Inside The Twisted Mind of Bruce Schneier 208
I Don't Believe in Imaginary Property writes "Bruce Schneier has an essay on the mind of security professionals like himself, and why it's something that can't easily be taught. Many people simply don't see security threats or the potential ways in which things can be abused because they don't intend to abuse them. But security pros, even those who don't abuse what they find, have a different way of looking at things. They always try to figure out all the angles or how someone could beat the system. In one of his examples, Bruce talks about how, after buying one of Uncle Milton's Ant Farms, he was enamored with the idea that they would mail a tube of live ants to anyone you asked them to. Schneier's article was inspired by a University of Washington course in which the professor is attempting to teach the 'security mindset.' Students taking the course have been encouraged to post security reviews on a class blog."
Comment removed (Score:3, Interesting)
Open network ? (Score:1, Interesting)
In security (Score:4, Interesting)
Such a personality may be disastrous in many other cases but works well when it comes to security work.
And remember that most computer viruses in the beginning weren't really malicious - they just were there "because I can". Even those cases has to be taken into account by security people.
Ant farms are nothing. (Score:3, Interesting)
You can get a port-a-potty delivered without ever providing positive identification. You don't even have to pay for it until it shows up, and they'll happily deliver while you're at work. They're quite used to people preparing to have renovations done by contractors.
Of course, I would never decide someone else needed a port-a-potty on their front lawn. But, much like the ants, it's something you can't help but notice if you have the right mindset.
Re:yawn, another "superior geek" complex (Score:2, Interesting)
I have to agree (Score:1, Interesting)
Comment removed (Score:5, Interesting)
Re:Destructive mindset (Score:2, Interesting)
For an example of how hard symmetric key cryptography is consider this: The session key exchange algorithm that is in most common use (Diffie Hellman) was invented in 1976. The public key cryptographic algorithm most commonly in use now (RSA) was invented in 1973. These haven't been broken. The current symmetric algorithm in use was invented in 2000 and the reason is that every previous algorithm was broken. There are dozens of attacks against symmetric algorithms and almost none against public key cryptography. While symmetric cryptography isn't nearly as hard as hashing, it's still pretty damn hard.
(also, RSA can be implemented in about five lines of code. Not quite as easy for AES)
There's a fine line (Score:4, Interesting)
Sadly the world we live in today has massively overestimated the possiblity of problems and hugely inflates the effects they will have (in the tiny percent of occasions when they happen). I think this is a side-effect of improved communications: we all get to hear about the 1 in a million disaster stories, but never about all the other times, when everything goes right. This leads us to think that problems are more common than they actually are.
The great thing about being a security professional is that you can never be proved wrong. If you claim a security hole and it is never exploited, no-one will say you're wrong - just that it hasn't been exploited yet. If we beleived everything these guys say, no-one would ever do anything as we'd all be too scared. Personally I think we should avoid the obvious problems, get on with our lives and accept that on a few, very few, occasions we might have to spend a little time sorting out a problem.
Re:Destructive mindset (Score:1, Interesting)
Re:paranoia yes ..... (Score:3, Interesting)
If you're in the USA, then good luck finding one that's even remotely secure. My US bank has such a laughable concept of security that I'm very glad I don't keep much money on that side of the pond.
I always thought I was just weird (Score:3, Interesting)
My answers always started the same way. "It's printed in ink on paper." I don't really think that the textbook author expected people to do anything other than to extend whatever line of reasoning had been presented in the previous examples (and I always got around to that) but the open-ended question "What can we say about this equation?" always struck me as license to comment on the clarity of the typesetting or anything else.
My teachers thought I was weird.
Later in life, I became involved in competitive pistol shooting. I loved the rule books. They were just collections of hidden loopholes begging to be found. And then came the problems. In some sports it was called the "engagement" rule. In others, it was the "spirit of the rules" rule. They were all the same sort of thing - a way to say you couldn't do anything unexpected. If you looked at a practical defensive scenario and found some completely whacky way to beat it by, say, running between cover in an odd sequence, you'd be found guilty by the officials of "failure to engage" the scenario. No points for you. A guy I knew had trouble seeing sights too close to his face but the rules forbid changing the sight radius (distance between the sights) making it impossible for him to move the rear sight further from his face. He responded by cantilevering both sights forward so that the sight radius stayed unchanged but both sights were now completely forward of the muzzle. It was perfectly legal under the rules as written but his pistol was declared illegal because it violated the "spirit of the rules."
What amazes me is the hostility this mindset engenders. I'm not shy about saying that I love to parse out the rules and find advantages. I'm not shy about saying that a "spirit of the rules" rule is really just saying "You're not allowed to be smarter than the people writing the rules and running the match." The reaction I get is flaming on message boards and accusations of poor sportsmanship. There are actually people out there who want to punish innovation; at least, that's the way I look at it.
"Thinking different" makes people feel threatened and act nervous and hostile. I don't understand that. Am I weird, or are they?
Re:Factoring large primes? (Score:1, Interesting)
Re:Is this mindset really special? (Score:1, Interesting)
Plenty of incentive to wonder if their dark-skinned neighbor is a Muslim terrorist?
It's not about incentive. It's about hype, and unfortunately, info sec hasn't gotten enough hype. Have a few media outlets declare that terrorists have poisoned the salt shakers and watch Americans start eating healthier.