wolly · HackerTrans

vor 9 Jahrendiscuss

The problem aren't really rules so much as a lack of substance in the industry. Even in this case where the author takes a stand and says to "just say no" the top right menu says "domains for sale". Even if you don't consider the domain industry itself shitty there's a huge overlap between that industry and things that are ethically questionable online. If one wants to change things, the system has to change first.

wolly

vor 9 Jahrendiscuss

> I like the concept of the shared 3-person offices.

I don't. This seem like a smaller version of an open office. Everyone has someone in their field of view, plus there's a TV and large glass windows with couches directly outside of them. That seem like a great way to get a little bit distracted all the time. Three people in one office is usually much worse than two people in a smaller office. Since if one person does something distracting, they are distracting the other two people. And when two people want to talk about something they are distracting the third person.

What the author describes seem more like "not having to go to meetings" or "not being bothered by management" than actually being able to work undisturbed for a predictable period of time.

wolly

vor 9 Jahrendiscuss

Unfortunately I think personal productivity overall in industry is less of a factor than people suggest. Everyone wants have high pay, use exciting technologies, work in comfort etc. but they don't see the bigger picture.

Investing in people at the end of they day has to make sense, otherwise other companies will out compete you. When it's hard to determine people skills, work varies highly in intensity, projects fail for any number of reasons, people don't stay very long at even the most "comfortable" companies etc. the personal productivity of any employee becomes marginal, at least in the lower ranks. This is true for most "craft" industries like newspapers, fashion or design.

wolly

vor 9 Jahrendiscuss

> You didn't make an argument.

I did make an argument, you just missed it. In most subcultures the thing your doing is the goal, therefor the actions themselves are meaningful (at least according to the participant). Since this isn't the case here, but more of a "the ends justify the means" situation, you have to argue that it actually does. The point isn't that there are other ways, which you incorrectly choose to focus on, but that you have to justify how these actions are appropriate both in themselves and relative to other actions.

> You made a false claim that there were other methods that work and/or an implication that there wasn't much effort on doing that.

As far as I know there isn't much effort going on. This is of course subjective, yet you haven't provided a real example of what you think is a substantial effort that should have lead to results.

> Programmers, support people, architects, tech managers, security experts, and so on have failed to do what you suggested because of greed and apathy of manufacturers.

Plenty of manufacturers make secure or at least not obviously insecure devices.

> They write about it all the time on blogs, esp basic QA. They write about it here, too.

The embedded ecosystem, especially in other countries, aren't going to see those blogs nor be able to act on it. They aren't ignored so much as not considered.

> People in the military invented computer security. They taught me.

I bet I have more military experience than you. The military operates in a different environment and different considerations than civilian infrastructure or products. Most civilian security researcher don't have formal training, yet frequently use terms like OPSEC without actually having an understanding what it means. Because if they did they would know that it to a large degree isn't transferable.

> Meanwhile, nobody is doing anything at any level, you can't convince businesses to do anything in general case, and so a vigilante breaching defective, damaging stuff might be only progress we can get in meanwhile. Reduces risk and decreases demand for garbage products. Vendors might get message like Microsoft did leading to their 180 in security.

This is just your opinion. If this how you do security work I'm not surprised you feel ignored.

The thing is I do have a number of suggestions on "other ways" to improve and/or promote IoT security. I see no point whatsoever mentioning them here though.

wolly

vor 9 Jahrendiscuss

> How about you show me the evidence that people are [...]

I've made my argument. Why don't you take part in the discussion and make some of your own to why this is meaningful?

> I'd love to hear what you've done to convince all the vendors [...]

Why is it at all relevant what I've done and especially since when you don't say what you've done?

> Most of us in INFOSEC haven't been able to convince [...]

I haven't seen much convincing being done. "INFOSEC" (all caps of course because we want to be cool like the military) by itself tends to be a label for people who are relatively far from the development process.

> The only time vendors ever delivered secure or safe solutions was when sound regulations were forced on them with a requirement they were followed before a purchase was made.

Yes, you're still not making an argument why these actions would in any way would be a effective way to regulation.

wolly

vor 9 Jahrendiscuss

I find the arguments for "taking a stand" quite weak. Normally with subcultures that break the law or in other ways inconvenience people the moral argument is that you're doing something that isn't available to you (often as a group) and your actions themselves are meaningful (often because it makes it available to you).

I don't really see in this case how they (or mostly anyone) is unable to improve IoT (or general) security through other means or that the consequences of the actions themselves are any different from other forms of attacks on software (like credit card fraud, denial of service or ransomware).

The arguments from the "hacker" gets especially weak when they conclude that consequences of breaking IoT devices is worthwhile, but the consequences of IoT devices breaking the Internet doesn't have the same effects. Even though you could argue that it's far harder for most people to influence overall Internet security than IoT security and therefor the moral arguments for breaking the Internet as a way of improving it should be slightly easier to make.

wolly

vor 9 Jahrendiscuss

I find that books are still a far superior way to reach proficiency in almost anything, technology included. The Internet certainly has many good features for learning things, but I'm not sure efficiency is currently one of them.

wolly

vor 9 Jahrendiscuss

"If I could talk to my 20 year old self I would recommend this: Stay away from the Internet as much as possible and don't look for general advice."

While I generally agree that you shouldn't overvalue general advice I don't find your argument very believable when you then go on to offer your own advice. Seems more like a convenient way to not having to address the article.

I'm all for going your own way, but it can't be just a reaction to something else. Especially in a relatively free industry like technology I increasingly see people who find themselves disliking the consequences of their decisions (often without realizing they made them in the first place).

wolly

vor 9 Jahrendiscuss

http://www.statistikdatabasen.scb.se/pxweb/en/ssd/

Labour market - The Swedish Occupational Register

wolly

vor 9 Jahrendiscuss

This isn't your normal Asian market. Most of us are happy that we can even make our clumsy attempts at buying sample quantities without speaking the language nor having a local business. There's little evidence of a "foreigner tax" in effect, if anything you're getting better prices and service because you're a curiosity.

wolly

vor 9 Jahrendiscuss

I think that Passengers could have been much more interesting if, especially in terms of sequence of events, it had followed Jennifer Lawrence's character.

wolly

vor 9 Jahrendiscuss

It's (to some extent) a Nordic thing.

http://appsso.eurostat.ec.europa.eu/nui/show.do?query=BOOKMA...

comments