Slashdot Mirror
Freakonomics Q&A With Bruce Schneier
Samrobb writes "In grand Slashdot tradition, the Freakonomics blog solicited reader questions for a Q&A session with Bruce Schneier. The blog host writes that Mr. Schneier's answers '...are extraordinarily interesting, providing mandatory reading for anyone who uses a computer. He also plainly thinks like an economist: search below for "crime pays" to see his sober assessment of why it's better to earn a living as a security expert than as a computer criminal.'" The interview covers pretty much the whole range of issues Schneier has written about, and he provides links to more detailed writings on many of the questions.
I found his comments on terrorism - A. Refuse to be terrorized - and cameras to be fairly well thought out.
We choose how we live.
We can live in fear and magnify risks that are, in reality, very minimal, or we can realize they're minimal and stop worrying about them.
I'd rather live free from fear.
And the answers about passwords were fairly good. When I was a regional security officer, I came up with similar concepts, based on the real threats that actually existed. When on a public site, with low real risk (e.g. public web, no linked account) it's better to have a common (but hard) password, and save more secure passwords for sites where you have real financial risk instead.
-- Tigger warning: This post may contain tiggers! --
"...In 1957, fifty years ago, there were fewer than 2,000 computers total, and they were essentially used to crunch numbers. They were huge, expensive, and unreliable; sometimes, they caught on fire..."
Well, now they are small, inexpensive, and relatively reliable. But at least they still sometimes catch on fire.
~~~~~~~
"You are not remembered for doing what is expected of you." - Atul Chitnis
A: It's always hard to figure out the actual numbers on this, but I definitely get the feeling that having a more open attitude with MP3s has contributed to my ability to actually make a living. More and more, people don't like to buy things that they haven't heard first, which makes perfect sense when you think about it. This is why they have listening stations in record stores (er, I mean, when they used to have record stores). And because I depend so heavily on word of mouth marketing, it's extremely important that it's as easy as possible to hear my stuff. Again, it comes down to the extremely low cost that comes with digital content -- it's okay if only a small percentage of listeners buy, as long as the number of listeners is very high. That can only happen if you let people listen.
Q: When you wrote "Still Alive" for Portal did you have any idea how well the synergy would be with the game? I don't think that there has every been ending credits in any media that has matched the love that people have for the end of Portal. Have you been asked to work on any other video game music since the release of Portal?
A: One of the reasons I agreed to do it was that I understood the character so well -- it was one of those things where I looked at what they had created and it made absolute sense to me. We didn't know all the details of how we were going to finish the game, but I really could sort of feel how it was supposed to end up. Of course I'm thrilled with the reception, and it's been much larger and more positive than I could have imagined. There's nothing else in the works at the moment, but I'm definitely open to doing more things like that if it's the right project.
Q: When will Valve release a video game that is also a full musical comedy?
A: Yes please. That would be a great deal of fun to do, whether or not it was any fun to play. I'll put you in touch with Gabe and you can insist that he make it happen.
To get the most out of this interview, make sure you have the facts on Bruce Schneier. The man is not what he seems.
There are several Web sites where I pay for access, and I have the same password for all of them.
/.pr0n
And these sites have content, content which gets stored under
Poor Bruce must get awful tired of answering questions from people who don't understand how computers, etc. actually work.
Unpleasantries.
I do have an idea. For starters, Holovideo. Computers a billion times more powerful than today's will be able to calculate the interference equations required to display true color live holograms on flat screens - or glasses.
Just think about it, put on your glasses and everything seems normal. Turn on your (wearable?) computer and you'll be able to interact (let's assume the glasses got tiny cameras on them, thanks to transparent electronics) with holographic objects - which may include virtual displays which you can move with your hand, a-la minority report (or a-la Nadesico if you're an anime fan ^^). Who says you'll need to use physical keyboards? Probably they'll be virtual, too! No more Repetitive Strain. And that's just for starters - imagine playing with rubik cubes or analyzing/debugging code (for programmers) in 3D.
However, I wonder if software will be advanced enough by then to have AI agents assisting you like most sci-fi flicks. Usually software is the barrier in computing. Programmers are slow.
This person needs to learn more about security
You think Bruce Schneier needs to learn more about security?
Anyone who loves or hates any language, platform, or manufacturer, doesn't know what they're talking about.
A: I run an open wireless network at home. There's no password, and there's no encryption. Honestly, I think it's just polite. Why should I care if someone on the block steals wireless access from me? When my wireless router broke last month, I used a neighbor's access until I replaced it. That answer is so bad it almost sounds like sarcasm. Given how easy it is to sniff sensitive data from an unencrypted wireless network, I can't imagine Bruce would allow it unless he segments his network or wires up his own PC.
Consider that a point is being made that you're not getting, because "this person" is not a moron, and generally talks about security as it is actually practiced instead of how it would be practiced if everybody were an expert and made good security a priority. Since people in general will not make security a priority, you have to talk about how people actually behave and how to craft security that will take actual behavior into account.
"It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
Specifically I do not care how my low-security passwords are stored. But for my high security passwords, I would like them all to be stored in a unix-like way, namely only cyphertext is stored and it's impossible for anyone to know what that password is. Sure they may be able to change it on my behalf, but can they tell what it is? No!
I've had this concern for quite a while now and I'm surprised that I haven't found a security certified label that addresses this concern. Sure there are other labels like http://www.truste.org/ or "Verisign Secured", but where's there one that tells me my user-password is stored in a "unix-like" manner?
Same point as Bruce, but put in terms of a threat analysis translated into everyday terms:
Why you should write down your password
Correction: Actually, they're keeping us from seeing the long string of flag-draped coffins streaming home...
Don't tell me to get a life. I'm a gamer; I have LOTS of lives!
I'm not a soldier, but I arrived at essentially the same conclusions on my own, right down to writing passwords on a card in your wallet. In fact, I used to teach people that in a local basic computer security awareness class a local library held.
:/
One important thing to note is that you have to be careful about password reuse. Oh, and email, no matter what, should NOT be considered "low security" no matter how boring your private life is because it can often be used as leverage to get more sensitive data. Look at this leak if you want to see the harm losing a simple Gmail account via password reuse can do.
As for the military issues, you have my sympathy. I sincerely wish we had leaders who would tell us "the only thing you have to fear is fear itself" and who would try to calm the public instead of using fear mongering tactics to consolidate political power. Unfortunately, from the responses we've seen over in Boston, I think that the public has been so irrationally terrified at this point that they won't listen any more. Not that I've heard many voices of reason speaking out to begin with, at least on TV.
What really sickens me is that this unrealistic threat evaluation is likely to get nice guys like you killed. I don't envy you
In his defense, had he completely restated the whole of his previously published work he references his responses would be tediously long.
I saw it as more of a "here is a more in depth answer to this question, if you are interested"
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.