Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ceremonial security and cargo cults

philvenables.com

Post reply on HN
Print view View original

11–20 of 49 posts

Re: Ceremonial security and cargo cults

#11

Post by lynx23 »

yawnxyz wrote: post #7

This is an interesting article that puts words into what I've been feeling and observing for a long time — at first the transition into Academia from tech felt this way (e.g. wow everyone's programmed to follow the PhD track!) to moving to Australia (wow everyone's so rule abiding and pattern matching; anyone who's attempting to "lead" gets cut down; there's even a term here for it called "tall poppy syndrome) But la…

Thank you, I've just learnt something this morning, almost before the first sip of coffee...

https://en.wikipedia.org/wiki/Tall_poppy_syndrome

Re: Ceremonial security and cargo cults

#12

Post by hnbear »

I’ve found it immensely frustrating in numerous roles when discussing security, audit and compliance requests that the requesters can seldom actually explain their reasoning.

I want a clear statement of risk and why their proposed compensating control actually mitigates it.

Far too often the answers are just “it’s securerer” or “it’s the way we do it”, and actually proposing something that genuinely mitigates the underlying issue is ignored.

All that said, I’ll end up referencing this in the future as somewhat useful steps in a number of situations.

Some have simpler approaches - eg for password security can just reference NIST guidelines which currently clearly state not to rotate and just require length above complexity. And they’re backup to with tested evidence and a clear rationale.

Re: Ceremonial security and cargo cults

#13

Post by astrange »

beardedwizard wrote: post #10
mkl95 wrote: post #8

A manager once asked me to rewrite a bunch of tests written by some former employee, because a security tool was complaining about hardcoded credentials. My guess is that he wanted to satisfy some OKR about how many security issues reported by that tool had been "fixed". Probably the most ridiculous thing I've done.

So you think hard coding credentials, or other variables for that matter, is a good idea?

If those were unit tests they weren't real credentials.

Re: Ceremonial security and cargo cults

#14

Post by lynx23 »

ta8645 wrote: post #6
userbinator wrote: post #5

I believe that such dogmatic "thinking" (if one can call it that) exists and propagates only because people are being discouraged from thinking critically. They are instead encouraged to find "best practices" and "solutions" from others (often giving them $$$), which they can blindly follow, instead of evaluating their unique circumstances and thinking independently about their own needs. The constant use of "securit…

No offense, but I think you're exactly wrong. People need to trust the science, so to speak, and leave the thinking to domain experts who can dictate the best course of action for everyone. On their own, too many people are prone to following misinformation, and can't even be trusted to read both sides of any given argument critically. If the last few years hasn't taught us this lesson, what has it taught us?

It has taught us that media distorts scientific information on demand. I am generally on your side, however, my lesson in the last years is that the communication channels can not be trusted, therefore I can no longer blindly trust what science supposedly tells me.

Re: Ceremonial security and cargo cults

#15

Post by manicdee »

beardedwizard wrote: post #10
mkl95 wrote: post #8

A manager once asked me to rewrite a bunch of tests written by some former employee, because a security tool was complaining about hardcoded credentials. My guess is that he wanted to satisfy some OKR about how many security issues reported by that tool had been "fixed". Probably the most ridiculous thing I've done.

So you think hard coding credentials, or other variables for that matter, is a good idea?

How do you test the rules about passwords containing at least one uppercase letter, one number and one special character if you don’t test with passwords that definitely do not contain those characters?

Re: Ceremonial security and cargo cults

#16

Post by mkl95 »

beardedwizard wrote: post #10
mkl95 wrote: post #8

A manager once asked me to rewrite a bunch of tests written by some former employee, because a security tool was complaining about hardcoded credentials. My guess is that he wanted to satisfy some OKR about how many security issues reported by that tool had been "fixed". Probably the most ridiculous thing I've done.

So you think hard coding credentials, or other variables for that matter, is a good idea?

I don't think it's a bad or good idea, it depends. In that case they were harmless. For comparison, some people shared passwords on Slack and email in plain text.

Re: Ceremonial security and cargo cults

#17

Post by [deleted] »

yawnxyz wrote: post #7

This is an interesting article that puts words into what I've been feeling and observing for a long time — at first the transition into Academia from tech felt this way (e.g. wow everyone's programmed to follow the PhD track!) to moving to Australia (wow everyone's so rule abiding and pattern matching; anyone who's attempting to "lead" gets cut down; there's even a term here for it called "tall poppy syndrome) But la…

[deleted]

Re: Ceremonial security and cargo cults

#18

Post by onphonenow »

hnbear wrote: post #12

I’ve found it immensely frustrating in numerous roles when discussing security, audit and compliance requests that the requesters can seldom actually explain their reasoning. I want a clear statement of risk and why their proposed compensating control actually mitigates it. Far too often the answers are just “it’s securerer” or “it’s the way we do it”, and actually proposing something that genuinely mitigates the und…

Agreed totally. I had a nightmare govt double vpn situation. Very hard to get an account, you had to run ancient OS and Java (it would annoy you with warnings about lack of security/age) and comical password complexity / rotation rules. The result was rampant password sharing but also because you had this double vpn setup, each layer rotating - folks just couldn’t remember passwords. So they outsourced password reset. To reset your passwords you provided your 100% predictable username - that was it. Even I had to get a reset due to an inactivity lockout and I had to laugh at how easy it was after all the silliness - I could have given any username

Re: Ceremonial security and cargo cults

#19

Post by trabant00 »

Cargo culting is unavoidable. We build everything "on the shoulder of giants". We do not have the infinite time and energy to analyse every problem from beginning to end and develop a perfectly fitting solution for it. For the most part we must copy behavior observed in successful entities. We also do not have the energy and effort to perfectly analyze the observed behavior so some data is lost in the copy. You end up with ceremonial solutions to problems that might not even exist in your case.

Ceremonies mostly get discarded by evolutionary pressure in the long term. Some end up taking a lot of time and energy to perform for zero benefits so they reduce the evolutionary fitness of those who perform them. These ceremonies get gradually removed from the "gene pool", being replaced by behaviors that actually bring some benefit. But those will be imperfectly copied as well and the cycle begins again.

Re: Ceremonial security and cargo cults

#20

Post by dgb23 »

yawnxyz wrote: post #7

This is an interesting article that puts words into what I've been feeling and observing for a long time — at first the transition into Academia from tech felt this way (e.g. wow everyone's programmed to follow the PhD track!) to moving to Australia (wow everyone's so rule abiding and pattern matching; anyone who's attempting to "lead" gets cut down; there's even a term here for it called "tall poppy syndrome) But la…

We tend to learn through imitation more than we think. Humans lean on Theory of Mind: when we see others do a task we assume that it’s the right way of doing things, so we adopt their incantations.

Generally this is not something that should be disheartening. It’s an incredibly efficient learning method that spreads cultural advancements quickly.

Have you ever tried to train a dog? They try to understand you, but they don’t imitate. You have to meticulously motivate them through each step of a behavior and mark it consistently with commands. It’s fun, but requires a lot of patience.

With humans you can just demonstrate something and they can imitate complex workflows in just a session or two.

The master said to the apprentice: “I’ll only show you this once, so watch carefully!”

Post reply on HN