If Gary Government wants to spy on Alice and Bob, then Alice and Bob can use encryption to prevent things like man in the middle attacks.
If Gary pays Bob money to divulge Alice's secret information, that's a different problem that encryption doesn't solve, nor should we expect it to.
Encryption will safely get secret information to/from you to another trusted entity. If it turns out that this other entity can't be trusted, then you're shit out of luck. That's always been the case and will probably always be the case.
This would all be solved if they just charged for the total data sent and received. They could charge something like a $20 monthly rate and $0.01 for each GB transferred.
This would mean that someone that transferred a terabyte would have to pay $30 for the month. Still pretty reasonable. Someone who transferred 10 terabytes would have to pay $120.
These are just numbers I came up with now. I'm sure they could be tweaked to make sure Google still makes a profit on people running servers and doesn't overcharge regular customers.
I am not arguing against the evolutionary pressure.
My original post was to "Black Parrot" who said "But that doesn't explain why it hasn't evolved in lots of other species."
I was illustrating with my car accident analogy that you don;t need to explain why things *don't* happen with that kind of specificity.
The "But that doesn't explain why [monogamy] hasn't evolved in lots of other species." argument is analogous to the "But that doesn't explain why other safe drivers still get into car accidents" argument.
I don't know if you've yet figured out that I don't buy this argument.
I am saying that it is easier to explain why things happen than it is to explain why they don't. You can probably explain what events lead you to meet and marry your wife. You probably can't explain why this failed to occur with the other 3.5 billion women on the planet to the same specificity.
Any explanation like "I liked her Australian accent" has some truth to it, but it's not the whole story, because lots of girls have Australian accents
You can try to explain why humans have monogamy without incurring the burden of explaining why every other species doesn't given the adaptive qualities of lower rates of infanticide. "It just didn't happen" is a perfectly reasonable explanation for why an improbable thing didn't happen.
I am talking about the difference between the realms of near certainty and probability.
When you say "I didn't get into a car accident because I am a safe driver" this is not the complete story because lots of safe drivers get into car accidents and lots of dangerous drivers don't. The real answer is that you were lucky, and also your safe driving habbits probably increased your odds.
While there are a near infinite number of concrete reasons why one might actually get into a car accident, like being drunk, texting, falling asleep, having a stroke, getting into a heated argument, etc, the only reasons for not getting into an accident are very abstract like "I am a careful driver". All of these concrete reasons like texting all increase your liklihood of gettting into an accident, just like how being a good driver decreases them, but the difference is that when you do get in an accident, one or more of them actually does cause your accident.
If somebody frequently drives drunk and texts while driving, but gets in an accident sober while texting one day, you wouldn't say that drunk driving and texting lead to his accident, because he was sober. Sure, he may have got in a different accident due to being drunk had things turned out differently, but he didn't.
You can difnitively say after every car accident. Was this accident due to texting, drunk driving, both, neither, or unknown? After every moment that goes by without an accident, can you even attempt to specify whether this moment was accident free because you weren't drunk or that you weren't texting? Like "I would have hit this car if I was drunk" or "I would have hit that car if I was texting"?
Non events don't give you the kind of specifics that actual events do
Lots of other people drive recklessly and don't get into car accidents either.
My point was that monogamy may have evolved in humans because it prevented evolutionary incentive against infanticide, even if it didn't evolve that way in lots of other species.
Just like how one reckless driver may be killed in an accident *because* he was reckless, even if the vast majority of reckless drivers do not get into accidents.
I would say a good reason to doubt someone had been in a car accident, would be if you had reason to believe that they were never in contact with cars. For example: I would highly doubt the claim that anyone dying prior to the invention of the automobile could have died as a result of a car accident.
Why didn't Benjamin Franklin get into a car accident? "It would have been impossible since cars weren't invented until after his death." seems a perfectly legitimate reason.
You could say that Bill was drunk, or Alice was texting, and that's why they got into car accidents, but that doesn't explain how every single person that drove drunk or texted while driving didn't get into an accident.
If you got in a car accident, would anyone swear that this must be a murder because, you were cautious driver? Or would they just accept that being cautious only decreases your odds of being in an accident to some still greater than 0 probability?
Imagine if you were a non-drug user and a virgin. If a doctor informed you that you tested positive for HIV, it might take a bit more evidence in the form of more tests to convince you. It's not impossible to contract HIV in other ways (e.g. blood transfusions, bit by an infected monkey, etc), but avoiding intravenous drugs and unprotected sex are nearly 100% effective ways of preventing HIV contraction, in a way that being a cautious driver does not prevent car accidents.
Can you explain why you *didn't* get into a car accident in the last month? What was it that you did that nobody else who got into a car accident last month did, to cause you to avoid all the accidents that could have happened?
You could say that Bill was drunk, or Alice was texting, and that's why they got into car accidents, but that doesn't explain how every single person that drove drunk or texted while driving didn't get into an accident.
What kind of explanation were you expecting?
Birds clearly have an advantage by being able to fly. If I said "Flying is not advantageous, because if it was, all organisms would have evolved to be able to fly", would that be convincing to you?
Hopefully just being a human being means that you possess talents, however unremarkable they may be.
That said, I think people like lobbyists, lawyers, and accountants are all probably very smart (maybe even smarter than most producers), but their talents are used for redistributing wealth to themselves and their patrons rather than creating wealth. I don;t think they are bad people. I just think we should be focusing on collectively making the pie bigger rather than fighting for a larger slice at the expense of others (i.e. redistribution). Ideally our system would be set up so that the path of least resistance is to create wealth rather than acquiring it from others, but sadly this is too frequently not the case.
Whether you are a socialist or a capitalist, it makes more sense to focus on producing. If nothing gets produced, then there is nothing to redistribute.
You basically can't do anything in this country without stumbling into the web weaved by some bullshit lobbying group. I'm not a big Ayn Rand fan, but we really are a society of producers and moochers.
I don't know if this is the case or not, but maybe they just have more taxes (rather than higher taxes).
It might actually be more burdensome to have more taxes than higher taxes if the costs associated with complexity (i.e. more accountants and lawyers needed to navigate the tax code) exceeds the difference with a "higher" tax.
I think if this were the case, it would make more sense to just have a higher income tax. Money spent on figuring out taxes need to be paid are a waste and better spent on just about anything that is actually productive.
It's interesting to see that you have invoked consequentialism to disprove consequentialism.
I said I believed that good end results dictate whether an action is good (i.e. utilitarianism/consequentialism). You implied that this results in bad end results throughout history. If you are trying to dissuade me from consequentialism, appealing to the bad end results of it's practitioners throughout history is not the way to do it. Why should I believe a cosequentialist argument for why consequentialism is wrong? If it's wrong, then so is your argument against it.
Why is it that people are willing to expose large quantities of information to private parties but don't want the Government to have the same information?
I think it's simple. I think we tolerate facebook's intrusion into our privacy because we receive something in exchange for it. We get to use a reasonably good social network that almost everyone is on for free. The government doesn't really give you anything for it's spying. Maybe they stop a few terrorists here and there, but honestly terrorism is not a big problem in the grand scheme of things. If you could save all the people who die in terrorist acts for a whole year or all the people who die in car accidents i n one day, the choice would be painfully obvious. Nobody is willing to have something like mandatory speed inhibitors on cars, and that would probably save more lives than anti-terrorism efforts.
This difference between facebook spying on you and giving you a free service, and the government spying on you, is like the difference between buying a lunch at a restaurant for $10 and having $10 stolen from you. You lose $10 in both, why is being stolen from so much worse? For better or worse, we agreed to Facebook spying. We never agreed to government spying.
"Bad" guys finding them first would be hackers, no? Is it only bad when hackers sell them to others? Or is it when they don't tell people about them? Or is it only when they're exploited?
I would say that it is bad when you unjustly harm someone. If you hack into someone's google account and steal their naughty cell phone pictures and post them on the internet, that's bad. If you penetrate a company's security but don't use your access to do any further direct harm, and the harm that is done to this company's reputation is just considering that it is based on truth, then I wouldn't say that is bad, but the law would.
You claim that your hacking is ethical because you only hack your own property. Many products these days (e.g. game consoles) are still owned by their manufacturer and you are only buying the license to use them if you read the fine print. Also by opening the packaging you are agreeing to the license. I personally do not agree that I can be bound to a contract by opening a box, so I choose to ignore these sorts of licenses, but this is technically illegal many would argue.
Wouldn't supporting one of these companies where you buy 0days make you complicit in supporting the "bad" people thus making you one of the "bad" even if you're doing it for the perceived greater good?
I am a utilitarian of sorts. I believe the ends justify the means.
The purpose of laws is deterrence; and security is defense. Even kings of old recognized the wisdom of a layered defense.
Layers are good when they are cost effective. Everything has a cost in resources (e.g. time, money, etc). Some kings probably spent resources on hiring wizards to cast magic spells to protect their castles and curse their enemies. To say the least, this was probably not cost effective.
What do you do when you are unable to trust your system? A prime example is Microsoft (and I'm sure there are others) sitting on 0days for the NSA. Absolutely disgusting.
Well one thing you can do is use an open source operating system. It isn't going to be 100% secure (nothing is), but at least the source code has millions of eyes on it looking for holes, and you aren't reliant on some central authority to make fixes available after the NSA is done exploiting them.
So is filesharing, littering, j-walking, failure to signal, texting while driving (as an aside, during my morning commute I encountered someone entering my lane on the way to work this morning, head down, eyes transfixed on her steering wheel where the phone was, instead of on the road) in some places talking on a phone whilst driving is illegal. All of these are rampant and some can result in death.
While all these things and hacking are all rapant, the difference is that filesharing littering and jaywalking are easy to catch. If you want to catch someone breaking the law on the road, just go out there and watch any random person for 5 minutes and they will have probably broken 10 laws.
If you want to catch a file sharer, join one torrent for game of thrones and you've got thousands of IP addresses of guilty people.
I hack things and contrary to your earlier implication that the mere act wrong, it is not immoral or unethical.
I didn't mean to imply that I think all hacking is inherently ethical. I meant to imply that not all hacking is necessarily unethical, even when hacking someone else.
The amount spent on these things is a fraction of what is spent elsewhere. There are companies which exist solely to distribute 0days and profit massively from them. As a byproduct of three letter agencies and our communications network overlords all of the relevant information transmitted can be/is logged and aggregated. For them to say that its expensive, is it really so? The tax payer already paid for it and HD space is cheap and becoming cheaper.
Yes it is expensive. To say the tax payer already paid for it is a cop out. Even if the NSA has proof that a guy hacked into a computer to become student president of a state college, they aren;t going to allow this info to be used in a trial. They are only supposed to be finding terrorists, and even if they are going beyond their scope, they aren't going to expose their program on small fish like 2bit hackers.
I think we should be buying info from these companies that sell 0 day exploits, and use this info to create security fixes. If we actually do a really good job, they will find that they can't make any money selling 0 day exploits because the don;t stay good for long enough to be marketable. I think a world where 0 day exploits are rampant is preferable to one where all these holes exist but are yet to be discovered. The more holes we find the better. Even if the bad guys find them first, the good guys can usually know shortly after.
I don't think the legal costs of sending hackers to jail is more expensive than the costs of subsidizing security, nor do I think the government should be in the business of subsidizing the costs of fixing sloppy programming.
The government doesn't necessarily need to subsidize it. It could directly commission contractors to find and fix security holes in critical software. In fact it already does this as a matter of national security because the government uses computers that contain sensitive information. The security fixes to open source software are given back to the community because they are governed by open source licenses. I think our government may hold some findings may be held back because they want to use them against others. The government could take in the same amount of money, but just spend it differently.
Or if you are a person that doesn't believe the government should be in charge of anything, You could simply stop prosecuting hackers, and lower taxes by this amount.
Writing solid, secure code is hard and expensive. It seems like any such policy would be nothing more than a trough for companies to feed off the public dime without provably improving their products like so many other subsidies.
Yes writing secure code is very expensive, but once you do it, everyone benefits to the point that it is cheap per person. If you spend $1million finding and convicting a hacker, you have found 1 hacker. If you spend $1million to find a bunch of security holes, and a billion people use it, you have spent $0.001 per person to get $1million worth of security improvements.
This wouldn't be a trough. Everyone uses computers from grandma to navigation systems on navy ships. If grandma can be hacked because of a windows vulnerability, then that means a navy ship's navigation system has the same vulnerability. Even if the government spent more money to secure only the software they used (which is ALOT), and these security fixes were available to the public this would do more to stop hackers than trying to deter them through prosecuting the unlucky few to get caught.
At risk of hyperbole due to dipping into analogies again, you could make the same argument that we shouldn't be penalizing burglars when we could instead be spending money on making houses more secure. At some point the economics and the incentives for good/bad behavior fall apart.
Imagine a world where 99.9999% of burglaries go unsolved, and to actually catch a burglar usually costs more than the value of what was stolen. At this point I think it makes much more sense to spend money securing houses than prosecuting burglars, especially if you can pay for one house to be made super secure and as a bonus get to secure every other house in the world for free. I know that in principle it is the hackers that should be held responsible, but it's just not a good practical decision.
You have inferred to much about the reasons for my position.
Personally, I think laws against malicious hacking are good and necessary. I don't think the CFAA is narrowly enough tailored to that task, but it's better than the wild west.
They are not good, and they are worse than unnecessary. They are 99.99999% ineffectual. The internet is already the wild west. Every single dollar or man hour of effort spent trying to catch a hacker, is infinitely better spent improving security to make hacking more difficult.
You only call for rule of the strong in computing because you see yourself as strong.
I am not confident in my ability to secure my computer at all. Numerous experts in the private sector and in the government have said that in their opinion we are powerless to stop an advanced persistent threat.
Nobody is string. Everybody is getting hacked from threats all over the globe. Our only hope is to make security better. You don't need to be a computer expert to benefit from better security. The same grandmas that have a windows 7 computer have an order of magnitude more secure computer than when they had a windows xp computer. Unfortunately the hacks are also getting more sophisticated. It's an arms race.
Legislators, law enforcement, lawyers and courts are expensive. Rather than putting a few hackers in jail, we could use that money to research security holes and fix them for billions of people.
So it should be legal to hack into the computer of every non-IT professional? Because they're the only people who are going to be competent to adequately secure their systems, and even then only a minority of them would do it completely. And have you never heard of that little thing called a "zero-day exploit"? It should be legal to crack your computer simply because there isn't a fix yet for a security hole?
1. Not even IT professionals can always adequately secure their systems. Every corporation that gets hacked has an IT department.
2. It is not that I think hacking is bad. I just don't think the cost of enforcing anti hacking laws by government agencies that know every little about computer security is worth the benefit of capturing and punishing the handful of people who actually get caught.
Imagine a world where there are millions of beatings by bullies every year. Every year we spend billions of dollars trying to catch bullies, and we only catch a few on average. In this situation, I would say it is probably a better strategy to start investing in self defense courses. This is a matter of practicality not principle. We as a society would be better off if everyone could defend themselves than if 1 or 2 bullies are brought to justice.
Obviously the problem of bullying or assault is not like how I described in my hypothetical example, which is why I don't think my solution to hacking applies to bullying.
I don't believe you've really thought that through. I personally don't think that my mom's PC should be available to every script kiddie out there just because I haven't been by to patch that obscure security hole in Photoshop.
If your mom's computer has a security hole in it, it will be hacked by script kiddies or more likely viruses whether hacking is illegal or not. Even if you lived at your mom's house you are not going to know about every newly found security hole in the thousands of bits of software running on an average computer.
100% of the emphasis of stopping hacking should be on improving security. This means finding security holes sooner, pushing out patches sooner, doing a better job of getting people actually do their security updates or get them to turn on automatic updates. We need to educate people on how to stay safe on the internet.
The internet is not a civil society. The internet is worse than the wild west. You can make whatever you want illegal, but you'd be far better off getting a gun and knowing how to defend yourself. This is the only reasonable course of action when the law is not capable of defending you.
I see why you might try to extend my position on one particular area to every other area where it might not make sense, but I don't advocate taking this view or any other view to this kind of extreme. I'm not an ideologue. I believe in treating different situations differently.
1. Locks on doors and windows are not sufficient to keep out a burglar. Even alarm systems frequently just minimize damage and theft rather than preventing it. You're operating system has the ability to simply refuse to grant unwanted requests for access. Any time it doesn't is because of misconfigured security settings or actual security holes. "breaking in" to a computer system is more like tricking a housekeeper into giving you all the owners jewelry voluntarily. Yes this would still be fraud, but it seems like a better solution than fraud laws, is having housekeepers that don't give away your possessions to strangers.
2. Even with computer hacking illegal, it is rampant. It is rare to catch people who do it. When people do get caught it is bright and socially awkward kids living in their mom's basement, not the Russian mafia guys, or Chinese intelligence, (i.e. we throw the book at the easy targets). We spend our money on litigation rather than innovation. If the only way to combat hacking was better security, then that's that much more money spent on better security innovations. When these innovations happen in open source software, it is beneficial to everyone.
Obviously hacking is bad. The question is whether laws are the best way to remedy the situation. I see the only solution to hacking that works is better security. Are we better off if we put the few people we catch in jail? I don't know, maybe. But we must also look at the cost of resources we put into trying to catch hackers and the benefit of the catching x% of them and see if it's worth it.
On a more emotional level, there are a lot of really smart and successful people who started out hacking as teenagers, and I don't think society would be better off had they been imprisoned rather than allowed to form companies like apple.
Obviously if you steal a bunch of money with hacking, that money should be returned because it doesn't belong to you, but I think the responsibility should be placed on institutions to have better security rather than on people not to explore/exploit weaknesses in security. It's not because I think the don't deserve responsibility, it is because I think we will be better off as a society if we have a strong immune system rather than if we try to eradicate diseases by making spreading them illegal.
Slashdot Mirror
Man generously allows son to sleep in his Fully functional Boeing 747 Flight Simulator Room
If Gary Government wants to spy on Alice and Bob, then Alice and Bob can use encryption to prevent things like man in the middle attacks.
If Gary pays Bob money to divulge Alice's secret information, that's a different problem that encryption doesn't solve, nor should we expect it to.
Encryption will safely get secret information to/from you to another trusted entity. If it turns out that this other entity can't be trusted, then you're shit out of luck. That's always been the case and will probably always be the case.
This would all be solved if they just charged for the total data sent and received. They could charge something like a $20 monthly rate and $0.01 for each GB transferred.
This would mean that someone that transferred a terabyte would have to pay $30 for the month. Still pretty reasonable. Someone who transferred 10 terabytes would have to pay $120.
These are just numbers I came up with now. I'm sure they could be tweaked to make sure Google still makes a profit on people running servers and doesn't overcharge regular customers.
I am not arguing against the evolutionary pressure.
My original post was to "Black Parrot" who said "But that doesn't explain why it hasn't evolved in lots of other species."
I was illustrating with my car accident analogy that you don;t need to explain why things *don't* happen with that kind of specificity.
The "But that doesn't explain why [monogamy] hasn't evolved in lots of other species." argument is analogous to the "But that doesn't explain why other safe drivers still get into car accidents" argument.
I don't know if you've yet figured out that I don't buy this argument.
I am saying that it is easier to explain why things happen than it is to explain why they don't. You can probably explain what events lead you to meet and marry your wife. You probably can't explain why this failed to occur with the other 3.5 billion women on the planet to the same specificity.
Any explanation like "I liked her Australian accent" has some truth to it, but it's not the whole story, because lots of girls have Australian accents
You can try to explain why humans have monogamy without incurring the burden of explaining why every other species doesn't given the adaptive qualities of lower rates of infanticide. "It just didn't happen" is a perfectly reasonable explanation for why an improbable thing didn't happen.
I am talking about the difference between the realms of near certainty and probability.
When you say "I didn't get into a car accident because I am a safe driver" this is not the complete story because lots of safe drivers get into car accidents and lots of dangerous drivers don't. The real answer is that you were lucky, and also your safe driving habbits probably increased your odds.
While there are a near infinite number of concrete reasons why one might actually get into a car accident, like being drunk, texting, falling asleep, having a stroke, getting into a heated argument, etc, the only reasons for not getting into an accident are very abstract like "I am a careful driver". All of these concrete reasons like texting all increase your liklihood of gettting into an accident, just like how being a good driver decreases them, but the difference is that when you do get in an accident, one or more of them actually does cause your accident.
If somebody frequently drives drunk and texts while driving, but gets in an accident sober while texting one day, you wouldn't say that drunk driving and texting lead to his accident, because he was sober. Sure, he may have got in a different accident due to being drunk had things turned out differently, but he didn't.
You can difnitively say after every car accident. Was this accident due to texting, drunk driving, both, neither, or unknown? After every moment that goes by without an accident, can you even attempt to specify whether this moment was accident free because you weren't drunk or that you weren't texting? Like "I would have hit this car if I was drunk" or "I would have hit that car if I was texting"?
Non events don't give you the kind of specifics that actual events do
Lots of other people drive recklessly and don't get into car accidents either.
My point was that monogamy may have evolved in humans because it prevented evolutionary incentive against infanticide, even if it didn't evolve that way in lots of other species.
Just like how one reckless driver may be killed in an accident *because* he was reckless, even if the vast majority of reckless drivers do not get into accidents.
I would say a good reason to doubt someone had been in a car accident, would be if you had reason to believe that they were never in contact with cars. For example: I would highly doubt the claim that anyone dying prior to the invention of the automobile could have died as a result of a car accident.
Why didn't Benjamin Franklin get into a car accident? "It would have been impossible since cars weren't invented until after his death." seems a perfectly legitimate reason.
You could say that Bill was drunk, or Alice was texting, and that's why they got into car accidents, but that doesn't explain how every single person that drove drunk or texted while driving didn't get into an accident.
If you got in a car accident, would anyone swear that this must be a murder because, you were cautious driver? Or would they just accept that being cautious only decreases your odds of being in an accident to some still greater than 0 probability?
Imagine if you were a non-drug user and a virgin. If a doctor informed you that you tested positive for HIV, it might take a bit more evidence in the form of more tests to convince you. It's not impossible to contract HIV in other ways (e.g. blood transfusions, bit by an infected monkey, etc), but avoiding intravenous drugs and unprotected sex are nearly 100% effective ways of preventing HIV contraction, in a way that being a cautious driver does not prevent car accidents.
Can you explain why you *didn't* get into a car accident in the last month? What was it that you did that nobody else who got into a car accident last month did, to cause you to avoid all the accidents that could have happened?
You could say that Bill was drunk, or Alice was texting, and that's why they got into car accidents, but that doesn't explain how every single person that drove drunk or texted while driving didn't get into an accident.
What kind of explanation were you expecting?
Birds clearly have an advantage by being able to fly. If I said "Flying is not advantageous, because if it was, all organisms would have evolved to be able to fly", would that be convincing to you?
Hopefully just being a human being means that you possess talents, however unremarkable they may be.
That said, I think people like lobbyists, lawyers, and accountants are all probably very smart (maybe even smarter than most producers), but their talents are used for redistributing wealth to themselves and their patrons rather than creating wealth. I don;t think they are bad people. I just think we should be focusing on collectively making the pie bigger rather than fighting for a larger slice at the expense of others (i.e. redistribution). Ideally our system would be set up so that the path of least resistance is to create wealth rather than acquiring it from others, but sadly this is too frequently not the case.
Whether you are a socialist or a capitalist, it makes more sense to focus on producing. If nothing gets produced, then there is nothing to redistribute.
You basically can't do anything in this country without stumbling into the web weaved by some bullshit lobbying group. I'm not a big Ayn Rand fan, but we really are a society of producers and moochers.
Why single out software? Why isn't the law "products and services are all taxable"? *That* would make sense.
I don't know if this is the case or not, but maybe they just have more taxes (rather than higher taxes).
It might actually be more burdensome to have more taxes than higher taxes if the costs associated with complexity (i.e. more accountants and lawyers needed to navigate the tax code) exceeds the difference with a "higher" tax.
I think if this were the case, it would make more sense to just have a higher income tax. Money spent on figuring out taxes need to be paid are a waste and better spent on just about anything that is actually productive.
It's pretty evenly split between democrats and republicans voting for this, unlike obamacare.
It's interesting to see that you have invoked consequentialism to disprove consequentialism.
I said I believed that good end results dictate whether an action is good (i.e. utilitarianism/consequentialism). You implied that this results in bad end results throughout history. If you are trying to dissuade me from consequentialism, appealing to the bad end results of it's practitioners throughout history is not the way to do it. Why should I believe a cosequentialist argument for why consequentialism is wrong? If it's wrong, then so is your argument against it.
I challenge you to give me an example where the ends don't justify the means.
or rather, a case where "the ends justify the means" is not true.
There are obviously lots of cases where the ends don't justify the means, and therefore these are poor decisions.
Why is it that people are willing to expose large quantities of information to private parties but don't want the Government to have the same information?
I think it's simple. I think we tolerate facebook's intrusion into our privacy because we receive something in exchange for it. We get to use a reasonably good social network that almost everyone is on for free. The government doesn't really give you anything for it's spying. Maybe they stop a few terrorists here and there, but honestly terrorism is not a big problem in the grand scheme of things. If you could save all the people who die in terrorist acts for a whole year or all the people who die in car accidents i n one day, the choice would be painfully obvious. Nobody is willing to have something like mandatory speed inhibitors on cars, and that would probably save more lives than anti-terrorism efforts.
This difference between facebook spying on you and giving you a free service, and the government spying on you, is like the difference between buying a lunch at a restaurant for $10 and having $10 stolen from you. You lose $10 in both, why is being stolen from so much worse? For better or worse, we agreed to Facebook spying. We never agreed to government spying.
I challenge you to give me an example where the ends don't justify the means.
"Bad" guys finding them first would be hackers, no? Is it only bad when hackers sell them to others? Or is it when they don't tell people about them? Or is it only when they're exploited?
I would say that it is bad when you unjustly harm someone. If you hack into someone's google account and steal their naughty cell phone pictures and post them on the internet, that's bad. If you penetrate a company's security but don't use your access to do any further direct harm, and the harm that is done to this company's reputation is just considering that it is based on truth, then I wouldn't say that is bad, but the law would.
You claim that your hacking is ethical because you only hack your own property. Many products these days (e.g. game consoles) are still owned by their manufacturer and you are only buying the license to use them if you read the fine print. Also by opening the packaging you are agreeing to the license. I personally do not agree that I can be bound to a contract by opening a box, so I choose to ignore these sorts of licenses, but this is technically illegal many would argue.
Wouldn't supporting one of these companies where you buy 0days make you complicit in supporting the "bad" people thus making you one of the "bad" even if you're doing it for the perceived greater good?
I am a utilitarian of sorts. I believe the ends justify the means.
The purpose of laws is deterrence; and security is defense. Even kings of old recognized the wisdom of a layered defense.
Layers are good when they are cost effective. Everything has a cost in resources (e.g. time, money, etc). Some kings probably spent resources on hiring wizards to cast magic spells to protect their castles and curse their enemies. To say the least, this was probably not cost effective.
What do you do when you are unable to trust your system? A prime example is Microsoft (and I'm sure there are others) sitting on 0days for the NSA. Absolutely disgusting.
Well one thing you can do is use an open source operating system. It isn't going to be 100% secure (nothing is), but at least the source code has millions of eyes on it looking for holes, and you aren't reliant on some central authority to make fixes available after the NSA is done exploiting them.
So is filesharing, littering, j-walking, failure to signal, texting while driving (as an aside, during my morning commute I encountered someone entering my lane on the way to work this morning, head down, eyes transfixed on her steering wheel where the phone was, instead of on the road) in some places talking on a phone whilst driving is illegal. All of these are rampant and some can result in death.
While all these things and hacking are all rapant, the difference is that filesharing littering and jaywalking are easy to catch. If you want to catch someone breaking the law on the road, just go out there and watch any random person for 5 minutes and they will have probably broken 10 laws.
If you want to catch a file sharer, join one torrent for game of thrones and you've got thousands of IP addresses of guilty people.
I hack things and contrary to your earlier implication that the mere act wrong, it is not immoral or unethical.
I didn't mean to imply that I think all hacking is inherently ethical. I meant to imply that not all hacking is necessarily unethical, even when hacking someone else.
The amount spent on these things is a fraction of what is spent elsewhere. There are companies which exist solely to distribute 0days and profit massively from them. As a byproduct of three letter agencies and our communications network overlords all of the relevant information transmitted can be/is logged and aggregated. For them to say that its expensive, is it really so? The tax payer already paid for it and HD space is cheap and becoming cheaper.
Yes it is expensive. To say the tax payer already paid for it is a cop out. Even if the NSA has proof that a guy hacked into a computer to become student president of a state college, they aren;t going to allow this info to be used in a trial. They are only supposed to be finding terrorists, and even if they are going beyond their scope, they aren't going to expose their program on small fish like 2bit hackers.
I think we should be buying info from these companies that sell 0 day exploits, and use this info to create security fixes. If we actually do a really good job, they will find that they can't make any money selling 0 day exploits because the don;t stay good for long enough to be marketable. I think a world where 0 day exploits are rampant is preferable to one where all these holes exist but are yet to be discovered. The more holes we find the better. Even if the bad guys find them first, the good guys can usually know shortly after.
I don't think the legal costs of sending hackers to jail is more expensive than the costs of subsidizing security, nor do I think the government should be in the business of subsidizing the costs of fixing sloppy programming.
The government doesn't necessarily need to subsidize it. It could directly commission contractors to find and fix security holes in critical software. In fact it already does this as a matter of national security because the government uses computers that contain sensitive information. The security fixes to open source software are given back to the community because they are governed by open source licenses. I think our government may hold some findings may be held back because they want to use them against others. The government could take in the same amount of money, but just spend it differently.
Or if you are a person that doesn't believe the government should be in charge of anything, You could simply stop prosecuting hackers, and lower taxes by this amount.
Writing solid, secure code is hard and expensive. It seems like any such policy would be nothing more than a trough for companies to feed off the public dime without provably improving their products like so many other subsidies.
Yes writing secure code is very expensive, but once you do it, everyone benefits to the point that it is cheap per person. If you spend $1million finding and convicting a hacker, you have found 1 hacker. If you spend $1million to find a bunch of security holes, and a billion people use it, you have spent $0.001 per person to get $1million worth of security improvements.
This wouldn't be a trough. Everyone uses computers from grandma to navigation systems on navy ships. If grandma can be hacked because of a windows vulnerability, then that means a navy ship's navigation system has the same vulnerability. Even if the government spent more money to secure only the software they used (which is ALOT), and these security fixes were available to the public this would do more to stop hackers than trying to deter them through prosecuting the unlucky few to get caught.
At risk of hyperbole due to dipping into analogies again, you could make the same argument that we shouldn't be penalizing burglars when we could instead be spending money on making houses more secure. At some point the economics and the incentives for good/bad behavior fall apart.
Imagine a world where 99.9999% of burglaries go unsolved, and to actually catch a burglar usually costs more than the value of what was stolen. At this point I think it makes much more sense to spend money securing houses than prosecuting burglars, especially if you can pay for one house to be made super secure and as a bonus get to secure every other house in the world for free. I know that in principle it is the hackers that should be held responsible, but it's just not a good practical decision.
Personally, I think laws against malicious hacking are good and necessary. I don't think the CFAA is narrowly enough tailored to that task, but it's better than the wild west.
They are not good, and they are worse than unnecessary. They are 99.99999% ineffectual. The internet is already the wild west. Every single dollar or man hour of effort spent trying to catch a hacker, is infinitely better spent improving security to make hacking more difficult.
You only call for rule of the strong in computing because you see yourself as strong.
I am not confident in my ability to secure my computer at all. Numerous experts in the private sector and in the government have said that in their opinion we are powerless to stop an advanced persistent threat.
Nobody is string. Everybody is getting hacked from threats all over the globe. Our only hope is to make security better. You don't need to be a computer expert to benefit from better security. The same grandmas that have a windows 7 computer have an order of magnitude more secure computer than when they had a windows xp computer. Unfortunately the hacks are also getting more sophisticated. It's an arms race.
Legislators, law enforcement, lawyers and courts are expensive. Rather than putting a few hackers in jail, we could use that money to research security holes and fix them for billions of people.
So it should be legal to hack into the computer of every non-IT professional? Because they're the only people who are going to be competent to adequately secure their systems, and even then only a minority of them would do it completely. And have you never heard of that little thing called a "zero-day exploit"? It should be legal to crack your computer simply because there isn't a fix yet for a security hole?
1. Not even IT professionals can always adequately secure their systems. Every corporation that gets hacked has an IT department.
2. It is not that I think hacking is bad. I just don't think the cost of enforcing anti hacking laws by government agencies that know every little about computer security is worth the benefit of capturing and punishing the handful of people who actually get caught.
Imagine a world where there are millions of beatings by bullies every year. Every year we spend billions of dollars trying to catch bullies, and we only catch a few on average. In this situation, I would say it is probably a better strategy to start investing in self defense courses. This is a matter of practicality not principle. We as a society would be better off if everyone could defend themselves than if 1 or 2 bullies are brought to justice.
Obviously the problem of bullying or assault is not like how I described in my hypothetical example, which is why I don't think my solution to hacking applies to bullying.
I don't believe you've really thought that through. I personally don't think that my mom's PC should be available to every script kiddie out there just because I haven't been by to patch that obscure security hole in Photoshop.
If your mom's computer has a security hole in it, it will be hacked by script kiddies or more likely viruses whether hacking is illegal or not. Even if you lived at your mom's house you are not going to know about every newly found security hole in the thousands of bits of software running on an average computer.
100% of the emphasis of stopping hacking should be on improving security. This means finding security holes sooner, pushing out patches sooner, doing a better job of getting people actually do their security updates or get them to turn on automatic updates. We need to educate people on how to stay safe on the internet.
The internet is not a civil society. The internet is worse than the wild west. You can make whatever you want illegal, but you'd be far better off getting a gun and knowing how to defend yourself. This is the only reasonable course of action when the law is not capable of defending you.
I see why you might try to extend my position on one particular area to every other area where it might not make sense, but I don't advocate taking this view or any other view to this kind of extreme. I'm not an ideologue. I believe in treating different situations differently.
I look at it 2 different ways:
1. Locks on doors and windows are not sufficient to keep out a burglar. Even alarm systems frequently just minimize damage and theft rather than preventing it. You're operating system has the ability to simply refuse to grant unwanted requests for access. Any time it doesn't is because of misconfigured security settings or actual security holes. "breaking in" to a computer system is more like tricking a housekeeper into giving you all the owners jewelry voluntarily. Yes this would still be fraud, but it seems like a better solution than fraud laws, is having housekeepers that don't give away your possessions to strangers.
2. Even with computer hacking illegal, it is rampant. It is rare to catch people who do it. When people do get caught it is bright and socially awkward kids living in their mom's basement, not the Russian mafia guys, or Chinese intelligence, (i.e. we throw the book at the easy targets). We spend our money on litigation rather than innovation. If the only way to combat hacking was better security, then that's that much more money spent on better security innovations. When these innovations happen in open source software, it is beneficial to everyone.
Obviously hacking is bad. The question is whether laws are the best way to remedy the situation. I see the only solution to hacking that works is better security. Are we better off if we put the few people we catch in jail? I don't know, maybe. But we must also look at the cost of resources we put into trying to catch hackers and the benefit of the catching x% of them and see if it's worth it.
On a more emotional level, there are a lot of really smart and successful people who started out hacking as teenagers, and I don't think society would be better off had they been imprisoned rather than allowed to form companies like apple.
Obviously if you steal a bunch of money with hacking, that money should be returned because it doesn't belong to you, but I think the responsibility should be placed on institutions to have better security rather than on people not to explore/exploit weaknesses in security. It's not because I think the don't deserve responsibility, it is because I think we will be better off as a society if we have a strong immune system rather than if we try to eradicate diseases by making spreading them illegal.