Its been a long 7 days. This time last week a security researcher was being raided by the FBI for pointing out a flaw in the airline system I've been pointing out for a long time now. The difference? He did it in a way the government couldn't ignore.
My thoughts on the "increased security" in airports aside, the worst thing you can do is convince people they're safe, when they're not. I lie, the worst thing you can do is put well meaning citizens in jail for trying to help. Now Chris hasn't seen jail yet, and I pray he never will, however this is the mentality in the US nowadays. From the government and from corporations. If you find a flaw, you better not tell anyone. If you tell people, the public better not find out. So long as its contained, nobody has to fix it. THIS IS WRONG! THIS LEADS TO SECURITY HOLES.
The absolute BEST systems in the world are vetted by many, many Smart People who Know Their Stuff and once they finally say it'll take too long to subvert the system (rather, it'll take longer to subvert the system than makes subversion worthwhile) the system is published so Everyone Else can have their crack at it. Don't believe me? Go read up on RSA, to name one. It's patented, and a de facto standard right now. It is published, so you, yes you, can go implement it yourself. This means every citizen out there can go implement it and have "secure comms". Of course, they may not implement it correctly, they'd probably hire some professional to check. This is how good systems work.
If you want a better example for those that don't speak crypto (I sure can't) check out Linux versus Microsoft. Microsoft hides their source code, and as such has bugs pop up in the wild. Granted, Liux is not perfect, and the first worm targetted it, but it does a lot better. WIth ALL the source code OPEN TO THE PUBLIC, it has a patch time way shorter than microsoft's, less security holes, and the ability for users to find bugs without having to be the target of an exploit first.
I've avoided publishing on this topic so far because I've been too close to the action, and quite frankly this could have been me. -------------------------------------------------------------------------------------------- I'd love to think that in this country of freedom I could speak my mind and not be worried. But this past week probably scared me more than Chris for some odd reason. Though he's the one that got screwed, I'm now seconded guessing everything I'll put in public. This post was censored as I wrote it, because I don't want to misspeak. This doesn't mean I'm at all involved with the case, I know Chris through research, its merely the thought that posting a security hole would have this reaction.
I'm in a foul mood, I'll leave you with this question. Is this the freedom you want? Or would you rather see an environment that fosters questions of security to makes itself better?
I'm not advocating overthrowing the government, subverting any of their systems, or supporting terrorism. Nor am I in any way saying I have ever done anything illegal, nor comtemplated it.
Those of you that know me know I'm not the type to hurt innocent people, nor put that ability in anyone's hands. I only point things out so they may be fixed and our kids will grow up in a better world than we did.
Comments (No responses yet)
