Slashdot Mirror
Book Review: Liars and Outliers
First time accepted submitter benrothke writes "It is said that the song Wipe Out launched a generation of drummers. In the world of information security, the classic Applied Cryptography: Protocols, Algorithms, and Source Code in C by Bruce Schneier may have been the book that launched a generation of new cryptographers. Schneier's latest work of art is Liars and Outliers: Enabling the Trust that Society Needs to Thrive. For those that are looking for a follow-up to Applied Cryptography, this it is not. In fact, it is hard to classify this as an information security title and in fact the book is marked for the current affairs/sociology section. Whatever section this book ultimately falls in, the reader will find that Schneier is one of the most original thinkers around." Keep reading for the rest of Ben's review.
Liars and Outliers: Enabling the Trust that Society Needs to Thrive
author
Bruce Schneier
pages
384
publisher
Wiley
rating
10/10
reviewer
Ben Rothke
ISBN
978-1118143308
summary
Brilliant book on trust and society, and it complex interrelation
In Applied Cryptography Schneier dealt with the pristine world of mathematical cryptography where aspects of pure mathematics could be demonstrably proven. For example, non-repudiation is absolutely provable.
In Liars and Outliers, Schneier moves from the pristine world of mathematics into the muddy world of human trust. Non-repudiation is no longer an absolute in a world where a Windows kernel can be compromised and end-users can be victims of social engineering.
The book addresses the fundamental question of how does society function when you cant trust everyone. Schneier notes that nothing in society works without trust. Its the foundation of communities, commerce, democracy, in truth — everything. And Schneier deals extensively with social and moral pressures that effect trust.
Liars and Outliers is very similar to books by Umberto Eco, that have a Renaissance feel to them; bringing myriad and diverse topics together. Schneier does this here and intertwines topics such as game theory, evolution, surveillance, existentialism and much more. Schneier's brilliance is that he is able to connect seemingly disparate dots around information security and society, and show how they are in truth tightly coupled.
In the book, Schneier makes note of those that don't follow the rules. He calls these people defectors, and these are the liars and outliers of the book. The book notes that everything is a trade-off, and these defectors are the ones that try to break the rules.
An overall theme of the book, in which Schneier touches and references sociology, psychology, economics, criminology, anthropology, game theory and much more, is that society can't function without trust. He writes that in our complex interconnect and global society, that we need a lot of trust.
Schneier makes frequent reference to Dunbar's number, which he first references in chapter 2. Dunbars number was first proposed by British anthropologist Robin Dunbar and is a theoretical cognitive limit to the number of people with whom one can maintain stable social relationships. It is generally in the area of 150. So when someone sees a person with 3,000 Facebook friends, something is clearly amiss.
In chapter 9 on institutional pressures, Schneier takes a very broad look at threats facing society today. One of the biggest perceived threats we have today is terrorism, and the book astutely notes that we can never ensure perfect security against terrorism.
If Schneier had his way, the TSA budget would be measured in the millions, not billions of dollars. He incisively observes that all the talk of terrorism as an existential threat to society is utter nonsense. As long as terrorism is rare enough (which it is), and most people survive (which they do), society will survive. He writes that while that observation is true, it is not politically viable for our leaders to come out and say that.
While the book is heavy on the people focus, Schneier also acknowledges that sometimes and for some people, the incentives to commit crimes are worth the risk. To deal with those, that is where security technologies come into play.
An interesting observation made in chapter 10 around technology is that sometimes the technological changes have absolutely nothing to do with the societal dilemma being secured. For example, he notes that between the ubiquity of keyboards and the tendency for teachers to focus on standardized tests, cursive is no longer being taught that much in schools. The result is that signatures are more likely to be either printed text is an illegible scrawl; making them easier to forge; which in turns creates new security risks.
In the book Schneier makes scores of astute observations on how society functions around security. He notes in chapter 16 that we are currently in a period of history where technology is changing faster than it ever has. The worry is that if technology changes too fast, the attackers will be able to innovate so much faster than society can that the imbalance become even greater; with failures that negatively affect society.
In many of the examples in the book, Schneier paints a dark picture given the advantage that the attackers and defectors have. But he also notes that we are in a period of history where the ability for large-scale cooperation is greater than it has ever been before. On that topic, he refers to the book The Penguin and the Leviathan: How Cooperation Triumphs over Self-Interest by Yochai Benkler where he writes that the Internet can and has enabled cooperation on a scale never before seen. And that politics, backed by science, is ready to embrace this new cooperation.
On the lighter side, in chapter 17, Schneier notes that Mussolini didn't make the trains run on time; he just made it illegal to complain about them.
Schneier notes at the end of the book that its lesson isn't that defectors will inevitably ruin everything for everyone. Rather that we as a society need to manage societal pressure to ensure that they don't.
Liars and Outliers is an absolutely fascinating and groundbreaking book. In this election year where the candidates attempt to make sweeping simplistic promises to fix complex problems, Schneier simply answers that in our complex society, there are no simple answers.
In Applied Cryptography Bruce Schneier demonstrated he was quite the smart guy. In Liars and Outliers, he shows he is even smarter than most of us first thought.
Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Liars and Outliers: Enabling the Trust that Society Needs to Thrive from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
In Liars and Outliers, Schneier moves from the pristine world of mathematics into the muddy world of human trust. Non-repudiation is no longer an absolute in a world where a Windows kernel can be compromised and end-users can be victims of social engineering.
The book addresses the fundamental question of how does society function when you cant trust everyone. Schneier notes that nothing in society works without trust. Its the foundation of communities, commerce, democracy, in truth — everything. And Schneier deals extensively with social and moral pressures that effect trust.
Liars and Outliers is very similar to books by Umberto Eco, that have a Renaissance feel to them; bringing myriad and diverse topics together. Schneier does this here and intertwines topics such as game theory, evolution, surveillance, existentialism and much more. Schneier's brilliance is that he is able to connect seemingly disparate dots around information security and society, and show how they are in truth tightly coupled.
In the book, Schneier makes note of those that don't follow the rules. He calls these people defectors, and these are the liars and outliers of the book. The book notes that everything is a trade-off, and these defectors are the ones that try to break the rules.
An overall theme of the book, in which Schneier touches and references sociology, psychology, economics, criminology, anthropology, game theory and much more, is that society can't function without trust. He writes that in our complex interconnect and global society, that we need a lot of trust.
Schneier makes frequent reference to Dunbar's number, which he first references in chapter 2. Dunbars number was first proposed by British anthropologist Robin Dunbar and is a theoretical cognitive limit to the number of people with whom one can maintain stable social relationships. It is generally in the area of 150. So when someone sees a person with 3,000 Facebook friends, something is clearly amiss.
In chapter 9 on institutional pressures, Schneier takes a very broad look at threats facing society today. One of the biggest perceived threats we have today is terrorism, and the book astutely notes that we can never ensure perfect security against terrorism.
If Schneier had his way, the TSA budget would be measured in the millions, not billions of dollars. He incisively observes that all the talk of terrorism as an existential threat to society is utter nonsense. As long as terrorism is rare enough (which it is), and most people survive (which they do), society will survive. He writes that while that observation is true, it is not politically viable for our leaders to come out and say that.
While the book is heavy on the people focus, Schneier also acknowledges that sometimes and for some people, the incentives to commit crimes are worth the risk. To deal with those, that is where security technologies come into play.
An interesting observation made in chapter 10 around technology is that sometimes the technological changes have absolutely nothing to do with the societal dilemma being secured. For example, he notes that between the ubiquity of keyboards and the tendency for teachers to focus on standardized tests, cursive is no longer being taught that much in schools. The result is that signatures are more likely to be either printed text is an illegible scrawl; making them easier to forge; which in turns creates new security risks.
In the book Schneier makes scores of astute observations on how society functions around security. He notes in chapter 16 that we are currently in a period of history where technology is changing faster than it ever has. The worry is that if technology changes too fast, the attackers will be able to innovate so much faster than society can that the imbalance become even greater; with failures that negatively affect society.
In many of the examples in the book, Schneier paints a dark picture given the advantage that the attackers and defectors have. But he also notes that we are in a period of history where the ability for large-scale cooperation is greater than it has ever been before. On that topic, he refers to the book The Penguin and the Leviathan: How Cooperation Triumphs over Self-Interest by Yochai Benkler where he writes that the Internet can and has enabled cooperation on a scale never before seen. And that politics, backed by science, is ready to embrace this new cooperation.
On the lighter side, in chapter 17, Schneier notes that Mussolini didn't make the trains run on time; he just made it illegal to complain about them.
Schneier notes at the end of the book that its lesson isn't that defectors will inevitably ruin everything for everyone. Rather that we as a society need to manage societal pressure to ensure that they don't.
Liars and Outliers is an absolutely fascinating and groundbreaking book. In this election year where the candidates attempt to make sweeping simplistic promises to fix complex problems, Schneier simply answers that in our complex society, there are no simple answers.
In Applied Cryptography Bruce Schneier demonstrated he was quite the smart guy. In Liars and Outliers, he shows he is even smarter than most of us first thought.
Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Liars and Outliers: Enabling the Trust that Society Needs to Thrive from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
First time accepted submitter benrothke writes
Nahh, he just switched from brothke to benrothke. He's been reviewing as far back as 2008 with a review of The Tangled Web not even a month ago. Maybe he forgot his password?
Haters gonna hate on book reviews (including me) but keep 'em coming, brothski!
My work here is dung.
The result is that signatures are more likely to be either printed text is an illegible scrawl; making them easier to forge; which in turns creates new security risks.
A couple related sentences seem to have collided here...
While Trust definitely lowers the cost of transactions between people/entities, I think that having a small amount of defectors is actually beneficial on a macro level. Without a couple people willing to take advantage of process flaws, it would be very easy for society to become stagnant and complacent.
Doesn't mean we shouldn't crush those defectors to dust when we find them, though.
Dunbar gets made fun of sometimes because of the whole correlation/causation thing. Its just as sensible that social size and neocortex size depend on food pressure.
There are also the weird equivalents of the squared/cubed law
Also primate behavior is pretty boring compared to human, so Dunbar gets made fun of because of what amounts to FTE full time equivalent accounting. Surely the relationship I have with my cube neighbor is not exactly the same as yours, resulting in a larger or smaller chunk of the brain necessary to process... So 150 average full time equivalents, but someone really shallow might do the mentioned 3000 FB friends because each, on average, is only 1/20th of an average relationship. This is actually a well known FB problem, for example I don't do the 1/20th of a real relationship thing, so I found FB incredibly annoying, I don't give a F about some kid I sat next to in study hall 20 years ago, so I deleted my account from all the friendspam. A social media network 2.0 thingy that understands that would be interesting... G+ and its circle sliders is pretty close.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
In the book Schneier makes scores of astute observations on how society functions around security. He notes in chapter 16 that we are currently in a period of history where technology is changing faster than it ever has. The worry is that if technology changes too fast, the attackers will be able to innovate so much faster than society can
Historically haven't attackers always innovated slower at least on the net? I was on the net for years before the invention of spam around '93 or so. Most "attacks" seem to be the same old social con artist crimes, or finding dumb coding mistakes... but for those in the biz, those dumb mistakes are defined as dumb, not insightful. A buffer overflow is freaking magic to a noob, but to a guy who knows C its a parlor trick.
Technologically enhanced stupidity on the victim side seems to be a bigger issue than technologically enhanced criminality on the attacker side.
In 20 years on the net, I've seen the victims get stupider, but I haven't seen the attackers get smarter or dumber. You'd think the same demographic pressure would apply to each, but...
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Common Law America used to have quite a bit more social trust. And people used to live with more integrity.
Of course, we had better social enforcement. Rude curs would be shunned as "no-account trash", or dueled if they continued to deliberately give offense.
Being free, any citizen was allowed to reject the law and opt not to be held accountable to it. Of course, they were also not protected by the law either, and if these "outlaws" began encroaching against society (robbing stages, kidnapping and the like) they had only the protections of natural law (kill or be killed, the law of the wild) to protect them. Society's members were free to contribute to a large bounty and hunt them down like rabbits.
It's these social costs for giving offenses that prevented everyone from doing that. While I can't agree with the puritanical basis in whole, most of those social costs have now been removed from our society. With the penalties gone, acting out and giving offense has become prevalent. And trust correspondingly takes a hit when we no longer concern ourselves with whether we've transgressed against another person, and merely worry about whether we've transgressed against the State and are liable for punishment by it.
I have not read Lies and Outliers, expect for the excerpt online, but I have followed the writing on the blog. It seems to me that this is another book that promotes and explains rational security. Really that was all that Applied Cryptography did. Explain what to do with the tools and knowledge we had. Most security systems are merely only façades. Door locks are not that hard to disable. Checks are not all that hard to forge. They exist to put a layer of ritual between others and our secrets, and it is beneficial for most of us to respect those rituals. What is left, then, is what to do with the those that do not respect ritual, or, even more dangerous, appear to respect the ritual but really are just abusing the rituals to maximize personal returns at the expense of the community.
The end, as always, is an efficient security that does not cause more trouble than it is worth. I think of all the alarms that used to go off every time a car was approached. Of course alarms did not really stop car theft. Most people just ignored them. Modern methods that do not destroy the civil tone of society tends to be more productive.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black