Schneier on Security

Jesse Thompson • June 12, 2019 4:29 PM

ZOMG @Me is harassing @Mark! Humour is no excuse! Ban them from the conference!

Back to topic though, I wonder what parallels exist between harassment and system intrusion. On the face of it the second seems easier to define, but I’d argue that both (ordinarily) represent nothing but signals acted upon by the target system. An offended person “takes” offense, a compromised system explicitly runs unauthorized code.

In systems security, we recognize the immorality of sending signals to obtain unauthorized access, it is at some level a matter of respect to agree not to trespass upon another’s property, regardless how easy it may be to hop over that fence. But we also work to improve the robustness of systems to be able to automatically reject as many such signals as is feasible in order to weather the storms of the inescapable fact that out of seven billion other people, some of them aren’t going to behave morally.

It’s challenging to understand why the analogous interpersonal situation of “being prepared to be exposed to thoughts, ideas, words that one knows one might find offensive” is as frequently vilified as it is. Why shouldn’t we be expected to bear the burden of some responsibility over what inbound signals we choose to allow to influence our behavior and responses?