Comment by INTPenis | Hacker News Reader

Comment by INTPenis | Hacker News Reader

Parent Full thread

Clearly they've put a lot of work into this and are willing to pay out for a "3rd party audit" so to speak.

But my schadenfreude is hoping for an outcome similar to what happened to an old co-worker of mine back in 2005.

He was a Windows nut and we were always in a friendly competition about which ecosystem was the better one. One time he had done a bunch of modifications to his own laptop OS, IDS, and tweaking services to have a slimmed down install with a web server. When he was happy he told me "tell your hacker buddies to try and hack this website hehe" :D

He had put up a simple website offering 1000 USD for hacking into the server it was hosted on. His own personal work laptop, with a bunch of other sensitive stuff on it.

I said, ok... And posted it on a certain mailing list that I won't mention.

We sat opposite each other and within 10 minutes I saw him bend down towards the screen with a worried look on his face. Tapping frantically on the keys.

Within another 10 minutes he had disconnected the computer from the internet and said the challenge was off. :D

Apparently his IDS had been throwing up warnings about md5 checksums being changed left and right. That's all we figured out about it. I was 16 years younger so he didn't want to share much more with me.

I feel like his choices by using a device that is for work ... kinda automatically makes me question what if anything we can learn from a technical perspective.

If his judgment is that bad on a basic level, how bad must it be on a technical level?

Many people confuse absence of evidence (of insecurity) with evidence of absence (of insecurity). Just look at the SARS-CoV-2 reporting in January and February, where every major media outlet copied stories about how the flu is much worse and that we should really be worrying about the flu. It was patently ridiculous to be making such assertions as the only thing certain at the time was the depth of our uncertainty.

The dilemma is that equating absence of evidence with evidence of absence is actually a good long-term strategy in our day-to-day lives. Without this strategy we'd be paralyzed by our own ignorance; particularly, paradoxically, those aware of their ignorance. It's a meta-skill to be able to identify when the heuristic should be discarded in favor of more rigorous analytical thinking. A capacity for analytical thinking isn't sufficient by itself, thus making such an error in judgement doesn't necessarily imply an absence of strong analytical thinking skills. (At least, that's what I tell myself ;)

More specifically I'd question the abilities of anyone who thinks they know about security who then exposes actual work material to some sort of uncontrolled test as described and honestly claims to be sure it is secure.

Anyone who knows about security understands that on a modern system there are so many layers of software / firmware, you never can be 100% sure (well I guess other than powering it off...).

How about we stop using HN's comment section to tell irrelevant-to-the-story personal anecdotes? This is basically the top/most upvoted comment of every article. Surely I can't be the only one to notice this trend?

HN is generally focused on thought provoking discussion. Anecdotes can be very thought provoking.

I don’t see why it’s a problem. If it’s the most up-voted, then clearly people find it interesting.

Not always what you want. I'm sure many people think the pun that the top 50 comments race to make on Reddit is the most hilarious thing in the world. But it also gets in the way of discussion as you have to scroll/collapse your way past.

I think we could do a lot worse than anecdotes, but what I find weird is how the anecdotes on HN are always so smug, like this one. "Heh, my old co-worker thought my 'little hacker buddies' couldn't hack his website ;b Let's just say they put quite a dent in it heh ;b."

Bit of an eye roll.

It's a problem exactly because it's up-voted, it's derailing. Happens on so many articles recently. Either derailing by a personal anecdote, or by the "middlebrow dismissal": https://news.ycombinator.com/item?id=4693920

Both are equally derailing. In this case, I would much rather the comments be about the actual OS in question or the trend of big companies crowdsourcing security (penetration testing).

One man's trash is another man's treasure. Otherwise we'd all be reading a website called Hacker Facts, not Hacker News.

These anecdotes provide societal context to the story. Why would Microsoft get the public to harden their product? Surely they have enough resources to do it themselves right?

Because many eyes make light work. Some people would obsess over trying to hack this OS, putting in far more effort than someone paid 9-5 to do it.

Admittedly I'm prone to posting stories and I'm thinking of not doing so / doing it less.

Look at this story. Some guy, who honestly seems to have pretty questionable judgment did a thing and it was a bad idea.

What does that really have to do with this challenge from MS about a custom version of Linux? I would say almost nothing.

Any chance I can get the name of that mailing list via PM?

Can I piggy back off this request as well?

Me three!

Reply on news.ycombinator.com