and they wonder why i use yahoo for my marketing spam newsletters.
Yahoo installed a backdoor for the NSA behind the back of the security team
61–70 of 302 posts
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#62Earlier quoted context omitted.
This is why we (as a community/industry) need to have the equivalent of a prison/death threat. The government wins by making it personal, by threatening prison and death for your obedience. It's not an abstract threat. It is directed to a specific person not a company or security team. The people who comply can quit those companies but they don't. I'm not referring to the ones down the chain (e.g the security team wh…
Wow. This is probably the worst comment I've ever seen on HN. You're suggesting that people who follow the law, which you disagree with, get blacklisted, following the model of criminals killing other criminals who follow the law. If you want to change the government, there are far better ways than retaliating against citizens unwilling to risk life and limb for your ideology. I think you need to learn to direct your…
So now, quitting your job (because you're asked to do something unethical) is the equivalent of losing your life and limbs?
Let me guess, you believe all government actions are lawful. All lawful actions are righteous and justified. The only permissible way to change the system is through the system. Did I get the gist of your morality?
In which case, keep voting and I'm sure you will see the changes you want reflected in legislation just so they can be ignored in by secret courts and intelligence services.
In the real world, people respond to threats (e.g prison). That's what the government uses. Why are we expected to behave differently?
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#63I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…
I don't know how common this is in general, but an ethics course was a required part of the engineering core curricula at my school (Case Western Reserve). Ultimately, though, an ethics course isn't going to make people stand up for their ethics. A professional organization along the lines of the American Medical Association (at least in terms of political strength) that stands up for its members and censures those w…
If you can professionalize a certain set of ethics, you can make it impossible for your employer to find anyone to complete the job.
For example, capital punishment is increasingly hard to carry out because anesthesiologists refuse to participate and drug companies won't supply the drug.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#64There is no moral dilemma here. If you blow the whistle on the NSA you are a traitor to your own country. How can this not be clear to people.
You're talking about the same US government that happily killed loads of people when they banned alcohol by throwing poison in the bootlegged stuff. Put your loyalties where you like, mine are with the people.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#65I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…
University of Central Florida required this when I went there, but I think the issue is applying the learnings from the course vs getting the pay check from your employer. I think it's one of those things that is easier to say than do unfortunately.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#66Let's say you were on security on and found it on the network. Would you somehow be bound by a gag order about it, since you would never have seen said gag order?
I think it's irrelevant in practice. (In theory, that's an interesting question) You're not making the decision to make this public. If you're on the security team, you're going to notify the boss, and at that scale of the system compromise this goes all the way to the top. At that point someone who knows about the gag order is in the chain. The only scenario where I think the question matters is if you do something…
Let's say an unaffiliated third party (white-hat hacker) found the exploit and reported it to you under a Bug Bounty program. Let's also say that that third-party was someone who followed "responsible disclosure" rules, and said that they'd publicize the vulnerability if you didn't do so yourself within a short time-frame. You investigate (by asking your team, your boss, looking at the bug tracker, etc.) and figure out it's an NSA backdoor. Now what do you do? Are you allowed talk to the white-hat? Are you allowed to not talk to the white-hat, knowing that this would result in the white-hat reporting the vulnerability and thus compromising the investigation?
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#67I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…
I don't know how common this is in general, but an ethics course was a required part of the engineering core curricula at my school (Case Western Reserve). Ultimately, though, an ethics course isn't going to make people stand up for their ethics. A professional organization along the lines of the American Medical Association (at least in terms of political strength) that stands up for its members and censures those w…
> When there are few professional consequences for unethical behavior at the behest of your employer, taking an ethical stand is ineffective and quixotic. You will be fired and another engineer will likely complete the job.
I disagree. I've seen this in action where people who were CCIE-level senior network engineers at one of the five largest ISPs in Turkey quit and got new jobs elsewhere (outside of the country) rather than be an active participant in the autocratic government's messing about with internet censorship and null routing of IP blocks. These were not people who could just be replaced by advertising an open position.
The more junior staff members left behind had trouble with the government's diktat, with less clue and technical capability, and ultimately ended up implementing what was required in a less effective and shittier way than an unethical CCIE could have.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#68From a threat modeling POV, this is an interesting type of insider threat. A high-privileged faction of the company is hijacked (via extortion) by a malicious third party with legal leverage.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#69Earlier quoted context omitted.
This is why we (as a community/industry) need to have the equivalent of a prison/death threat. The government wins by making it personal, by threatening prison and death for your obedience. It's not an abstract threat. It is directed to a specific person not a company or security team. The people who comply can quit those companies but they don't. I'm not referring to the ones down the chain (e.g the security team wh…
Wow. This is probably the worst comment I've ever seen on HN. You're suggesting that people who follow the law, which you disagree with, get blacklisted, following the model of criminals killing other criminals who follow the law. If you want to change the government, there are far better ways than retaliating against citizens unwilling to risk life and limb for your ideology. I think you need to learn to direct your…
It is legal, and perhaps moral, to refuse to work with unethical people who follow immoral/illegitimate orders. While the mention of "snitches get stitches" set things down the wrong path, the core idea is not unjust.
Re: Yahoo installed a backdoor for the NSA behind the back of the security team
#70There is no moral dilemma here. If you blow the whistle on the NSA you are a traitor to your own country. How can this not be clear to people.
That's a statement, but not an argument.