483 karma · joined December 1, 2023
Another example I experienced was a door-to-door salesman who say your home has been identified by the government to be eligible for a heavily discounted air conditioner installation. Our company is authorized to provide that. There's limited funding available so buy quick to avoid missing out. So it ticks all your boxes but it wasn't a scam and I did buy it and it really was a great deal. BUT I didn't trust a word the salesman said. I checked with the government myself, found their company from the list of authorized installers, and called them back through that channel to order it. That's that part people keep getting wrong. They don't go through another channel to re-contact them.
I've heard celebrities say they don't read what anyone says about them on social media. That sounds like a good idea because there's always going to be haters to any popular public figure. Just ignore them and you're fine.
3rd parties being affected? Well stop associating with the widely-hated public figre if you can't handle the heat of celebrities.
1) Stranger approaches you
2) They tell you some things
3) They ask for money
That process looks like a legitimate cold-calling salesman, but you can treat them the same way and not miss out. After step 2), assume everything they said is possibly a lie and go find the actual person/organization you already know and trust and contact them yourself to do whatever it is. If it's not somebody you already trust, as in this case, then abort.
What if you're a holocaust denier? What are you going to do? Somehow not share your belief with the world? Yes! Either that or accept the hateful responses you're bound to get if you do share it.
Don't forget this is all about public posts. Not anyone's private life or stuff they only share with people they trust. There's always going to be a Muslim somewhere who wants to kill you for being a practicing gay, or a holocaust believer who wants to punish you for disagreeing with their it-did-happen belief.
What about an ashiest who ties their belief to rejecting the identities of Christians? There's no end to what people vehemently disagree on.
By the way, you can always change your identity if you really want to. Just because you're gay doesn't mean that has to be your identity. You might primarily see yourself as a citizen of your country or what your job defines you as or your personality or religion or just simply yourself if you don't want to be part of a bigger group.
Not saying the people making death threats are innocent and of course the law should try to stop them, but often it's not powerful enough so people who don't want that unfortunately have to keep quiet or be anonymous when they want to step on the toes of death-threat-happy communities.
Other people have done a lot to help at their own initiative though. Resellers approach me and market it themselves, customers recommend it on forums, researchers mention it in their published papers, and one customer even wrote a chapter of a book about it - which was key to being eligible for a Wikipedia page.
I'm lucky though because it belongs to a slow moving, well-defined class of products that people in my target industry already understand so when they go looking for a cheaper alternative to the super-priced big names, they find mine. I'm not inventing a new market.
It's not free money though. It's very code-heavy and technical-understanding-heavy and I've spent nearly 20 years actively developing it by now. One man wouldn't be able to just smash one out in a year, and you'd need some reasonably deep domain knowledge.
To some extent hackers are like the wind. They're a nebulous cloud of unidentifiable possible-people that you can't influence through shaming or laws or anything else. I think we should see them that way to make it clear that it's primarily the developer's responsibility.
Of course blame hackers when they're within reach too.
Vendors of engineering software used by car makers, on the other hand, have no such liability. It's software so its the user's responsibility.
Social engineering is also something that can be protected against by developers, at least to some extent. Yubikey type 2FA is more resistant to that than user-input TOTP codes, for example. Nothing's bulletproof but it could certainly be improved in many cases. Wasn't some company that experienced a credential stuffing attack recently sued for not requiring 2FA for its users?
We don't tolerate house builders who says "well there's always some way water might get into the framing, so we don't need to bother installing flashings properly - a bit of caulking will do instead."
Hackers are essentially a force of nature that will always exist and always be unstoppable by law enforcement because they can be in whatever country doesn't enforce such laws. You wouldn't blame the wind for destroying a bridge - it's up to the engineer to expect the wind and make it secure against that. Viewing them this way makes it clear that the people responsible for hacks are the developers in the same way developers are responsible for non-security bugs. Blame is only useful if you can actually use it to alter people's behavior - which you can't for international hackers, or the wind.
Banging this drum could be effective if it leads to a culture change. We already see criticism of developers of software that has obvious vulnerabilities all the time on HN, so there's already some sense that developers shouldn't be extremely negligent/incompetent around security. You can't guarantee security 100% of course, but you can have a general awareness that it's wrong to make the stupid decisions that developers keep making and are generally known to be bad practice.
The human effort idea is even a bit morally objectionable. You can feel that you're worth more than others because more of the lives of others were consumed to create your possessions. It's a zero sum game where poor people can never afford high-care art because their time is worth less than the artist's.