicPuppy]

Well, I agree and disagree. Part of our monkey brain loves explosions, and all of our brain longs for concrete things. So a mass of statistics won't wake in the average person the sort of pure dread that a few pictures or a grisly story, will. The media has latched on to this, and now provides a non-stop cycle of abductions, explosions, and product-scare stories, and so the non-abstract-thinking average joe or jane decides that all there is in the world is these types of events, completely missing the point that these events are vanishingly uncommon, and only seem common because they are hilariously over-reported.

I think, in a way, we are wired to appreciate concrete stuff. It'd be hard not to be, on a lot of levels. A lot of how our brains work is absolutely dependent on that sort of perception.

On the other hand, we are all capable of abstract thought. It's unfortunate that this is not really wired into the emotional nerve center of most people, and it is definitely something that needs to be nurtured and cultivated in the population at large. I have no idea how this could be done.

Re:Bad Analogies Abound

[Anonymous Coward]

The only place where I think he's totally off base is calling the brain "a patchwork". It's not, in fact. It's extremely finely tuned to do what we need it to do. You're both right. It's an extremely finely tuned patchwork.

Look at something basic like the visual processing subsystem. Think of all the optical illusions you've seen (or use google if you need some more). Our brain's software has bugs in recognising even something as simple as a moving coloured square, which shows that it has serious fundamental flaws. But at something like spotting a tiger in tall grass, it's red hot - far better than any synthetic object-recognition software that we're likely to write for some time yet.

Our brains are like software that has been through several million testing/patch cycles. Except that the patching stage is carried out by randomly modifying the code, usually introducing other bugs - which, if they're not critical in the default user environment (of an African village), will generally go unfixed.

Re:Bad Analogies Abound

[smellsofbikes]

>>Exaggerate uncommon risks -- for example, air travel is safer than cars but because car accidents are common they are seen as less risky

>Maybe because everyone involved in an air plane crash usually dies. Automobile deaths are much less. There's this idea of risk = probability * impact. In the case of automobiles, probability is high but the impact is low. It's the other way around in aircraft failures.

That's actually exactly what he's talking about: risk = probability * impact. The problem is if the probability is 0.2 and the impact is 0.2, people unconsciously assume that it's not as bad as something where the probability is 0.000000001 but the impact is 1.0 -- because they're primarily basing their decision on the perceived value of the impact, not on the probability*impact product. As Schneier has said elsewhere, if you read about it in newspapers it probably isn't dangerous. It's the things that are so common they aren't news, that are the dangers you need to worry about, because those are the ones you're very likely to face.

By the way, most airplane crashes aren't fatal. Go to the NTSB aviation accident database and do some lookups on any year you care to choose. Most big commercial jet crashes have high fatality rates but the majority of crashes are small planes carrying 1-4 people and the majority survive. Like the people who are only looking at impact but think they're looking at risk, you're talking with your heart and not your mind when you say that most airplane crashes are fatal. They're not. The public perceives that they are. That's because the public is lousy at risk assessment.

Re:Bad Analogies Abound

[Vellmont]

I just think it's a poor way of stating it...It lets people off the hook. It's not their fault, they're insufficiently evolved.

That's a value judgement you made, not an inherent part of the argument. I don't that viewpoint being expressed anywhere but in your post.

the reason for this is that the body has an instinctive risk-response for things that pose immanent danger, and it doesn't have an instinct for things that pose potential or hypothetical threats.

I strongly disagree. What's not potential or hypothetical about the risk of walking around alone at night in a bad area of town? All risks are potential or hypothetical until they actually happen.

Re:Bad Analogies Abound

[phliar]

Maybe because everyone involved in an air plane crash usually dies.

Not true. It's a little hard to compare stats between driving and flying... (And then there's the whole matter of whether or not you include the numbers from Sept 11 2001.) For fatal crashes (accidents in which at least one person died) you have a 35% chance of death. And that doesn't even count the non-fatal accidents.

Think about the horrific crashes where many people lived -- the Sioux City crash following complete loss of hydraulics (there was an actual fireball!), or the Aloha "convertible" 737. The fact is that airline pilots super-skilled and super-trained; there is just no comparison between the average airline pilot and the average car driver. Ditto maintenance on the average car vs. the average airliner.

Of course there are exceptions like those drunk Southwest pilots, or ValueJet maintenance. But when you consider the number of flights every day, those are lost in the noise.

(My own anecdotal evidence: I do not personally know anyone that has been in an airliner accident, but I do know people that have been in (and died in) car accidents, motorcycle accidents, ski accidents, and "small plane" accidents.)

Re:Bad Analogies Abound

[Maxo-Texas]

Some perfectly smart people do not experience fear.
Other perfectly smart people experience joy instead of fear in situations that most of us are afraid.

Being afraid or enjoying danger are not factors of intelligence tho I admit some people are too stupid to know they are in trouble until it is too late or they may not recognize something is dangerous like a live wire.

Re:Bad Analogies Abound

[cytg.net]

you can remove the quotes around

'goes live,'

in

You can't compare the brain to software. We can control software and decide when it 'goes live,' there are no prototypes in nature or evolution.

- and once it goes live .. it's pretty much alive ..

Re:Bad Analogies Abound

[E 99]

Schneier's point is that the modern world has changed a lot faster than our brains are able to, and as a result, we're maladapted for some of the tasks facing us today, like assessing remote risks.

Well, I think he's clearly wrong. I think the same faults in assessing risks would have been present in East Africa 100,000 years ago... Over-emphasizing the risk of being eaten by a sabre-toothed cat and under-emphasizing the risk of being axed in the head by a romantic rival. The true absurdity of his argument is that this makes the brain an inferior design to a computer. In reality the brain and the computer have radically different functions, and by comparison both the function and the design of the computer is ridiculously trivial.

Re:Bad Analogies Abound

[jagdish]

An exit-door procedure at 30,000 ft. The illusion of safety. Emergency water landing, 600 miles per hour. Blank faces - calm as Hindu cows.

Re:Bad Analogies Abound

[Lurker2288]

First, I don't see how you can argue the fact that the world changes faster than our brains can. Evolution is a long, slow process, and the modern world hasn't been around nearly long enough for appropriate reactions and behaviors to become hard wired yet. Humans are more resilient to rapid change than, say, hamster, because we have much less inborn, instinctive behavior and much greater capacity to learn and develop. But the more the world changes, the more out of step our instincts become, and the more important our learned experience becomes.

And the comment about brains and computers at the end has nothing to do with the rest of his argument. There are lots of things computers can do better than human brains--doesn't mean brains are inferior. So what point are you trying to make?

Re:Bad Analogies Abound

[Web Goddess]

Thanks for a (finally) intelligent comment on an interesting topic. We have evolved instincts that DO protect us from ancient dangers -- such as children becoming picky eaters at the time they are able to toddle away from their parents.

Many of our evolved instincts are very beneficial in small communities, yet exploited to bad ends by the advertising industry. We should trust our elders, they know what is dangerous! But we should not trust an old fellow on TV touting a product. We should avoid doing things that killed a friend! But we should not necessarily avoid things that kill the occasional random schmoe out of billions but are widely reported in the news media; the one-man or instance-of fallacy.

Our brains, like our bodies, evolved to help us survive. However, cultural change is so rapid now that these honed-over-millenia instincts are no longer sufficent.

Fortunately, education can train us in behaviors that are not instinctive. Witness Schneier himself.

Cultural adaptation is an evolved characteristic, and optimistically, I think it will be sufficient. Education is the solution to surviving until our brains catch up.

Wendy

Re:Bad Analogies Abound

[mikael]

And their are many variations in many models. A good example of this is the experiment where people were asked to mix two colors (red and green) so that the resulting mix matches a particular shade. Based on the type of genes used to encode the opsin molecules used for perceiving light, different responses would be made in the visual system. This was predicted by comparing DNA samples against the experiment results.

Re:Bad Analogies Abound

[Artifakt]

You can clearly see the human brain has some compartmentalization, with structures that seem superficially the same as older structures underlying more moder ones. What takes more analysis is to see where the older structures simply have to be retrofitted with adaptations that make them deeply compatible with the newer ones.
        For example, human speech probably evolved over the last million years or less (I'm being generous by most biologists opinions - now that the best estimate for a common ancestor between humans and chimpanzees has been pushed back to 7 million years, a full million for speech no longer seems like it's pushing the available total time, but there are plenty of evolutionary biologists who would stick with estimates as short as 200,000 years). In the newer brain, complex centers built up, allowing simpler proto-speech, with only protonouns or command sounds, to incorporate modifiers such as clear verb-noun distinctions, and eventually tensed verbs, as well as adjectives, adverbs and such. All human language ends up with things in common, because they are hardwired.
        What's not as obvious is that the very most primitive centers of the brain had to be modified, so that breathing could better facilitate speech. The human ability to use the last bit of air in ones lungs to gasp out a warning is a small demonstration of how one of our deepest brain structures evolved quite a bit in recent times. Those structures were only recently found, after being predicted by the argument I just gave and others. There are many other cases like them, but these things don't change the large scale appearance of the older brain enough to be at all obvious before actual electrical mapping of the living brain was developed.
        Essentially, whether this is a 'patchwork' is a question of which methods we use to study the brain.

Re:Bad Analogies Abound

[Agripa]

The only place where I think he's totally off base is calling the brain "a patchwork". It's not, in fact.

Hell! Whoever did the design did not even know enough to use backface illumination on the attached CCD array and ran all of the metalization traces along the front of the retina! Take a look at a cephalopod eye to see how it should have been built. To the designer's credit however, they used channel routing in the primate designs which raised the active capture area for better performance but that just shows another level of patchwork engineering. I can understand it though. What are you going to do when stuck with an already working in production design by a contractor who has left the scene and management wants improvements immediately? The DSP color correction for the chromatic aberration caused by the complex index graded curved lense was a pretty clever fix at well.

It's extremely finely tuned to do what we need it to do

I completely agree with this and the rest of your post.

Re:Bad Analogies Abound

[igb]

(because you don't worry about stranger kidnappings as much as car accidents

If you're worried about harm to your children, it's cars, stairs and hot liquids, not necessarily in that order. Everything else is in the noise floor. If you're worried about sexual abuse of your children, tell your ex-wife to stop leaving your pubescent daughter with her boyfriend: everything else is in the noise floor. Etc.

Re:Bad Analogies Abound

[ErroneousBee]

The evolution argument is disproven by Schneier himself; how could he be thinking about it if we hadn't already evolved to make it possible?

Schneiere isn't humanity, he's just Schniere.
Anyway, I think you're trying to take his comments too far. It seems to me Schneire's ideas are really more of a way of thinking about why people are bad at assessing risk rather than a predictive theory that can be picked apart and examined.

The correct spelling of Bruce Sniers's name is based on a constantly changing one time pad that hasn't been created yet.

Re:Bad Analogies Abound

[duffbeer703]

Bruce is full of shit, but you need to consider that he's speaking at the RSA conference, and most of the attendees are corporate security policy wonks, whose jobs are mostly horseshit.

I think people take certain cues and translate them into a "risk level" automatically. Let's look at two examples: fear about flying and computer security.

Many people worry about airplane safety. Let's think about why:
  - Few people survive airplane crashes
  - Nearly every airline is at or near bankruptcy
  - People hear all of the time in the media that airline employees are taking pay reductions.
  - Airlines systems are fucked up; planes are late, the airlines act arbitrarily, they don't care about customer satisfaction

So if I'm a little anxious to be strapped into a 22 inch wide seat in an aluminum tube for 5 hours, and I'm stuck in an airport for 8 hours because the flight was overbooked or there was a thunderstorm 2,000 miles away, I'm going to be nervous. Why would I expect maintaining a complex machine is done right when everything else is fucked up?

Computer security ranks low, not necessarily because people are ignorant of the risks, but because they don't perceive any danger from them. If someone steals your credit card info, who cares -- you're not liable! If there's a botnet spewing spam from my PC, who cares... there's minimal impact to you.

Re:Bad Analogies Abound

[tehcyder]

The evolution argument is disproven by Schneier himself; how could he be thinking about it if we hadn't already evolved to make it possible?

Schneiere isn't humanity, he's just Schniere. One guy can have the skills and ability to do something, while the vast majority of others do not. Anyway, I think he's really trying to say that risk assessment of the modern world doesn't come naturally to people, like it did to risk assessment of being eaten by a tiger 100,000 years ago. I don't know if the evolutionary theory about risk assessment is right, but I really doubt you do either. Neither of us have any data to show much of anything. Anyway, I think you're trying to take his comments too far. It seems to me Schneire's ideas are really more of a way of thinking about why people are bad at assessing risk rather than a predictive theory that can be picked apart and examined. The ideas aren't really well developed enough for that kind of assessment.

Is this some elaborate joke, or did you really just misspell someone's name three different ways when you had quoted the correct spelling originally?

Re:Bad Analogies Abound

[Altus]

While it is true that you are more likely to be killed in a taxi or bus accident I think the chance of the accident needs to be taken into account.

People survive taxi and bus accidents all the time, but they happen a lot and some are fatal. The perception is that if you are in a plane crash you are dead (I dont have survival numbers handy but I think this is what most people imagine) while most people believe you have a non trivial chance of surviving a car crash.

I think its the perception of certain death that makes plane crashes more scary even if they are less common.

Re:Bad Analogies Abound

[tehcyder]

humanities tendency to poorly conceptualize risk

Humanity's.

"Humanities" means the study of non-scientific subjects such as English or History. I genuinely read your statement as criticising non-scientists at first, until I worked out what you were trying to say.

This is not a grammar Nazi post, as otherwise I would have mentioned the split infinitive...

Re:Bad Analogies Abound

[Lurker2288]

Put perfectly. That's exactly what I was trying to convey previously.

Re:Bad Analogies Abound

[adamofgreyskull]

If we weren't competitive, we wouldn't have problems. The fact that not everyone works at the same level is irrelevant.

Nor to the same end.

Re:Bad Analogies Abound

[eison]

Really good point about taxis, I hadn't thought about those. Thanks.

It's the money

[ZonkerWilliam]

As a INFOSEC person, I see this kind of mentality on a daily bases. Still, there is a realization of the costs of outages due to attacks and that I see. Slowly but surely it's changing. Compared to evolutionary changes tho, it's a blink of an eye.

Stupid.

[SatanicPuppy]

We're not evolved for space flight either. You can't apply "evolution" as a blanket to tool use at the level we've taken it; we have evolved a capacity for abstract thought which allows us to create highly complex tools...Saying that we're not evolved to assess risk on a level as abstract as this is disingenous...When was the last time a virus jumped out of your computer and ate you? There is no evolutionary pressure involved with such intellectual pursuits.

It's perhaps more accurate to say that only a few people are capable of truly understanding this stuff at all, and for the rest it's just black magic. Of course they don't appreciate the risk. I guess B.S was trying to find a rational reason why people just categorically don't understand security when applied to technology, but I think it's more just that they're doing well to be able to use the tech at all. We're going to have to have a lot higher skill level among users before we can expect them to truly appreciate security.

Re:Stupid.

[aztektum]

I haven't read the article yet, but I have a feeling your comments would echo my own. I'd add too that, it's not that your average user can't grasp the concepts, but they haven't been "conditioned" to. We fall back on what we know and Windows, as the OS with the most penetration, has worked for over a decade without requiring gramps and auntie em to jump through hoops.

Trying to change the mindset of millions of users is not something that will happen over night.

Re:Stupid.

[tkinnun0]

We're not evolved for space flight either. Yet millions of people go to space everyday? Or perhaps a space flight to the ISS requires months of preparation precisely because we truly aren't evolved for space flight.

Re:Stupid.

[SatanicPuppy]

And that means what, exactly? We're evolved for tool use, and our tool use has grown so evolved that we're creating tools that surpass the conception of most members of our species. Does that mean that they need to evolve up to be able to create those things themselves? Not at all. It's a societal division of labor. Someone has to clean the telephones.

A biological population will have many individuals who have differing levels of skill at different tasks. A species as diverse as ours has a great many roles, and not everyone can be a specialist at every role. Saying that, because most individuals can't do X we're not evolved to do X, makes no sense. Clearly we are evolved to the point where some people can do it, and everything from there on out is just differences in individuals.

What he's hypothesizing is a type of Cognitive Closure, and while I had classes with McGinn, and he's a hell of a guy, I don't think that the answer to the question is that people simply aren't able to think about this kind of stuff. The fact that most people choose not to think about it, or are ignorant of it, is not the same as us being unable to think on those terms as a species.

Re:Stupid.

[timeOday]

When was the last time a virus jumped out of your computer and ate you? There is no evolutionary pressure involved with such intellectual pursuits.

Wow, it sounds like you're in violent agreement with Schneier; he said evolution didn't prepare us for computer security, you agree, then you call him stupid for saying it.

Anyways, these days mortal combat is now primarily an intellectual pursuit, because technology dominates. Usually nowadays we wage war by economic sanctions, which can kill just as many people as bombs. When we do apply violence, those without technology die like flies. Look at Vietnam and the Iraq war: the fact that we're angry and surprised when we achieve only a 5:1 or even 50:1 kill ratio only confirms the primary role technology plays. Disagree? Wake me up when the tables turn and low-tech nations from half way around the world paddle over the pacific ocean and conquer Washington DC with swords and spears. Nope, it's (still) all about technology.

Re:Stupid.

[maxwell demon]

When was the last time a virus jumped out of your computer and ate you?

You'll get a very biased result here. Those who've been eaten by a computer virus won't be able to answer here. And even if they could, they wouldn't admit on Slashdot that they got a computer virus.

Re:Stupid.

[arbitraryaardvark]

Wake me up when the tables turn and low-tech nations from half way around the world paddle over the pacific ocean and conquer Washington DC with swords and spears.

As I recall, they used boxcutters and knives. September ended, you can wake up now.

Anyways, these days mortal combat is now primarily an intellectual pursuit, because technology dominates.
- obscure junpai/ largo reference -
-1 troll.

Re:Stupid.

[jez9999]

Anyways, these days mortal combat is now primarily an intellectual pursuit

Is there really anything intellectual about ripping a guy's head and spine off?

Re:Stupid.

[timeOday]

As I recall, they used boxcutters and knives.

Destroying a few buildings is a ridiculously far cry from overthrowing a nation. We can destroy buildings in other nations with the push of a button - and we have, thousands of times over.

Re:Stupid.

[lawn.ninja]

I think we should all just agree that most people are bad at any type of security. They dead bolt their doors but ignore the stranger in the elevator. People react to stimulus; brains react to stimulus. It is the reason magicians can pull tricks on someone that is so intently watching for the trick. The key here is that no one would know what it looked like if they saw it; not the magician's trick or the security breach. Everyone thinks a hacker is some geeky kid in his basement. Not the radiologist down the hall or the guy sitting in the cube next to you... When in fact most of the time it is the guy next to you. The real underlying problem is the idea that something always fits into a nice tidy catagorized box. Until people realize that the box is part of the trick history will continue to repeat itself.

Re:Stupid.

[QuietObserver]

I won't argue your point, primarily because I agree wholeheartedly, but taking a number of inventions that have been patented, it's equally possible to argue that some people are creating tools that surpass the stupidity of most members of our species as well.

Re:Stupid.

[Agripa]

You can't apply "evolution" as a blanket to tool use at the level we've taken it; we have evolved a capacity for abstract thought which allows us to create highly complex tools...Saying that we're not evolved to assess risk on a level as abstract as this is disingenous...

We have evolved to assess risks in the environments that we spent time evolving in. This is so much the case that specific physical brain structures are devoted to handling specific aspects of those ancient and evolutionarily significant environment of 100,000 years ago and earlier. Modern society has changed so rapidly that many of these facilities can no longer be relied on for reliability.

Our ability for abstract thought allows us to train ourselves to assess modern security threats accurately but it requires specific training toward that end.

When was the last time a virus jumped out of your computer and ate you? There is no evolutionary pressure involved with such intellectual pursuits.

That is Bruce Schneier's point. There has been no evolutionary pressure for humans to develop specific facilities to accurately gauge and respond to modern security threats. Those things now have to be learned in the same way one would have to learn to read and write as opposed to how one can learn to speak and listen during childhood. The later proceeds through the use of imprinting and the former requires artificial training.

Microsoft causes evolutionary regression

[slashdotlurker]

Finally, its official. 'nuff said.

We don't need to evolve

[Lucas123]

In many ways, we need to go back to square one. We need to teach ethics to the younger generation. Hackers and phishers will always remain one step ahead of the security community in developing new methods to bypass security measures. The problem is, we should have to erect so many virtual walls. The real question we should be asking ourselves is: why is this behavior acceptable -- even lauded at times?

Re:We don't need to evolve

[SatanicPuppy]

I would argue that there is no "evolution" that we can make as a species that will cause this problem to go away...It's a problem of software, not hardware.

Teaching people ethics isn't going to help though...If we could just teach everyone to be nice, we'd have done it a long time ago. Millenia of evolution have taught us about competition for scarce resources, and that expresses itself in all kinds of anti-social behaviours, and it always has. Sure, the instinct to protect the herd is in there as well, but I'd argue that we've been a lot more successful at suborning that instinct. In many people it only seems to express itself in times of extreme stress.

Re:We don't need to evolve

[pla]

We need to teach ethics to the younger generation.

Which will accomplish what exactly?

You can't make everyone into a paragon of virtue, no matter how hard you try. And it only takes a few to prey on the rest (reducing the number of scammers would just increase the profitability per scammer).



why is this behavior acceptable -- even lauded at times?

Because the same behavior in other contexts has largely beneficial effects (even though it offends the establishment - Though that in a way makes it more, not less, desireable).

The same cryptographic skills that let Random Bad Guy get into your bank account also let DVD-Jon defeat various mechanisms for denying people unfettered access to content they have legally purchased. The same firewall piercing technology that allows botnets to work from a home LAN also allow VOIP and most online games to work behind a firewall.

Re:We don't need to evolve

[melikamp]

I would argue that there is no "evolution" that we can make as a species that will cause this problem to go away...It's a problem of software, not hardware.

I completely agree. And it seems to me that humans are not under pressure here. Let computers worry about the security. Unlike us, computers are perfectly evolved to perceive, understand and manage the risks of the net. And when they learn to emote, they will also care about their security to the extend we never will.

so what?

[AxemRed]

We aren't specifically evolved do algebra either, and we (well, many of us) do a decent job at that. Humans are evolved to learn and adapt.

Re:so what?

[apt142]

Well some of us can adapt. Some of us are just dumb.

Go down you local street corner and see how many people can solve the simplest of equations. I'm guessing you wouldn't get a high percentage of people who could. And we've been teaching algebra in schools for a long time. It's a requirement in my state to pass Algebra to graduate high school.

Re:so what?

[kebes]

We aren't specifically evolved do algebra either, and we (well, many of us) do a decent job at that. Humans are evolved to learn and adapt.

Absolutely. But Schneier's point is not that it is impossible for humans to think rationally about IT security, but that it does not 'come naturally' to the average person. The same is true of algebra and other branches of mathematics: humans in general have very advanced knowledge in these areas, but it is still quite easy to construct a mathematical problem that will trip up a layperson, because most people are not formally trained in mathematics, and will incorrectly invoke "common sense" when solving a problem.

The fact is that humans have an in-built "threat and probability analysis" system that was optimized to deal with "real world" situations like searching for food, avoiding predators, finding mates, etc. It is for this reason that gambling "works." People are easily tricked into believing that they can "beat the system" or "find a pattern." They believe that having rolled many sixes recently, they are "due for a 1 or a 2" even though the probability of rolling a particular number on a die is independent of previous rolls. This is because most of our in-built probability estimators assume chains of events are causally linked (which is a reasonable assumption in the "real world"--i.e. if it's been a long time since it has rained, it is indeed "due to rain soon").

In the realm of security, Schneier identifies certain assumptions that our minds make, which are actually fallacies when it comes to modern security (e.g. that a commonly occurring risk is less important than a rare risk).

We are not "built" to deal with modern security. As with advanced math, rather than rely on common sense (and its associated useless rhetoric) to set security policy, we need to have detailed arguments citing well-documented studies. We can indeed rise above our "programming," but far too many people don't bother trying--and continue to rely on common sense even when it is a demonstrably poor predictor.

Re:so what?

[apparently]

Go down you local street corner and see how many people can solve the simplest of equations

Well, for any equations where the solution is "go fuck yourself!", "I got somethin' you can solve, sugah!", or "no seriously, go fuck yourself" the subjects in my test study pass with flying colors.

Re:so what?

[DerekLyons]

But Schneier's point is not that it is impossible for humans to think rationally about IT security, but that it does not 'come naturally' to the average person.

OTOH - Schneier has a vested interest in supporting that belief. Without generating fear, he can't get consulting gigs. Without generating controversy, his value as a pundit and speaker goes down.

Re:so what?

[gclef]

...And some of us are apparently not terribly well-evolved to see the problem with ad-hominem attacks, either.

Re:so what?

[DerekLyons]

And some of us are apparently not terribly well-evolved to tell the difference between an ad-hominem attack and facts.

Re:so what?

[grumling]

Actually, we are built to deal with security. You dog, however, may have some problems getting along with it. The reason is because fido's brain isn't as far along as yours. It only deals with emotions and autonomic responses to the world. You brain, however, is able to ignore these responses and (usually) accurately assess the situation. But only if it chooses to.

You are right, people who gamble are not thinking rationally. They are using simple reenforcement methods to justify to continue to gamble, and calling it probability. If these people were truly playing the odds they'd never pick up the dice to begin with. The casinos know this and kick out the people who know how to beat the odds out when discovered (such as card counters).

Re:so what?

[Chris Burke]

They believe that having rolled many sixes recently, they are "due for a 1 or a 2" even though the probability of rolling a particular number on a die is independent of previous rolls.

My goodness, this is simply untruth! While it may be so in the white halls of academia, where such things as "fair dice" and "independent events" are bandied about as though they actually exist in their perfect mathematical forms, it isn't so in the harsh reality of the craps table! Allow me to explain. You see, when you roll a die and it lands as a six, this means that the one side is facing down. While bouncing and rolling each side of the die will contact the table only momentarily, but just prior to stopping the die will have one side contacting the table and will move ever so slightly until friction eliminates its remaining kinetic energy. This friction creates heat on the one, which is held in by the felt table, while the six is facing up and exposed to the air currents and thus is cooled. As hot objects expand and cool objects contract, and a less dense object is more buoyant than a dense one, this creates a natural tendency for the subsequent roll to favor landing one-up rather than six-up. Successive rolls of six will only increase this heat differential. So you see, the gambler's intuition is correct that they are "due" for a one as the odds every increasingly push the die in that direction.

I have myself used this fact to acquire vast sums of money from casinos, to the point where I was able to purchase a casino myself. You should come and visit and play at my craps table. I'm sure with my the knowledge I've given you, you will soon be buying the casino from me!

Re:so what?

[Agripa]

I have myself used this fact to acquire vast sums of money from casinos, to the point where I was able to purchase a casino myself. You should come and visit and play at my craps table. I'm sure with my the knowledge I've given you, you will soon be buying the casino from me!

You had me going for a second but having already sold my casinos, I recognized your ploy.

Re:so what?

[Agripa]

I do not particularly disagree with the general point of your post however:

. . . Your dog, however, may have some problems getting along with it. The reason is because fido's brain isn't as far along as yours. It only deals with emotions and autonomic responses to the world. You brain, however, is able to ignore these responses and (usually) accurately assess the situation. But only if it chooses to.

Fido's brain is just as evolved as ours. It has evolved for the aspects of the environment which dogs interact with and live in.

Re:so what?

[noidentity]

"We aren't specifically evolved do algebra either, and we (well, many of us) do a decent job at that. Humans are evolved to learn and adapt."

I'd say we evolved what is now known as algebra so that it would be a good fit for us.

Re:so what?

[rabiddeity]

This is because most of our in-built probability estimators assume chains of events are causally linked (which is a reasonable assumption in the "real world"--i.e. if it's been a long time since it has rained, it is indeed "due to rain soon").

Interestingly, that is an equally poor assumption that was shared by the Tiwanaku and Pueblo peoples. I'd expect these same people thought, "It hasn't rained for a long time, so it must rain soon." In the real world, that is a bad prediction.

The field of statistics is one of humanity's greatest mathematical achievements, but it's worth a reminder that our "common sense" often directly contradicts it without us even realizing it, often with disastrous results.

Re:so what?

[geoskd]

We aren't specifically evolved do algebra either, and we (well, many of us) do a decent job at that. Humans are evolved to learn and adapt.
We do a spectacularly bad job of it. Considering our brains operate at levels that are capable of processing and interpreting many high resolution frames per second, while intermixing this information with 4 other primary senses across tens of thousands of simultaneous channels, it should not take so long to do simple algebra. If we were really more than marginal for that kind of thing, we would describe the process as "intuitive", and we would know the answers a soon as the question could be framed. Furthermore, we will not evolve these abilities, because there is not enough survival advantage to this knowledge.

The only way for humanity to evolve their intelligence much beyond the point we have reached, is for stupidity to be fatal. Unfortuantly, we go to great lengths to avoid exactly that situation.

-=Geoskd

Re:so what?

[Von Helmet]

Ironically, my complaint with your post would be the mechanics of the die landing one up, when you've just argued that the one will be broader due to the alleged heat and the six narrower. Surely the die would be still further inclined to keep coming up six?

Re:so what?

[tehcyder]

I have myself used this fact to acquire vast sums of money from casinos, to the point where I was able to purchase a casino myself. You should come and visit and play at my craps table. I'm sure with my the knowledge I've given you, you will soon be buying the casino from me!

Oh sure, like I'm falling for that one.

Again.

Smith

[pete-classic]

"Only human."
--Agent Smith on IT security

Re:Smith

[kalirion]

That's right. To correctly estimate an IT risk you must have a squiglyspooch.

Re:Smith

[Anonymous Coward]

"Dodge this."
--Trinity on the ability of software security to defeat a determined human attacker

Phhhh ...

[foobsr]

... if it really must be Schneier, read: "Why the Human Brain Is a Poor Judge of Risk" ( Wired ), but better immediately turn to Kahneman .

CC.

oversimplified

[sharp-bang]

I disagree with the use of the term 'evolution' to discuss the inadequacy of emotional responses to threats. People can be successfully trained to overcome these issues. As a security professional, I know my spidey-sense has altered considerably over the years due to training and experience, and I would think that others in fields where risk assessment is all in a day's work have largely had the same experience, and, to a certain extent, this is extensible to the population at large. (For example, I find that younger employees are typically a lot more savvy about safe online usage than older employees, which is not a matter of evolution, but acculturation to technology.) The evolutionary advantage of rationality outweighs the primacy of fight-or-flight responses in trained individuals.

This looks to me like another misquoted/misunderstood Bruce Schneier sound bite. Not much to see here.

daphuture

[cthulu_mt]

I'm estimating my risk in an East African village 100,000 in the future. Forget about London.

Well...

[Estanislao Mart�nez]

Schneier is neither an evolutionary biologist nor a neuroscientist. Why is his bad opinion on these matters news?

Re:Well...

[Samgilljoy]

I'm glad someone made a note of this. Here's the crux of the matter. You see how he and many others love contrasting "reality" with the lay person's misconception thereof? Unfortunately, far too many people who have dedicated their lives to certain subjects don't understand that, when it comes to non-technical matters, they are themselves "lay people." You see so many absurd, ignorant, overly simplistic, and methodologically juvenile theories about society, history, religion, natural language, etc. from certain quarters of the professional world. Not that there are not plenty of sensible people, but sensible people aren't usually so in love with their own ideas that others are make aware of them regularly.

because people want the easy way

[hobo sapiens]

People want the easy way. Security and "the easy way" are often at odds.

Case in point...I was in a hospital ER the other day, waiting in the room (for a very long time), and I looked at the computer in the room. I noticed that someone affixed a sticker to the keyboard tray with (presumably) the windows domain login info. Had I wanted to, I could have logged in and probably gotten to all kinds of medical records. Someone from the hospital's CIS department would probably poop a brick if he saw that.

People are lazy, and security folks constantly have to toe the line between making things hard enough to be secure but not so hard that it's just easier to find the loopholes.

Re:because people want the easy way

[Jasin Natael]

I can one-up you on that. I recently saw a security system control panel with the four-digit PIN code written in permanent marker on the plastic housing near the LCD display, and clearly labeled as such: "Security Code: 1-1-1-1". To make it even worse, the panel directly faces the unreinforced glass doors used for the business's main entrance, and is clearly legible from outside the building.

Re:because people want the easy way

[blhack]

And that is why it SUCKS to be the person in charge of security for a domain. Make the security too harsh and the users complain (with good reason) that they can't get anything done. Make things too lax, and you turn into an alcoholic schitzophrenic who does nothing but sit at home in the dark murmering about exploits and unencrypted telnet sessions that your entire company runs on, and how even the software providers out in north carolina won't implement SSL into their software because all of their programmers are from the 1970s even the guy who supposedly "knows-linux" and wants to run gentoo on the soekris box that you sent them to use as a firewall; you sit there alone, and paranoid that some russian script kid, or 14 year old digg user wanna-be l33t-sausage hack-zore is gonna come accross a username/pass and burn your precious servers to the ground!

The relation between beer/security can most properly be illustrated by this graph

Re:because people want the easy way

[Von Helmet]

If you're saying that IT security implementation causes beer consumption, then your graph is the wrong way round. The dependent variable goes on the axis, not the abscissa.

Re:because people want the easy way

[Cally]

I'd like to see a time series of this, showing the changing curve as experience accumulates. Either way round.

Thanks Bruce, but call us when you're qualified

[SIIHP]

"Originally from New York City, Schneier currently lives in Minneapolis, Minnesota. Schneier has a Master's degree in computer science from American University and a Bachelor of Science degree in physics from the University of Rochester. Before Counterpane, he worked at the United States Department of Defense and then AT&T Bell Labs."

I don't see anything about "behavioral psychology" or "evolutionary biology" in there.

So, sorry Bruce, but you're not qualified to make that statement with any authority, and frankly, your position as an expert on security should make you more wary of voicing lay opinions about subjects in which you have no expertise.

Re:Thanks Bruce, but call us when you're qualified

[NeutronCowboy]

So, sorry Bruce, but you're not qualified to make that statement with any authority

You're making the mistake of judging the validity of a claim based on the person's authority. Even Wikipedia, your favorite source, has info on that. Just make sure to read the article in its entirety. Your comment would in fact be far more helpful if it would actually dissect his theory. Because, quite frankly, if we're going by authority is the prime criterion for when anyone should say anything, you'd only be allowed to talk about the lint in your navel.

Re:Thanks Bruce, but call us when you're qualified

[spottedkangaroo]

I AM A FULLY QUALIFIED BEHAVIOR ANALYST.

Welcome to my sig.

(I'm posting this part because the lame "lameness" filter won't let me post a direct quote.)

Re:Thanks Bruce, but call us when you're qualified

[SIIHP]

Are you? In some places it's illegal to claim you are if you aren't. Be advised.

Re:Thanks Bruce, but call us when you're qualified

[DerekLyons]

So, sorry Bruce, but you're not qualified to make that statement with any authority, and frankly, your position as an expert on security should make you more wary of voicing lay opinions about subjects in which you have no expertise.

Don't forget that his paycheck depends on him voicing unfounded opinions and creating fears where none existed before. Without generating fear, he can't get consulting gigs. Without generating controversy, his value as a pundit and speaker goes down.

Re:Thanks Bruce, but call us when you're qualified

[ifoxtrot]

I don't usually respond to negative posts, but this is something I feel quite strongly about:

1. You don't have to have a qualification in something to know enough to make an enlightened statement about a particular subject. If we were to restrict talking about the weather only to meteorologists, small talk would vanish overnight. In a more serious vein, interdisciplinary research would be even more difficult than it is now. Imagine having to have a qualification in both psychology and security to be able to publish research into this?

2. A qualification is simply a piece of paper that has been accredited by some educational body, presumably recognising a standard of education in a particular field. Just because you don't have the piece of paper doesn't mean you don't have the knowledge. How do you know that Bruce Schneier doesn't, in fact, know as much (or possibly more) about evolutionary biology or behavioural psychology than yourself? Does the fact that I haven't studied engineering preclude me from having insightful discussions with an engineer? Do my opinions matter less because I don't have the degree? Does the fact that I have a PhD in computer security (and you presumably don't) mean that any opinion I state on the subject is somehow more valid because I hold the qualification and you don't?

3. Bruce Schneier is eminently qualified to make statements about security (which is afterall a central aspect of his thesis). He has been conducting extensive research into psychological aspects of IT security (you can see a draft essay on the topic at http://www.schneier.com/essay-155.pdf). This research has included long discussions with psychologists and serious reviews of the literature. I would content that there are very few people on this planet that are truly as knowledgeable in both security and the psychology of security as Bruce Schneier is now. I would be equally interested in the views of a psychologist who undertook research into security -- I know only of a handful that have done so, and none have the particular angle that Schneier has adopted.

4. That is not to say that everything the Schneier is saying on the topic is faultless, or that I agree with everything he says, but I'll debate the ideas, not the man. I personally find it objectionable to anthropomorphise an evolutionary process, or talk about the intent of evolution. But what do I know, I don't have a degree in evolutionary biology...

Re:Thanks Bruce, but call us when you're qualified

[SIIHP]

I think the problem with your statements in general is that he is portraying himself as an expert in one field and using said expertise in that field to, incorrectly, gain acceptance of his ideas in another field.

With that in mind, your statements simply don't matter.

You see "argument from authority" but that's because you're not bothering to see the real objection, and simply jumping on the oh so typical slashtard bandwagon.

I hope you see now why that long winded reply was wasted, it simply doesn't address my point at all.

Re:Thanks Bruce, but call us when you're qualified

[Scrameustache]

"Originally from New York City, Schneier currently lives in Minneapolis, Minnesota. Schneier has a Master's degree in computer science from American University and a Bachelor of Science degree in physics from the University of Rochester. Before Counterpane, he worked at the United States Department of Defense and then AT&T Bell Labs."

I don't see anything about "behavioral psychology" or "evolutionary biology" in there.
So, sorry Bruce, but you're not qualified to make that statement with any authority Your appeal to authority is duly noted.

A fundamental reason why the Appeal to Authority can be a fallacy is that a proposition can be well supported only by facts and logically valid inferences. But by using an authority, the argument is relying upon testimony, not facts.

Re:Thanks Bruce, but call us when you're qualified

[ifoxtrot]

I think the problem with your statements in general is that he is portraying himself as an expert in one field and using said expertise in that field to, incorrectly, gain acceptance of his ideas in another field.

Of course he isn't -- he's presenting the results of research he's conducted on the topic of the psychology of IT security. I believe the target audience is not behavioural psychologists, but in fact security experts who don't realise the intricacies of the problem.

If you can show me evidence of where he's trying to "gain acceptance of his ideas in another field", then I may reconsider my position, but bearing in mind this presentation was to the RSA security conference, I strongly doubt there were many evolutionary biologists in attendance.

With that in mind, maybe my previous statements aren't all that irrelevant, but feel free to ignore them if you can't refute them.

Re:Thanks Bruce, but call us when you're qualified

[ifoxtrot]

the crux of your argument is nuh uh, excuse me, "Of course he isn't"

If you are capable of reading what I wrote, you'll see a number of argued points, none of which you have even remotely attempted to answer.

I've wasted enough time on you.

Re:Thanks Bruce, but call us when you're qualified

[PitaBred]

Are you a lawyer now? Because if not, you just gave legal advice without proper education. Shame on you!

Seriously, are you really that dumb? Who is the authority that says "You are now a mathematician!" or "You are now a behavioral biologist!" Where did they get the authority to issue that decree? From, say, learning about it? There's no magic point where you all of a sudden become an expert, no kind of magical thing that just grants expertise. Most definitely not a degree. Everyone who is an 'expert' is there because they learned about the subject. Whether they do it studying on their own time, through introspection of their own experiences, through an accredited degree program or whatever, the outcome is still largely similar. And it doesn't make them any less of an expert unless you can prove their claims wrong.

Re:Thanks Bruce, but call us when you're qualified

[NeutronCowboy]

You know, when even Slashcode tells you to cool your heels, you might want to take that suggestion seriously and spend some time on introspection. But I'm sure your puberty-addled brain is too cool for that. Again, thanks for providing entertainment on an otherwise lousy day.

Re:Thanks Bruce, but call us when you're qualified

[44BSD]

Naturally, I haven't RTFA, but what is this research Bruce conducted? He's pretty well-read in subjects outside his formal training and bearing upon infosec (such as economics, cogsci, experimental psychology), but other than crypto, I am unaware of any original research he's conducted.

Note: I do not consider reading papers produced by Ross Anderson and his students to be "research".

Re:Thanks Bruce, but call us when you're qualified

[spottedkangaroo]

Hahaha...

I claim that I am definitely an authority on behavior analysis. I haven't taken any classes on it, but I definitely am.

Do something about it. Seriously. Go.

No, we are simply taught the reverse.

[Zombie Ryushu]

I don't think thats the case. I think its just that culturally we fear what we don't understand and are being taught to be stupid and proud of it. Biology and evolution have nothing to do with it. We can learn these concepts we just willingly refuse to for religious and ideological reasons.

Re:No, we are simply taught the reverse.

[Chandon Seldon]

I don't think thats the case. I think its just that culturally we fear what we don't understand and are being taught to be stupid and proud of it. Biology and evolution have nothing to do with it. We can learn these concepts we just willingly refuse to for religious and ideological reasons.

Human culture has evolved right alongside human physiology. I'm not sure that there's any benefit to trying to distinguish between them at this level of discussion.

His arguments are logical, but...

[sm62704]

He's a security guy, not a biologist. His list (I must not be well today, I'm actually RTFAs) is correct; e.g., 3000 deaths this century in the US from terrorism and 40,000 every single year on the highways, but OMG ITS TEH TERRAISTS!

However, although he's well versed on security his grasp of evolution is even slimmer than mine, and I'm no biologist, either. The only way evolution would come into play would be if computer security had the effect of killing us before we had children. Clearly, the security of your home PC is NOT going to keep you from procreating. In fact, considering the stereotype of us nerds it's arguable that knowing how to secure a PC is counter to evolution! After all, evolution is all about getting laid.

I'll demonstrate with two real people: me, and a woman I know.

It is possible that I have a lot of kids in Asia I don't know about, but for the sake of argument lets say I only have the two girls that came from my ex-wife's uterus.

Both of my children are living, and grown. Neither has children of their own.

Linda, OTOH, had 14 kids, 13 of which are still alive. She trumps me in the evolution game 13 to 2. I lose, she kicks my ass in the Darwin game. But she can't even boot a computer, and while Bruce Schneider could likely root my box with impunity, I built the damned thing from spare parts.

There is no possible way to "evolve" computer security. Schneider should stick to computers and shy away from fields in which he isn't an expert.

-mcgrew

Re:His arguments are logical, but...

[ObsessiveMathsFreak]

Linda, OTOH, had 14 kids, 13 of which are still alive. She trumps me in the evolution game 13 to 2.

I'm almost certain that this can be shown to be a fallacy. Natural selection is an ongoing process. If you're a one trick pony, in this case, lots of children, then you have many offspring, but they all are more likely to be "specialists" not "generalists", and will be less adaptable.

Any way I note that
a) Linda's large family is less likely to be down to genetic factors than it is to social or cultural factors. and
b)

It is possible that I have a lot of kids in Asia I don't know about

Linda's "mass production" strategy may not in fact be as intensive as your own,

Re:His arguments are logical, but...

[Jasin Natael]

There is no possible way to "evolve" computer security.

Then, it sounds like we need a lethal, compulsory video game with a computer security theme.

Re:His arguments are logical, but...

[sm62704]

If I had mod points today I'd mod that funny, but alas today all my comments are being modded "flamebait" and "troll". The Microsoft, DEA, MAFIAA, and Sony employees must have mod points today. My karma was excellent this morning, it's probably in the shitter now.

Or maybe today's mods are familiar with my old stuff.

-mcgrew

Re:His arguments are logical, but...

[j_166]

"3000 deaths this century in the US from terrorism and 40,000 every single year on the highways, but OMG ITS TEH TERRAISTS!"

I would counter that by comparing economic damage as well as deaths. I bet if you tally up the economic damage done in TEH TERRAISTS attacks, it would probably not be insignificant.

But beyond that you are sort of proving Bruce's point. Because *you* don't understand the security measures we as a nation are taking against global terrorism, and how those measures benefit us (or do not), you are resorting to belittling them (OMG ITS TEH TERRAISTS!), and assigning them less importance than something else you are more familiar with. Irony, thy name is Slashdot Commenter.

Re:His arguments are logical, but...

[j_166]

That's funny, I thought alot of economic damage would have occurred by several billion dollar buildings crumbling to the ground, loss of office space, the death of 3000+ highly productive workers, the grounding of all flights for several days, etc. Not things I would consider to be caused by people reacting irrationally.

Re:His arguments are logical, but...

[j_166]

Sure, but what is the total cost of the car wrecks that kill 40K people per year. Probably not even a billion dollars, although I'm not an actuary, so it could be more than that or less. That was the original point. The OP said something to the effect that we are wasting so much money on terrorism when only 3000 people (give or take) died in the last 7 years, when that money could be better spent addressing the 40K people who die a year in auto accidents.

I'm just pointing out that A.) that is not a good comparison because its not just about the number of dead, and B.) its a false dichotomy anyway. We could easily do both, and more.

Re:His arguments are logical, but...

[E 99]

He's a security guy, not a biologist. His list (I must not be well today, I'm actually RTFAs) is correct; e.g., 3000 deaths this century in the US from terrorism and 40,000 every single year on the highways, but OMG ITS TEH TERRAISTS!

That's because 3,000 murders is a more vile thing than 40,000 accidental deaths.

Re:His arguments are logical, but...

[j_166]

"It's a false dichotomy not because you can have both, but because you can have neither. Both accidental deaths and criminal deaths are things which will never be eliminated. (And let's be honest, there's no real reason to treat the 9/11 attacks as anything other than simple criminality; they accounted for only about 15% of murders in the US in 2001.) We can certainly reduce them, but eliminating either one is simply out of the question. Given the costs of each, both in lives and dollars, I know which one I'd rather see get the most attention."

Nobody (but the people i'm arguing with) thinks that these problems can be eliminated though. Bush's Rah-Rah-we're-gonna-git-the-terraists talk non-withstanding. Working to REDUCE both car accidents AND global terrorism is not only possible, but both are worthy pursuits. I'll go one further and say that not only are both possible, but its actually pretty mandatory that we work on both, if we want to maximize our productive society. And we do pay attention to both. Maybe not in equal dollar amounts, but lots of attention gets paid to telling people not to drive aggressively, to wear seatbelts, catching people speeding, etc. There's only so much that can be done on that front though, and none of it makes the front page of the Times.

Unfortunately, lots of attention also gets paid to dropping bombs on people we don't like. I would like to see the USA out of the middle east and working on traffic problems probably more than you, but I recognize that that simply is not possible at the moment.

People are working on all of these problems, is my point. Its just that the ones that make the news tend to be the ones that have pretty explosions attached to them.

Great discussion though. Its nice to see this kind of well thought out discussion on slashdot of all places.

Re:His arguments are logical, but...

[sm62704]

True, but we're talking about safety, not villany. I'm aghast and disgusted by terrorism, but not the least bit afraid of it. My chances of being killed by a terrorist are lower than my chances of slipping on ice this winter and dying from the fall. I see little reason to spend extra money on terrorism; regular law enforcement funds should do. I'm certainly not willing to give up any of my rights to fight terrorism.

OTOH my chances of dying on the highway is scarily real. As a former cigarette addict I'll most likely die from cancer, caused by the corporate terrorists, who Google informs me kill half a million people a year. Heart disease doesn't run in my family, but that kills another half a million people.

Selling cigarettes and trans-fats is IMO quite a bit more vile than driving an airplane into a big building.

Probably

[sharp-bang]

There were in South Africa anyway.

Re:Probably

[maxwell demon]

No, those were South African villages. :-)

Just an excuse

[Kohath]

Security solutions have to be designed around usability. If usability isn't the #1 or #2 consideration, it will increase the failure rate of the humans involved and you'll end up with an insecure system in practice regardless of the technical merits of the security methods.

Security is the least of it. How about Democracy?

[victorvodka]

The crude animal impulses present in the vast bulk of humanity are masked by the accumulation of accomplishments by extremely rare geniuses. Skim off the top 1% of creative freethinkers, and humanity wouldn't be all that different from any other species on this planet. Our feelings about what is or is not secure are easy to game with scary stories and special effects. Our desire to live peacefully in a democracy can quickly be overwhelmed by a relatively small threat, such as by a group of underfunded Islamic crazies living in a cave with a shoebox full of box cutters and 19 airplane tickets. It wouldn't take much of a jujitsu move for an effective terrorist to scare the bulk of the American people to quickly decide that fascist rule was in their interest. Humanity's easily-meddled-with irrationality is our Achilles Heel. For example, since 9Eleven America has turned away many brainy and creative people who used to contribute to our greatness. Now those people go elsewhere, making other places great.

What a pile of carp

[Roadkills-R-Us]

The real problems are, in no particular order:

1) A lot of people are either stupid or uneducated.
2) A lot of people don't bother to think.
3) A Lot of people are sheep and believe what they're told by marketing.
4) A lot of people are lazy.

I guarantee you this covers the vast majority of the problems with IT security. It's not biological evolution, though you could make a good argument for societal devolution being the problem.

Re:What a pile of carp

[cthulu_mt]

A short, unoriginal list...I guess you fall under #4.

Re:What a pile of carp

[Frozen Void]

You forgot :
5.Building an insecure system from the ground up and expecting the users to fix it.

Re:What a pile of carp

[grumbel]

I completly disagree. Sure, people might be lazy, not bother to think and such, but thats not the problem, thats the way humans are, maybe not all, but a very large number of them and there is *no* chance to 'fix' that on a global scale. If you just blame the user you will never reach a good state when it comes to IT security.

Security talk is *way* to focused on rather irrelevant theoretical stuff, sure, it might be interesting when algorithm X is is now vulnerable to attack Y and Z, both of them however very unlikely in real life situations. What however gets easily missed is that 99.9% of the people don't encrypt their traffic with algorithm X in the first place, they don't encrypt at all, they send plain text and will continue to do so as long that is the default in their application and that is the problem that needs to be attacked.

I think the by far hugest problem of IT security is simply that it often has terrible usability implication. When you make the secure way hard and the insecure way easy, it is no surprise when the users go the easy root. Also computer systems are way to easy to break and violate even the simplest users expectation. Viewing an image is considered harmless, because in a well designed system it would be harmless. Not so on todays crap systems, thanks to buffer overflows and friends, clicking on an image is not so different then clicking on a exe. And such stupid issue go through all of todays systems, applications send plain text, passwords only obscure stuff, but don't encrypt it, system doesn't verify installed exes, system doesn't track tempering of files, users are forced to remember a new password for each and every webpage, etc. There are heap loads of issues that are just plain wrong on todays systems and most of them actually could be fixed without the user even noticing, but nobody seems to care about making security actually usable.

Re:What a pile of carp

[j_166]

5.) ???
6.) PROFIT!!

Re:What a pile of carp

[bgspence]

And, that list describes both the IT security community and the systems users.

Thr real problem is wirh the IT 'pros.' They need to develop security solutions that apply to users with just those attributes. The users aren't changing any time soon.

Lazy, stupid, unthinking IT sheep need to get their act together.

IT security is not evolved for the people it is intended to serve.

Re:What a pile of carp

[mstahl]

You should read Kevin Mitnick's book on the human element of security. There's a lot more reasons beyond laziness why security fails in a lot of circumstances. His book covers physical as well as abstract security.

Re:What a pile of carp

[Tom]

The real problems are, in no particular order: The real problem, in no particular order:

1) Most people doing IT security are arrogant techofreaks with absolutely no understanding of HCI, usability or users in general.

If the people who built our cars were equally arrogant, ignorant bastards, you'd have to have a diploma in engineering to start it, it would look like an airplane cockpit, and every time you open the door you'd have to fill in a questionare saying that you're really sure and you absolve the manufacturer of any responsibility.

Oh, and they'd come with a 50-page sale contract that says you can't sue the manufacturer every, for anything, and the car doesn't really belong to you, you only get a limited license to use it. But that's a different topic.

Re:What a pile of carp

[concept14]

5) And a lot of the above 4 types work for Microsoft and the other vendors.

Re:What a pile of carp

[turing_m]

It also stems from upper management either not being smart enough or not dedicating enough time to do a bit of basic research on security, so then they either ignore security issues entirely, or want security but completely underestimate the intelligence required to do a good job at it.

I'm reminded of reading "Surely You're Joking, Mr Feynman!", where Feynman routinely bypassed the cargo cultish efforts at security by his ostensible military overseers. It's the same pattern - primitive people attempting to construct something that is fundamentally incomprehensible to them. On one hand, you have New Guineans building an "airfield" expecting to magically get cargo, not understanding that a landing strip is only one piece in a gigantic logistical chain. On the other hand, you have people whose fundamental intelligence limit is blue collar or middle management type work buying the most expensive safe money can buy and not changing the combination from the factory default!

Re:What a pile of carp

[Frenchy_2001]

you forgot the cause of a lot of security breach, virus infections and other problems

5) Most people are naturally trusting

They will trust their fellow man or the technology that they do not understand, mostly because they can not grasp what the other person would have to gain by lying to them (in an email spam for example).

The kind of skepticism you have in the streets about strangers is an acquired skill, drilled into you by your parents. Otherwise, as a kid, you would just follow the first stranger to promise you a candy.
Most people are still in the infancy stage regarding technology. People offer them candy, they follow and get a nasty surprise (trojan, virus, worm, scam...). But most people consider themselves savy and insulted if you dare to mention such a thing...

Re:What a pile of carp

[tehcyder]

On the other hand, you have people whose fundamental intelligence limit is blue collar or middle management type work buying the most expensive safe money can buy and not changing the combination from the factory default!

You can change it?

Re:What a pile of carp

[turing_m]

Yes, for that particular model, you could. Every single safe of that model was set to the same combination, and if the guy who had ordered it had bothered to rtfm, he could have changed the combination. Even 1,2,3,4,5... would have been better than just leaving it to the default. And I'm sure that that particular manual would have been understandable by a layperson. It would have consisted of diagrams and instructions by someone for whom English was their first language (seeing that this was 50 years ago, when America actually used to manufacture things). But of course, no one bothered to read it.

Is there anything...?

[Otter]

Is there anything on which Bruce Schneier is not an expert? Now he's an expert on evolution? I'm not sure why he thinks his knowledge of cryptography qualifies him to hold forth on every freaking subject on the planet.

Re:Is there anything...?

[MadMidnightBomber]

Bruce Schneier once killed a man using only linear cryptanalysis

Worse: humans evolved against security

[MeditationSensation]

Witness the post-it notes under the keyboard to remember a password. :-)

Bad reporting?

[Estanislao Mart�nez]

How in the hell does this relate to IT security?

If you read Schneier's regular blog, you'll see that he regularly talks about security topics in general, not just IT security. The tagging of this talk as being narrowly related to that may be a case of inaccurate reporting; given what Schneier regularly talks about, I'd have been surprised if his talk hadn't covered non-IT security topics.

Stupid Crap

[TrappedByMyself]

I guess people are running around in some sort of Darwinian intellectual enlightenment these days. I've been seeing bad evolution and artificial intelligence references all over the place recently. It's only a matter of time until some jack-off writes about a darwin 2.0 semantic web

Anyway...the issue with security isn't that people aren't "evolved" enough to use it, it's just that the solutions presented to the masses are garbage. You don't implement something in a way which makes it difficult to use, then say that people are just too dumb to use it. The solutions needs to evolve, not the people.

Re:Stupid Crap

[tomstdenis]

I think it's the opposite. I think most people are capable of advanced lines of thought, they just choose not to because to them it's work.

Like, if they have to use a password that is hard to guess [er, remember] then they look at the service as "unfriendly." If they have to wrap their minds around trivial concepts like public and private keys, then the solution is too hard (honestly, if you can't figure out public/private keys you're probably operating on the mentality level of a severely retarded 8 yr old).

I'm sorry, but at the age of 14 I was capable of figuring out on a high level how RSA worked. I didn't understand all of the math, but I at least got the idea that the private key decrypts what the public key encrypts, how to distribute them, etc. And that was almost 12 years ago when the PGP was less common place.

We have technology that can trivially encrypt/sign your emails, like pgp and enigmail. Just people refuse to spend the 15 mins it takes to learn the software because *throws up hands* it's too hard. Face it, people are lazy, deceitful creatures that seem to blame everyone but themselves for their shortcommings. (and yes, I misspelled that word because my browser failed to correct for me!).

Tom

Re:Stupid Crap

[Quiet_Desperation]

which makes it difficult to use, then say that people are just too dumb to use it.

That always amazes me to this day.

IT GUY: Your PC is insecure.
AVERAGE JOE: I don't really know how to properly secure it.
IT GUY: Dumbfuck.

Yeah, great approach. Gosh, why don't we teach kids that way?

TEACHER: What's 147 divided by 7?
FIRST GRADER: You haven't taught us division yet.
TEACHER: Dumbfuck.

Re:Stupid Crap

[Anonymous Coward]

More like this:

IT GUY: Please use a secure password. Try using a phrase you're familiar with, and stick in a couple of numbers and special characters. It's good to use at least 16 characters.

USER: Look, can I just leave it empty, so I can hit the button and log in?

IT GUY: No. Look, just pick a line from a poem or something. Stick a number or two in. That's good enough.

USER: Why do I have to log in all the time! You guys are a pain in the ass.

IT GUY: I'll make it easy for you. Pick a secure password or I'll lock your account and file a complaint with your supervisor.

USER: IT NAZI!

That's how it goes in most organizations...

Re:Stupid Crap

[Sax Maniac]

What I usually see is this:

IT GUY: Your PC is insecure.
CEO: It's your job to secure it, dumbfuck. Give me a secure computer.
IT GUY: Yes sir.

Re:Stupid Crap

[Anonymous Coward]

You forgot...

IT GUY: And change all five of your 16 character passwords every 2 months, choosing a different password each time with no repeating.

USER: ... Right. Where are my post-its?

Sometimes IT Security professionals aren't evolved enough to understand humans.

Re:Stupid Crap

[Tim C]

That's something I've seen before on a reasonably high-profile website here in the UK (not a publicly-accessible one and this was a few years ago, but still - no details).

Users were required to use a password at least 8 characters long, with at least one letter, one numeric, and one non-alphanumeric, which had to be changed every thirty days.

You would be amazed how many passwords I saw of the form "Password-12", which would then be changed to "Password-13", then "Password-14"...

Make the password policy too complicated, and users will fall back on systems that undo all the security you took so much time to build. At least this particular site locked the account after three successive logon failures - although of course that also helps to ensure easily-remembered (and therefore generally likely easily-guessed) passwords.

Re:Stupid Crap

[rantingkitten]

Only usually, since the "average Joe" thinks it's okay to know jack-all squat about the thousand-dollar plus machine upon which his business utterly depends, and which he's been using day in and day out, year after year... he hires some "IT professional" who is marginally above your average ISP tier-one helpdesk yob. Of course the "IT guy" doesn't do anything useful, but the Average Joe has zero knowledge with which to assess the actual talent of the guy he's paying 80 dollars an hour. And so he continues paying out the nose, nothing ever gets done, and the cycle continues.

Amazing how that works, innit?

Re:Stupid Crap

[stewbacca]

uh, well it IS your job. Actially, i'm convinced that you IT guys hoarde knowledge, and avoid good software just for your own job security.

Re:Stupid Crap

[Sax Maniac]

Sorry, I don't do IT, but I know plenty that do. Most don't like being called at 6pm on a Sunday because a laptop crapped out due to spyware that the VP installed.

A lot of software, if not most, is out of control of your IT guy. Big companies have managers buying software with no "skin in the game" - they buy it despite the fact that all the users and IT people hate it. How many companies used Notus Lotes as an email system, despite it absolutely sucking golf balls for that purpose? The deal is made on a golf course or yacht, the sales suits smile and drink and congratulate each other and get 50K bonuses, and you have to deal with the results.

Re:Stupid Crap

[stewbacca]

All great points, but none of them take away from the fact that the IT person is hired to fix all this stuff, regardless of how it was broken. If one doesn't like being called at 6pm on a Sunday, one should get a different job.

To put it another way, without the niggling problems of computer-illiterate bosses that can afford yachts (whatever that has to do with anything), the IT guy doesn't have a job.

Re:Stupid Crap

[Sax Maniac]

If one doesn't like being called at 6pm on a Sunday, one should get a different job.

No doubt, but it doesn't mean they are purposefully causing the problems it for job security as you assert. Perhaps a few retarded sociopaths are, but normal people don't. Why make yourself extra work, when you're not going to get more money out of it?

Your IT guy is not trying to sabotage you precisely because it's his problem when it doesn't work.

So evolution is the deciding factor?

[Opportunist]

Time to get rid of planes (not snakes, just the planes), frozen yoghurt and tv. I can't see how any of that is in our genetic makeup. If we should fly, I'm sure we'd have evolved some wings by now.

Old News

[scruffy]

This sounds like what's in his 2003 book, Beyond Fear.

I suppose we need the repetition though.

Re:Ah.

[SatanicPuppy]

I'm not sure what the hell you're talking about. Are you saying that B.S is an evolutionary biologist? I think he'd be a bit surprised to be so described, since as far as I know, his background is almost entirely compsci and crypto (and physics).

Mine on the other hand is primarily cognitive science, which, as it happens, does include a bit of neuroscience, more than enough to dispel the whole "patchwork" assertion. And while my formal training in evolutionary biology is somewhat lacking, I think the uncontestable claim that humanity is a competitive animal will be seconded by anyone with even the weakest background in biology.

Just give it a couple 10,000 years

[rrohbeck]

On the other hand, why *should* we evolve for IT security? It's not like there's a Darwin Award waiting for the dumbest user or admin. There's no evolutionary advantage for comp sec aware folks... unless we start creating some, like opening up safety related systems to the wild. Mmmm, how about wireless interfaces to the internal networks of cars, or to household appliances like gas stoves? Or the charge circuitry of Li-Ion batteries? That'll teach the noobs.

This explains many of the "solutions" out there

[damn_registrars]

Consider how many of the IT solutions for the mass market work right now:

• Your expensive OS has security flaws that you can drive a mack truck through? Patch it or buy the new version of the same.
• Your mailbox is flooded with special offers on discount viagra? Install a spam filter to block the messages.
• Oops, the filter isn't catching the newer offers for discount software? Update the filter or buy the newest version of the same.
• Oops, the filter isn't catching the new stock offers that are flooding your inbox now? Another update, of course.

When of course, these all have much better solutions, if only people actually worked on the source of each respective problem. Hint, its not filter / firewall rules.

Re:This explains many of the "solutions" out there

[damn_registrars]

is a known troll
I'm not sure why you think you're relevant. But thats OK, because as I already explained, your comments as an anonymous coward will still be posted with a score of zero, and hence be largely unread. If you want to add to the conversation, please do us a favor and register. You may even manage to get a point across by doing so.

But of course you're also free to continue playing this odd game of yours where you try to use less than 1% of my postings to make a sweeping generalization about me. Has it ever occurred to you that I've made over 120 posts to slashdot this year, and yet you're the only stalker I have? Does that not mean anything at all to you?

Bad Science

[Ezekiel38]

"The brain is still in beta mode, it's got all sorts of patches and workarounds. It's not perfectly created, it's clearly evolved up." If your brain is so imperfect and patchy, and you know so little about it, why should anyone listen to your opinion? You're using your own beta-mode noggin' to whip up a bunch a baloney, and you recklessly throw it out with such certain authority. Shameful.

Re:Bad Science

[wsanders]

Hey, what do you know about biology and psychology, compared to a crypto expert?

Remember, the first rule in selling IT security is, "I am l33t!!"

Brain Vista

[mindwanderer]

"The brain is still in beta mode, it's got all sorts of patches and workarounds. It's not perfectly created, it's clearly evolved up." See, even God uses Windows.

Re:No I'm not

[NeutronCowboy]

Wow. You truly are entertaining. Here, have some more rope. I'm sure you can find an entertaining way of hanging yourself again.

Hey AC!

[SIIHP]

"You do realize that, outside of biology, evolution is usually used metaphorically, right?"

YOU do realize that in this case, WE ARE ACTUALLY TALKING ABOUT BIOLOGY, RIGHT?

I see why you posted AC.

Fossils = biological_prototypes + time;

[Scrameustache]

"The brain is still in beta mode, it's got all sorts of patches and workarounds. It's not perfectly created, it's clearly evolved up." Wow, just ... wow. I'm not even a biologist but I know that's a terrible analogy. You can't compare the brain to software. We can control software and decide when it 'goes live,' there are no prototypes in nature or evolution. Every attempt is an iteration of the process and the process is never ending. Not even a biologist? Are you not even a programmer either? Every attempt of a stable build is an iteration of the process and the process is never ending!

Sexual reproduction decides when the organism goes live, and marketing decides when the product goes live.

Re:No I'm not

[Chandon Seldon]

I'm judging his statements based on his expertise. He has none. That's not "authority" by any measure. His "authority" never entered the equation.

That's exactly how a (fallacious) argument from authority is usually constructed.

You can't reliably judge an argument on the basis of the perceived expertise of the speaker, since it's entirely possible that they may know more than you think.

Open letter to God

[EmbeddedJanitor]

Better luck with Humans V2.0.

Anyway you should only trust Humans V1.0 after SP1 has been released.

Re:Open letter to God

[zegota]

Seriously. I tried a fresh install after Humans V1 became corrupted, but it seems like its reverted back to its old behavior.

Re:Open letter to God

[cytg.net]

think I just od'd on your sig... or did I ?

Re:Open letter to God

[comradeeroid]

Early reports from beta testing of Humans Longhorn indicate that the increased security features mainly consist of nagpop's and blocking of almost every function. Before a patch was released to allow it to be shut down several beta testers suffocated due to a function that prompted "It seem's like lungs.exe is trying to access oxygen, if this is correct press 'Yes'"

Re:Open letter to God

[zwarte piet]

God: I case you didn't notice: Every humon got upgraded to v2.0 quite for a while. Now please reboot, will ya!

Re:No I'm not

[SIIHP]

"That's exactly how a (fallacious) argument from authority is usually constructed."

No it isn't.

In this case his argument is an OPINION, which is directly reliant on his expertise.

If there were an absolute truth here, you would be correct. You are not, because there isn't.

Conditioning

[FranTaylor]

People are very quick to confuse inbred and conditioned behavior, because it can be hard to distinguish.

Calling a behavior inbred is usually a cop-out: if it's inbred, then we can't do anything about it, so we can stop thinking logically about it and just attribute it to bad human wiring. It's the lazy person's way to end an argument.

I suggest to you, that someone who has been brought up in an environment where trust is treated like the complex subject that it is, will do better than someone brought up in an environment filled with deceit and denial.

Re:Conditioning

[reverius]

You keep using that word. I do not think it means what you think it means.

This is silly

[grasshoppa]

Our brains haven't evolved a single way to solve problems; That's why we're as successful as we are as a species, is that our brains can evolve and solve new problems as they come up.

This guy demonstrates a severe lack of understanding of the subject, which is odd given who it is.

Re:SIIHP

[SIIHP]

"Hm, my troll detector just went off."

Stop pointing it at yourself?

Re:Err...

[j_166]

"How much money and how much trouble have we expended to go after terrorists? But how few people have they killed? It won't please anyone, but if we spent that money fighting something ordinary, say heart disease (#1 killer, last I knew), we might actually save more lives."

Maybe the money and trouble we've spent on fighting terrorism so far is precisely what keeps them from killing alot more people. More directly, how do you know what effect, good or bad, people taking their shoes off in airport security lines has on air security? Just because the TSA doesn't report its results directly to you? For all we know (you and I both) taking shoes off may have prevented hundreds of bombs from being smuggled aboard airplanes.

Just because it doesn't make sense to you personally doesn't mean its not worthwhile to do. Which I suppose is part of Bruce's actual point.

Also, you are setting up something of a false dichotomy. There is no reason why we can't spend a lot of money and trouble on fighting both terrorism AND heart disease, as well as Cancer, jaywalkers, speeders, people with too much back hair, etc. etc.

Don't poke the bear

[Scrameustache]

Plane crashes are scary because planes aren't familiar to most people; Actually, plane crashes are scary because once you're on the plane, there is nothing you can do about them.
Car crashes are less scary because of familiarity, has you said, but also because you can grab the wheel, yell "look out!", or otherwise act upon your own destiny. And because of vertigo phobia. In a car, you're already on the ground: you aren't going to accelerate towards it inexorably, as planes will if they stall/run out of gas/break/hit another plane/etc.

Familiarity and statistics are just part of it.

Re:Don't poke the bear

[Anonamused Cow-herd]

Actually, plane crashes are scary because once you're on the plane, there is nothing you can do about them.
There are huge numbers of colluding biases that make planes scary for people. Some are logical, and others are less logical -- either way, I think people characterize fear of things like planes incorrectly. It's not just a matter of risk, it's also a matter of perception. For example, take flamethrowers. Horribly ineffective weapon, horribly effective scare tactic -- who would want to die like that? In the case of planes, some of the contributing factors include:

• Natural, inborn fear of heights present in many mammals
• Fear of the unknown
• Betrayal of "common sense" -- it seems unreasonable that something so heavy could actually stay aloft
• Ignorance of real risk facts
• Fear culture that has evolved around airplanes since their inception
• Fear of dying in a "gruesome" manner
• Social reinforcement for fear -- lots of other people are scared, too

The list, of course, continues. To try and isolate causes of complex fears and other actions is a serious error that humans make all the time, in an effort to understand and interact with our circumstances. Why do you love your parents? Is it because it's inborn, or learned, or because they gave you cookies, or because it's necessary to create a social fabric? Of course, it's not any of those -- it's all of them, and many, many more reasons.

This article is rubbish

[hardihoot]

The first problem I have with this article is that it attempts to discuss two completely different topics, that of security against physical harm or risk and that of security against harm to a computer system. They really are not related. If I see a rhino charging at me I will have fear and get out of the way (if I can). In the case of a computer system, I cannot detect harm such as someone attempting to gain administrator access through a remote connection except by special software or reading logs.

The average human being is not going to dig through log files or read technical documentation to shore up possible security risks. A (sober) human being will most certainly try to get out of the way of a rhino, and it is more common sense than it is evolution: either get out of the way or get trampled to death. When it comes to IT security, the average human computer user will trust the firewall, the anti-virus software, or "that computer guru" to keep things safe.

The second problem I have with the article are the unproven assertions made:

--we got good estimating risk 100,000 years ago in an East African village

--evolution is true, and how we feel emotionally about security is a result of it

--the brain is still in beta mode

--it is difficult to estimate risk in London in 2007

I think Londoners (as are most city-dwellers I know) are street smart and savvy enough to estimate risks quite well, but maybe because all but the criminals have been disarmed and Londoners don't have the means of self-defence anymore it is perhaps harder to defend against harm?

Re:This article is rubbish

[maxwell demon]

The second problem I have with the article are the unproven assertions made:

[...]

--the brain is still in beta mode

But it is! :-)

Admit it...

[AlecLyons]

You're drunk, aren't you.

I know I am, and I was just about to post what you did.

Great news for the OLPC folk!

[jpellino]

" 'As a species we got really good at estimating risk in an East African village 100,000 years ago. But in 2007 London? Modern times are harder.'""

So those kids in East Africa with their shiny new XOs should run rings around us westerners?

Oh, wait...

Location, location, location

[Blakey Rat]

But in 2007 London? Modern times are harder.

Phew! I'm glad I'm in Seattle.

I'm glad he's confirming my own opinion

[cheros]

I spent years doing technical security, but that eventually turns to box shifting. Sure, there are very clever tools out there, but what good is that going to do my clients if they still leave a laptop ready to be stolen, and use passwords an 8 year old can guess?

And that's again just the technical side. We have a setup which advises on all sorts of security, and doing the anti-kidnap coaching is a serious eye opener for someone who's been living on the command line. It puts it all in perspective (although the driving part is *seriously* cool to do just for the hell of it :-).

IMHO, security is NOT a process (I know this is sacrilege :-). Security is about people, and as long as we don't start from that angle a lot of people will still make a lot of money - but not address the real issue.

I've started coaching CEOs on security, privacy and IT, and that works because it impacts decisions in a positive way. But we've got a little while to go yet..

Or in short...

[pb]

"IT Security Not Evolved for Humans".

This article is trash and the author irresponsible

[j4ck50n]

"Risks that could be controlled - The DC sniper caused a few deaths but the response was way out of proportion."

What an ignorant, insensitive ass. Please, do tell, how could the response have been better managed? A shooter on the loose for weeks taking out random targets at will. Response out of proportion?

I think of the woman shot in the head standing next to her husband while loading their car after shopping. Ponder for a moment, the emotion involved in that single death. The intensity of that moment. A few deaths indeed.

The Amish would agree...

[WheelDweller]

There's a reason the Amish don't have cell phones, and it's not *just* because of religious reasons, though that's a big part of it. The Amish see something like this as getting between people. Face it: how many times have you, in person, been put "on hold" for someone on a cellphone? Basically they don't like what it would do to their community.

In this case, the same is true. Metaphorically like giving a hot rod to a teenage boy, you can't always trust'im to be _wise_ or _polite_ as to the operation of the car....and this is a realization of the same thing, on a grander scale.

In a similar vein, what's the first thing that gets illuminated when you hand a child a flashlight? YOUR face. :>

Wrong way around

[Tom]

As much as I respect Bruce, but here he's got it the wrong way around.

If people can't cope with the way something works, then are the people at fault, or the way we built that thing? Or, in more practical terms: Which part can we change? So where should we direct our energy and creative thinking?

Humans are the way they are. The way to change them is called education, takes several generations for any major change, and is fairly uncertain and not yet fully understood.

Re:Err...

[j_166]

But you're assuming that there is one 100% fool-proof security system out htere, that once our researcher discovers what it is, they will put it in place and all will be secure. That isn't the case in physical airport security any more than it is in computer security. In the real world, and computing, security is more like an onion. It has many layers, some closer to others. Worse, in both cases you evolve towards better security using trial and error.

I would argue that taking off your shoes does indeed do something: it prevents terrorists from sneaking in bombs in their shoes. Furthermore, it doesn't really hinder useability of the system all that much, so I would say its a pretty good tradeoff. It is one less exploit "they" can use against our system. Think of it as a patch, if that helps. You don't run an unpatched IIS 3 server, even if nobody is seriously using any exploits against IIS 3 anymore.

"The true solution is to stop pissing people off who would be terrorists, and stop allowing them to fuck up our economy and SUCCEED at the terrorism. Terrorism only works when your target is afraid of you."

I agree that would be a good solution, but it is also not a realistic solution since it would only work on Fantasy Island.

Get over it

[paladinwannabe2]

So he made fun of you for being a coward instead of answering your question. And now you're stalking him for petty revenge. If anything, this backs up his opinion that AC's aren't worth responding to. Fortunately for him, he can just set his preferences so he'll never see your posts again.

He has a point, but...

[Mutatis Mutandis]

Yes, there are too many security efforts evaluate risks badly; that aim to rigorously closing systems to guard against supposed known threats, piling security measure on security measure, while leaving the back doors wide open. The equivalent of people who are afraid of flying, but drive recklessly while drunk.

However, I think that many misguided security measures are inspired at least as much by self-protection as by bad evaluation of risks. People often know that they are not addressing all the real risks. But they assume that as long as they stick to policy, and "even better" ridiculously over-design to cover every possible risk explicitly mentioned in the policy, they can't be blamed when things to go wrong. Some junior technician is not going to challenge policy laid down from above, just because it has giant gaping loopholes. He or she is just going to follow it, and apres nous le deluge. And the policies in turn are often written by people who focus on past incidents, not future risks, because what's behind you is more likely to bite your ass.

Governments regulate aviation safety very tightly because they can get a lot of criticism when there is a fatal accident. But car accidents that cause more casualties overall, are considered a normal part of life, and people rather resent additional safety measures, so governments are much less inclined to take strict measures to reduce them. That's not caused by short-sighted risk evaluation (at least not necessarily on part of the government) but by plain politics.

You can see it any form of modern engineering; measures designed not to reduce risk, but to reduce liability. Of course I don't know whether the same principle was applied in communities of pre-historic hunter-gatherers, but my somewhat pessimistic view of humanity induces me to assume that it did. And I would not be surprised if the same behavior was discovered in chimpanzees.

It is even possible that that behavior actually has a background in the evolution of our brains. The ability to blame someone else when things go wrong, must be of considerable advantage to the spread of your genes.

Reproduce.

[WK2]

It is interesting to note that those who are most competent at IT security are least likely to reproduce.

east african village

[arbitraryaardvark]

I once heard Neal Stevenson give a similar talk. http://db.tidbits.com/article/05951
He drew pie charts labled "threat model" where 99% of the chart was "hyenas."
Today, our threat models are a bit more complex.
http://www.anu.edu.au/people/Roger.Clarke/DV/NotesCFP2K.html#Steph

junpei wikipedia

About those shoes...

[DigiShaman]

FYI this is why they check our shoes for explosives. Notice the sheet metal: The explosion literally rips a hole through it!

Re:About those shoes...

[rtb61]

So one crazy shoe bomber and a few hundred million shoes latter, how many exploding shoes have they found. So why aren't they strip searching everybody, if it is real, think of bombs in bras and cavity insertions, or at an absolute minimum completely dismantling every electronic component that goes onto a plane, every camera, phone, laptop, pda and media player. Better yet if you can afford to fly you can afford to buy all new stuff at your destination, great for corporate profits and besides, what is wrong with flying naked if you have nothing to hide, hmm.

Nice BS political troll combining the little shoe explosion (which most probably had no room for a foot) with that much larger plane explosion.

So FWit friends of Fred selling fear in 08, so 'SUP', hmm, fear - obey - corporate profits (try changing the letters it is far more truthful). If you are going to do political trolls on /. at least put some geek/nerd word craft into it ;).

Re:About those shoes...

[DigiShaman]

Nice BS political troll combining the little shoe explosion (which most probably had no room for a foot) with that much larger plane explosion.

Let me get this right. I posted a video that provides a compelling reason for why they justify the search. In return, you have the audacity to call ME a troll?

And where in my post did I say I agreed with this approach? I never did FYI.

Dangerous tool

[sdeering]

Like many first-generation tools, the internet exposes us to risk. Think electricity, tall buildings, surgery.. we just haven't figure out how to build a safe internet yet.

High impact?

[6Yankee]

In the case of automobiles, probability is high but the impact is low. It's the other way around in aircraft failures.

Doesn't the impact happen at ground level either way?

You got a point there

[Burz]

And for that reason you gave, I think we have to conclude that computer UIs suck for security.

For example: Someone gives you a crypto key on a flash drive. You plug it in and look at the contents... a teensy nothing of a file that just opens in a text editor. The OS doesn't try to push any of our evolutionary buttons with regard to this very important object.

Or how about task lists? They'll show you what/who is using the CPU, but won't do the same for a network interface. The user must take it upon themselves to become educated and install tools like nettop and such.

Also, most GUIs won't give you a clue about the data/executable status of a given file (unless you keep opening the properties/info window). So we get lots of trojans posing as jpeg files and proliferating like mad. OSes are only now starting to (inelegantly) deal with this problem.

These are examples of bad design from a security standpoint.

Re:You got a point there

[Tom]

And for that reason you gave, I think we have to conclude that computer UIs suck for security. Absolutely, yes.

Also, most GUIs won't give you a clue about the data/executable status of a given file (unless you keep opening the properties/info window). So we get lots of trojans posing as jpeg files and proliferating like mad. OSes are only now starting to (inelegantly) deal with this problem. Yes, this is a major problem I wrote about last year. It's the confusion between data and code. Originally, we thought a user shouldn't have to care. We learned the hard way that he needs to.

Re:Err...

[j_166]

Why bother with security at all then with that attitude? No system is going to be 100% perfect anyway, so why bother at all. What are we going to do? tear down all the airports, scrap all the airplanes and rebuild it all from scratch with an eye for security? Not going to happen. You are totally correct that us looking out for our best interests is the root of the problem, but the problem with that problem is that us looking out for our best interests necessarily means that we aren't looking out for the interests of others. That's why I said your idea was unworkable. It would be nice if world relations were a zero-sum game, but that's just not how the world works.

Now, that being said, I just wanted to say I do get what you're saying. We could probably do alot to improve security by trying a little harder not to be dicks to people in other countries. But that's neither completely possible, nor will it solve it entirely.

"we need to stop with the meddling in the middle east to the extent we have been (Afghanistan = good idea, Iraq = bad idea), work on our image as a nation and then encourage people to stop being scared of the bogeyman, and start paying attention to the REAL dangers that our arrogance and national policy are causing."

I agree with you 110% there, and I'll raise you we should also cut all ties with Israel. But I have news for you, that still isn't going to solve the problem. There are just bad people in the world, who want what we have. worse, there's some that just don't plain like us for no real discernible reason. And no amount of being nice to them is going to convince them otherwise. And its just too easy to make your point by taking down an airliner or three.

Maybe that's why...

[jav1231]

Maybe that's why they're "running scared" from the Storm Worm!
http://it.slashdot.org/article.pl?sid=07/10/24/1532240

Independence Day

[nEoN nOoDlE]

Remember that Will Smith movie Independence Day? If that movie is a true to life indication (which I believe it is), then super advanced aliens aren't evolved for IT security either.

Age?

[Nicolay77]

it does not 'come naturally' to the average person I would argue that it does not 'come naturally' to the average older than 20 person.

Young people learn at amazing rates. Some people keep learning stuff much longer but are a very tiny minority.

Idiot.....

[IHC Navistar]

This has *NOTHING* to do with brain evolution. Period. It has everything to do with modern attitudes, perceptions, and beliefs, as influenced by modern events, cultures, and happenings.

This is a prime exmaple of someone trying to sound smart about something they obviously aren't.

IT security has nothing to do, even remotely, with brain development OR evolution (other than the fact we had to develop the skills necessary to use/develop computers/machines/technology).

Humans *ARE* evolved for these types of thing, just hardly anybody wants to spend the amount of time necessary to counter every security threat that gets thrown at them.

Idiot.

The Cybermen?

[Zombie Ryushu]

Weren't Human 2.0 The Cybermen?

Wrong!!!

[VincenzoRomano]

Humans have not been intelligently designed for IT security!
Read the Bible!

The Lemon Market

[AftanGustur]

I was there and another thing he mentioned was The Lemon Market which is a market in which the seller of a product knows much more about the product than the buyer. The guy who invented this won the Nobel price for his work.

Guess what, in a Lemon market, all the Lemons get sold and only a few of the good products, the IT market most often is a "Lemon market", and that explains why the best products don't always come out on top.

You proved his point

[Fezmid]

"Maybe because everyone involved in an air plane crash usually dies. Automobile deaths are much less. "

Thank you for proving Bruce's theory exactly. You don't think that automobile deaths are that common, when in fact 119 people die on the roads every DAY. 43,443 people died on the roadways in 2005 alone, and this is only in the United States! Pretty sure airplane deaths are FAR less...

http://en.wikipedia.org/wiki/List_of_motor_vehicle_deaths_in_U.S._by_year

Brains Need An Upgrade

[Hoi Polloi]

What do you expect? The human brain is still running on OS "Homo Sapiens 2.0". It hasn't had an upgrade (or even a patch) since the last ice age. Networking is slow and undependable, memory is prone to faults (or even false data), graphics quality varies wildly, it sometimes ignores input and returns the same results constantly, and if you hit it too hard it shuts down and has to be rebooted. The only thing going for it really is very good parallel processing. Sadly, some people are still running on "Homo Erectus 1.0".

Re:Security is the least of it. How about Democrac

[feelbad_feelsgood]

It didn't take much of a jujitsu move for an effective terrorist to scare the bulk of the American people to quickly decide that fascist rule was in their interest.

Fixed that for ya.

Of course it's harder...

[Datamonstar]

Yes, it's harder. we're competing with ourselves much more fiercely and more often. We're up against our own brains, and that is the fatal limitation.