Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Schneier's Keynote At Linux.conf.au

kdawson posted more than 6 years ago | from the necessary-security-theater dept.

Security 138

Stony Stevenson writes "Computer security expert Bruce Schneier took a swipe at a number of sacred cows of security including RFID tags, national ID cards, and public CCTV security cameras in his keynote address to Linux.conf.au (currently being held in Melbourne, Australia). These technologies were all examples of security products tailored to provide the perception of security rather than tackling actual security risks, Schneier said. The discussion of public security — which has always been clouded by emotional decision making — has been railroaded by groups with vested interests such as security vendors and political groups, he claimed. 'For most of my career I would insult "security theater" and "snake oil" for being dumb. In fact, they're not dumb. As security designers we need to address both the feeling and the reality of security. We can't ignore one. It's not enough to make someone secure, that person needs to also realize they've been made secure. If no-one realizes it, no-one's going to buy it,' Schneier said."

Sorry! There are no comments related to the filter you selected.

frosty piss (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#22230432)

Zoom in as I fill this mug.

Re:frosty piss (-1, Troll)

Anonymous Coward | more than 6 years ago | (#22230518)

BUT!

did that frosty piss come from a NIGGER DICK?!

if not, I want a full refund.

Hey (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#22230436)

Who gives a shit? Not many, I figure.

In other words . . . (3, Insightful)

base3 (539820) | more than 6 years ago | (#22230442)

. . . Bruce has figured out the real money's in security theater, not in security, and he wants a piece of that action.

Re:In other words . . . (0, Flamebait)

Anonymous Coward | more than 6 years ago | (#22230604)

Actually, Bruce wrote a crappy book copied from other sources, and couldn't hack doing real cryptography, so he's looking for other ways to look smart.

Security through obscurity: slashdot approach (0)

Anonymous Coward | more than 6 years ago | (#22230692)

It seems that the direction of slashdot has decided to make it difficult to read the good but controversial posts by removing the option from the main page. The default is now "Read the posts that suck", and go through hoops to reach the rest.

Already, dealing with the new display style was a pain in the ass to deal when using Firefox...

Re:In other words . . . (1)

oldhack (1037484) | more than 6 years ago | (#22230850)

Dude, say what you will about the dude, but his book (the red one) was and still is an awesome book that taught whole lot of us programmers the nuts and bolts of cryptography, both the algorithms and implementation, in a nice compact package.

Re:In other words . . . (1)

PurpleZebra (1201249) | more than 6 years ago | (#22230880)

Obviously someone doesn't know who Bruce Schneier is.

Re:In other words . . . (1)

Free_Meson (706323) | more than 6 years ago | (#22231414)

Obviously someone doesn't know who Bruce Schneier is.
His brother was in the Jaws movies, no?

Re:In other words . . . (1)

that this is not und (1026860) | more than 6 years ago | (#22233336)

You say that like a namedropper.

Schneier is someone who has accomplished a lot as an amateur cryptography hacker. Someone outside the 'credentialed' cryptography community who wrote a tremendously useful book 'for the rest of us.'

That doesn't make him a security expert. Cryptography and Security are two completely different things.

Go *fish! (2, Informative)

Mathinker (909784) | more than 6 years ago | (#22233932)

Yeah, that's why Twofish [wikipedia.org] was one of the 5 finalist algorithms of NIST's AES competition [wikipedia.org] .

And Blowfish [wikipedia.org] is still unbroken after 15 years.

I should be such a crappy cryptographer!

Video of Presentation (2, Informative)

Anonymous Coward | more than 6 years ago | (#22230808)

Re:Video of Presentation (0)

Anonymous Coward | more than 6 years ago | (#22231174)

It's probably worth linking to this from the main article - the mirror has gobs of bandwidth.

Re:In other words . . . (5, Insightful)

ppanon (16583) | more than 6 years ago | (#22230812)

No. What Bruce has realized is that, in the boardroom and the lunchroom (where almost nobody knows any better), security theatre often will kick the ass of real security practices because it's marketed by professional sales teams. It also often can be delivered for less (because it can be priced for what the market will bear).

If you want real security to be provided, you have to learn to sell it at least as well as the snake-oil. You have to make it sufficiently visible, but non-impeding, that people feel safe.

It's about understanding the human/political side of the equation that can make the difference between a successful deployment and a perceived failure.

Re:In other words . . . (4, Insightful)

QuantumG (50515) | more than 6 years ago | (#22230848)

It's an interesting theory but are you aware of anyone who thinks the bullshit we go through at the airport is for anything other than appearances? It's not just geeks and smart asses who know this, it is everyone.

Re:In other words . . . (1)

bigstrat2003 (1058574) | more than 6 years ago | (#22230948)

I know one person who really does think that. He's a fairly smart person, for the most part, but this one has always baffled me. Oh, true, he thinks that some of the measures are bullshit, but he fails to see that they're pretty much all bullshit... so he's in the same camp as the true morons, just a matter of degrees.

Re:In other words . . . (3, Informative)

QuantumG (50515) | more than 6 years ago | (#22231014)

Uh huh.. I, unfortunately, spend a lot of time in airports.. I've never once seen someone taking off their shoes with a smile on their face.. there's only one thing you think when they tell you to take your shoes off: "oh my god this is bullshit." If your friend actually thinks there is a sensible reason to scan the shoes of flyers then I suggest you get him some psychological help.

Re:In other words . . . (0)

ZombieRoboNinja (905329) | more than 6 years ago | (#22231138)

Remember when that idiot [wikipedia.org] put a bomb in his shoe and tried to blow up a plane? Ever wonder how many other idiots would have copied this brilliant idea if security DIDN'T make a show of inspecting shoes? Ever wonder if maybe a few of them would have succeeded?

I dunno, I guess I need some of that psychological help you were recommending.

Re:In other words . . . (2, Interesting)

QuantumG (50515) | more than 6 years ago | (#22231178)

Remember how that guy was foiled without the help of scanning and so the scanning of the shoes is completely superfluous?

Re:In other words . . . (1)

ZombieRoboNinja (905329) | more than 6 years ago | (#22231194)

THAT guy was "foiled" because he was extra-special dumb. He was trying to light his shoe IN THE SEAT OF THE PLANE. All he had to do was go in the bathroom - worst case scenario, the smoke alarm goes off and they think he's smoking in there.

Re:In other words . . . (3, Insightful)

QuantumG (50515) | more than 6 years ago | (#22231280)

I think you're laboring under the belief that:

1. the sole of a shoe can contain any significant amount of explosive
2. that walking on such a shoe would not cause the explosive to go off
3. that airport scanner technology can tell the difference between explosives and leather

None of which are the case. The only thing you could maybe fit in the sole of a very hard soled shoe would be a knife.. which hopefully people realize doesn't give a would-be hijacker any more of an advantage than being unarmed - if 50 scared passengers rush you, it doesn't matter that you have a knife. And that's what should have been the lesson of 9/11: if you allow yourself to be victimized you will die.. but if you step up and stop hijackers there is no way to hijack a plane.

All in all, I wish the government would just let the market decide. There should be a "no security" terminal where people can catch a plane much as you catch a bus.. buy your ticket, get on the next available flight. If you want to be harrassed, go to the security theater terminal.

In other beatings . . . (0)

Anonymous Coward | more than 6 years ago | (#22231334)

"if you allow yourself to be victimized you will die.. but if you step up and stop hijackers there is no way to hijack a plane."

Sorry, but I don't think you're being entirely fair to all the people who died on 9/11. The people didn't "allow" themselves to victimized. They went in with the expectation that this would be like any other hijacking up to that time. In hindsight this wasn't the case, but it's not fair to penalize people for making a reasonable decision at the time.

"All in all, I wish the government would just let the market decide. "

All in all capitalism with it's "lowest common denominator" economics and decisionmaking is a poor tool against an irrational force like terrorism.

Re:In other beatings . . . (1)

novakyu (636495) | more than 6 years ago | (#22231526)

All in all capitalism with it's "lowest common denominator" economics and decisionmaking is a poor tool against an irrational force like terrorism.
I don't see how terrorism is irrational. It is very rational. In fact, it is most rational thing some people can do. It's quite as simple as:

1. We meddle in other countries' affairs.
2. We tick the locals off.
3. The locals want to kill us.

It's as old as the "an eye for an eye." Are you saying that the oldest legal code in the western tradition is irrational? Are you saying that the Bible is irrational?

Well, maybe they are. But, if they are, then these terrorists are not any more irrational than the people held as saints in world's religions (and I don't mean just Islam), well, perhaps with the exception of Buddhism, but I don't know much about that.

Re:In other beatings . . . (1)

Calinous (985536) | more than 6 years ago | (#22231940)

"Are you saying that the oldest legal code in the western tradition is irrational?"

      I think this comes from the Bible (The Old Testament). Its point of origin is known as the Middle East.
      I don't know about western traditions - the Gauls or others

Re:In other beatings . . . (2, Informative)

novakyu (636495) | more than 6 years ago | (#22233558)

I think this comes from the Bible (The Old Testament). Its point of origin is known as the Middle East.
I don't know about western traditions - the Gauls or others
Egh. I was feeling lazy, but here is the Wikipedia page [wikipedia.org] about it. While most people may know it first from the Bible, I think it's the Codex Hammurabi that's often credited for having that written down first.

I am not a lawyer or a law student (so whatever I speak of "tradition of legal code" would be out of my arse), but this is the first written code of law to the west of China (and that's what I mean by "western"; like it or not, the Middle "East" and Muslims had frequent interaction with Europe, at least enough so if you want to divide the world into "East" and "West", they would fall in with "West"), so it must mean *something*.

Re:In other beatings . . . (1)

QuantumG (50515) | more than 6 years ago | (#22233554)

The people didn't "allow" themselves to victimized. They went in with the expectation that this would be like any other hijacking up to that time.
And let them selves be a victim of it because they figured it would be over soon. In other words, they failed to take action because they believed no action was necessary.. but if they had always taken action then no hijackings, ever, would have occurred because hijackers would have known that airline passengers are not willing to be victims. As it is now, airline passengers are willing to be victimized before they even get on the plane!

Re:In other words . . . (1)

nospam007 (722110) | more than 6 years ago | (#22232932)


All in all, I wish the government would just let the market decide. There should be a "no security" terminal where people can catch a plane much as you catch a bus.. buy your ticket, get on the next available flight.

In Europe they have such planes, they are called trains.

Re:In other words . . . (0)

Anonymous Coward | more than 6 years ago | (#22233518)

1. the sole of a shoe can contain any significant amount of explosive
2. that walking on such a shoe would not cause the explosive to go off
3. that airport scanner technology can tell the difference between explosives and leather

1. How much would you call significant? 1/4 oz? I could happily blow a plane out of the sky with 1/4 oz of Semtex and a crown cork off a beer bottle.

2. I'll have a 100 yard dash with anyone while wearing Semtex soled trainers, without fear of anything going amiss.

3. Most airports now have detectors that can identify objects with a high nitrogen content, such as explosives.

Having said all that, I think there should be a place for individual airlines deciding the level of intrusion that their customers are put through - as you say, let the market decide.

if you allow yourself to be victimized you will di (1)

Peter Simpson (112887) | more than 6 years ago | (#22233572)

How true. It's unlikely that 9/11 would succeed again, given the almost 10-to-1 passengers-to-badguys ratio. Even if they're armed, they'll run out of ammo, and a grenade is a threat, not a guarantee of success. I'd rather the TSA start a new campaign along the lines of the title sentence. Maybe make it a little more positive, something like "together, we can do something about it" and encourage individual and group action against threats, rather than treat us all like suspects.

Fat chance of that ever happening, though.

Re:In other words . . . (1)

MrLogic17 (233498) | more than 6 years ago | (#22233856)

>I think you're laboring under the belief that:
>1. the sole of a shoe can contain any significant amount of explosive
>2. that walking on such a shoe would not cause the explosive to go off

Dude, why do you think they suddenly started making people take their shoes off? Does the name "Richard Reid" ring a bell? Inept idiot or not, he does [ahem] totally blow away your argument.

http://www.google.com/search?q=shoe+bomber [google.com]

Re:In other words . . . (1)

QuantumG (50515) | more than 6 years ago | (#22234130)

Isn't the fact that it failed and had no chance of success anyway enough?

Or is the mere threat of an impossible bomb a problem.. oh yes, of course it is.

Re:In other words . . . (1)

bickle (101226) | more than 6 years ago | (#22234016)

"but if you step up and stop hijackers there is no way to hijack a plane." ...except for the the plane on 9/11 where the passengers *did* step up. They stopped the plane from reaching the hijacker's target, but it *was* hijacked.

Re:In other words . . . (1)

QuantumG (50515) | more than 6 years ago | (#22234144)

They didn't step up soon enough to prevent the hijackers from getting into the cockpit.

By the time they finally did something it was too late.

Re:In other words . . . (1)

SJ2000 (1128057) | more than 6 years ago | (#22231510)

If they really gave a flying fucking about security they wouldn't allow "Screwdrivers (seven inches or less in length)" in carry-on luggage. Seriously, are these people fucking stupid or what? You think I can't stab someone with a 6 inch screwdriver but I can with an 8 inch?
http://www.tsa.gov/travelers/airtravel/prohibited/permitted-prohibited-items.shtm#7 [tsa.gov]

Also (Video unavailable, it's on a tape and I currently don't have the equipment to digitise it) they wouldn't take scanned and verified checked-in luggage from the X-Ray machine back into the untrusted areas of the airport (shops, the line you wait in to put your baggage through the x-ray machine, ticket desks etc.) on an open trolley, unescorted, before going back into the trusted area and being loaded on to the aircraft.(LAX, Tom Bradly International Terminal within the last week)

Plenty of time and opportunity to steal baggage, or slip something into a bag of your choosing.

Let me guess, they use the camera's to watch the trolley's to ensure this doesn't happen?
Why the FUCK are they using trolley's in the first fucking place and not conveyors belts like EVERY other fucking international airport I've been to (South Korea, Paris, Heathrow, Melbourne, Sydney, Frankfurt, Amsterdam) so I'm fairly sure they don't have the initiative to follow them with cameras.

By the way, if you read the marketing posters next to the areas under construction within the Tom Bradly International Terminal, it has nothing to do with security. Just more waiting areas and seats.

But as long as I don't bring my Pudding of Death (over 3 oz, http://www.tsa.gov/travelers/airtravel/prohibited/permitted-prohibited-items.shtm#10 [tsa.gov] ) then all is well....once you actually get to the damn checkpoint, after all, the line has 300 people in it. Great traffic flow planning fuck-wits.

Re:In other words . . . (1)

bigstrat2003 (1058574) | more than 6 years ago | (#22231886)

I agree, it's stupid, but unfortunately, I can't force other people to see reason. If I could, we wouldn't have such bullshit things going on in this country in the first place. ;)

Re:In other words . . . (1)

DdJ (10790) | more than 6 years ago | (#22233490)

I've never once seen someone taking off their shoes with a smile on their face.

I do.

Mind you, I think it's bullshit. But the people at the airport are not the ones who caused the problem. The people around me have nothing to do with the decision making that went into it. The people it's appropriate to get mad at are nowhere around. A hostile reaction to the security theater while being subjected to it is itself an emotional, illogical response to the situation.

So, why get worked up about it while there? That'd make my day even less pleasant. So I smile, and chat with folks. If the topic comes up (and as you can imagine, sometimes it does), the fact that none of it makes us any more secure is one of the things we chat about. That helps more than grumbling or ranting.

Years ago my mother used to say to me, she'd say, "In this world, Elwood, you must be" -- she always called me Elwood -- "In this world, you must be oh so smart or oh so pleasant." Well, for years I was smart. I recommend pleasant. And you may quote me.

-Elwood P. Dowd

Re:In other words . . . (1)

base3 (539820) | more than 6 years ago | (#22233032)

That's exactly what I said, although in more flowery language--security theater is easier to sell than security, and thus, there's more money in it. So add some theater to to the non-snake-oil security, and . . . PROFIT!!!

Re:In other words . . . (1)

NoPantsJim (1149003) | more than 6 years ago | (#22230990)

I'm no expert on the subject, but my experience so far has been this, and I am a big fan of Schneier.

If you explain to a group of people why something is 'security theater' and then present an alternative, they flock to it. It does not matter that the alternative may also be 'security theater', as long as its shortcomings are of a different variety.

I have an opinion on this (-1, Flamebait)

Anonymous Coward | more than 6 years ago | (#22230448)

And it might be strange.

It has to do with all of the NIGGERS!!!!!!!!

coons!!!!!!!!!!

jigaboos!!!!!!!

porchmonkeys!!!

and don't forget the SAND NIGGERS and DUNE COONS!!!

love this line... (3, Funny)

Serious Poo (597509) | more than 6 years ago | (#22230460)

"tailored to provide the perception of security rather than tackling actual security risks." Isn't this also the mission statement for the TSA?

Re:love this line... (1)

fizzbin (110016) | more than 6 years ago | (#22230690)

If Bruce were giving his speech in the US rather than Australia, the TSA (Theater Security Agency) would get prominent mention.

So much of what they do, from checking IDs (ever seen an ID that says "Terrorist"?) to carry-on bag screening (violating privacy while missing guns and weapons) is pure theater. It provides the appearance of security, but not the reality.

Re:love this line... (-1, Flamebait)

Anonymous Coward | more than 6 years ago | (#22231142)

NO!!!!!!!!

The job of the TSA is to screen out all of the towelheads/DUNE COONS/SAND NIGGERS/whatever you want to call them.

I only ask one thing: if you are going to say they have a turban on their heads, for the love of God don't spell it "turbine". Doing that will only feed the trolls.

nigger nigger nigger

now c'mon, idiot mods. waste your points modding this down instead of modding up something edifying. for you idiot mods, i KNOW you CANNOT RESIST modding this one down. it said the keyword, "nigger". waste that point or two. you know you want to so get it over with. idiots like you shouldn't be modding anyway so waste it on an AC where it won't make any difference. DO IT FUCKER! DO IT!!

Re:love this line... (1)

bersl2 (689221) | more than 6 years ago | (#22231304)

"Unfortunately, we're stuck with us as a species."

Perceptions. (1)

Anonymous Coward | more than 6 years ago | (#22230462)

I'm sorry but what does RFID have to do with the "perception of security"? Barcodes don't make me feel safe, why should RFID? As for the latter (cameras). When was the last time you saw security video on the evening news, not to mention all those cellphone video shots. And the middle? Yeah my drivers license makes me feel soo safe.

Re:Perceptions. (1)

Whiney Mac Fanboy (963289) | more than 6 years ago | (#22230734)

I'm sorry but what does RFID have to do with the "perception of security"?

RFIDs have bugger all to do with security, but plenty of people are trying to push the perception that they can. Read this alarmist article [upi.com] . Check out its opening sentence:

An associate of Osama bin Laden crawls into a container -- along with some new luxury cars -- in a shipyard in Hamburg, Germany. The goal -- shipping himself to the United States and evading the Department of Homeland Security,
Lucky all terrorists are RFID-tagged!

Re:Perceptions. (1)

AJWM (19027) | more than 6 years ago | (#22230878)

That's okay, if the cargo container 6+ MeV x-ray inspection doesn't cook him, it should at least catch him.

Might not do those RFID tags much good, either.

Re:Perceptions. (0)

Anonymous Coward | more than 6 years ago | (#22233948)

...have bugger all to do with...
Pardon me, but if I may - what does this mean in this context? Does it, or doesn't it?

Re:Perceptions. (0)

Anonymous Coward | more than 6 years ago | (#22234044)

FYI : The phrase '...have bugger all to do with...' means '...has nothing at all to do with...'

CCTV - Worth its weight in gold (5, Interesting)

mungmaster2000 (1180731) | more than 6 years ago | (#22230552)

CCTV almost never captures what you set out to catch. In many organizations, it's a knee-jerk reaction to some kind of incident. ie) Something got pinched, someone received an ass-kicking, etc. Even if you do catch it, you'll never be able to identify/recognize/charge/convict the person based on the video image alone. 4CIF at 30 fps is pretty much as good as it gets right now in most feasible installations. All you'll be able to say is, "Subject is hatless...REPEAT...HATLESS!" (And that's even if he's in the frame). The PTZ will just pan around aimlessly on a tour program, or be pointed at the wrong thing. However, wide-spread deployment of CCTV systems is still not futile; you just usually end up catching something that were never really looking for in the first place. People and vehicular traffic movements, facility useage, or realtime video of an incident in progress that just happens to be going-on in front of the lens. You can establish time frames of entry or exit, or use it to clue-you-in to the right path to finding the real evidence you're looking for. From a security systems perspective, more CCTV is better, but not to mitigate direct and specific threats. Only general ones. Or sometimes you just luck-out and with a good booby shot in the atrium of an office building.

CCTV - HDTV (1, Informative)

Anonymous Coward | more than 6 years ago | (#22230744)

"Even if you do catch it, you'll never be able to identify/recognize/charge/convict the person based on the video image alone. 4CIF at 30 fps is pretty much as good as it gets right now in most feasible installations."

I wouldn't say that. [securityiss.com] (note the date)

Re:CCTV - Worth its weight in gold (2, Funny)

Whiney Mac Fanboy (963289) | more than 6 years ago | (#22230758)

Check out this article. [bbc.co.uk]

These guys would NEVER have been convicted without CCTV.

Absolute PROOF that CCTV works.

Re:CCTV - Worth its weight in gold (1)

springbox (853816) | more than 6 years ago | (#22230898)

That's like having an employee who regularly screws up but their employer decides to keep them because of that one time when they did something right. Is there any actual proof (more than one) that even more monitoring will actually do anything good?

Re:CCTV - Worth its weight in gold (1)

mungmaster2000 (1180731) | more than 6 years ago | (#22230970)

How do we know that it's not doing its job all along? You might document zero security incidents for a particular camera over a particular time period. But you'll never be able to measure the incident avoidance or mitigation (or even count the number of times) the bad shit that it prevented. Totally Heisenberg. And I know; we can't hide behind the "what-ifs." But security (and I mean all forms of security) is all like that. You'll never realize a measurable cost-benefit, but there's an inate sense within everybody that it's needed on some level. The tricky thing is to just not go overboard (as with anything). (The difference between scratching your ass, and tearing it wide open). CCTV is a tool, but that's it. Policing is a similar matter.

Re:CCTV - Worth its weight in gold (1)

ps236 (965675) | more than 6 years ago | (#22233306)

That's the case with all security.

Our burglar alarm at home has never gone off and meant that a burglar has been caught - but we have no way of knowing how many burglars have looked at our house and decided to go somewhere else instead because of the burglar alarm. So, we keep it. On a simplistic level it could seem like a waste of money.

CCTV may not catch many people committing crimes, but it may put off an awful lot of people.

Airport security may not catch many people trying to carry on 'dangerous' items (bottles of water etc) onto planes, but if it makes a few people decide not to bother trying, then it's a good thing in my book.

That's not to say that I don't think they're often dumb, and usually take it too far - like the time the metal detector went off when I went through it, and they told me to take my shoes off - scanned them, and then let me go on my way - no frisking or going back through the detector or anything - I could have been carrying an automatic rifle under my coat and they'd never have noticed... I did consider pointing this out to them, but decided against it, because I wasn't in the mood for probes in random parts of my body.

Re:CCTV - Worth its weight in gold (1)

mungmaster2000 (1180731) | more than 6 years ago | (#22230916)

The security systems integrator or security principal in charge of that CCTV installation should share the blame for that incident - By installing a camera that personnel had access to do such peeping with. It's irresponsible. Not to mention a major faux pas in today's era of privacy legislation. (Especially in my neck of the woods - Canada). You never put a camera in a place like that. And if you have a legitimate business need for CCTV coverage anywhere near such an era, you spec-out a system that has the "prohibited area" feature. That is, you can define a polygonal area of the screen that will always display black - either live and/or for archival purposes. So if Rowdy Roddy Peeper the Security Guard decides he wants to zoom-in on say a hotel room window, all that he'll see is the window frame, flood-filled with black. They say that in the physical security industry, you must respect everyone and yet trust no one. But I think that you also have to trust your security officers even less. If you give them some kind of power or ability, they'll abuse it because they're human. You gotta have controls in place to detect, deter, and prevent abuse. Just like a security guard's watchclock. Skip it, and he goes to sleep whenever he can.

Re:CCTV - Worth its weight in gold (1)

OzRoy (602691) | more than 6 years ago | (#22230786)

Well the obvious answer to that is to just put in more CCTV. We need more! THINK OF THE CHILDREN!

Re:CCTV - Worth its weight in gold (5, Interesting)

warrigal (780670) | more than 6 years ago | (#22230900)

Sometimes cameras can have a deterrent effect. I don't mean those lame dummy cameras, either.

Just the rumor that we were putting a camera system in our school practically eliminated graffiti

vandalism in a vulnerable area. The vandalism then took other forms, which were actually more of a problem.

Re:CCTV - Worth its weight in gold (1)

boarsai (698361) | more than 6 years ago | (#22231958)

On the flipside from my personal experience:

The apartments where I used to live we had security patrols and security cameras. Even with these deterents four men brazenly walked into the "secure" undercover carpark, broke my steering lock, hotwired and rode my motorbike out and off into the night.

Yes, my bike could probably have been a bit more secure if I'd taken extra precautions but I thought that surveilence would have been a bit of a deterant. Evidently these criminals were aware of the effectiveness of such cameras.

The cameras caught them in the act of course but the video captured is of such poor quality that you couldn't pick someone out of a lineup even tho their faces were captured staring at the cameras.

The same night my bike was stolen a scooter also went missing. Weeks later another motorbike or two got knocked off, even after I had warned the owners of my loss and suggesting they up their security (such as chaining bikes to poles etc etc). There's only so much you can do however and all you really manage to acheive is slowing them down somewhat... :(

Altho there is the chance that these guys thought they were simply dummy cameras... even so the poor quality of them makes you wonder why the hell they even bother. All I can tell you is 4 white blokes stole my bike. That may help in a very few select circumstances... but I never did see my bike again. :(

Yes, it was insured. Thankfully. Now convincing the significant other to allow me to get another bike? You cannot insure that chance unfortunately. I ride the train to work now.

Re:CCTV - Worth its weight in gold (0)

Anonymous Coward | more than 6 years ago | (#22232262)

Wrong! well, not completely. It is proven, that cctv has a deterring effect on only some crimes - the "planned" crimes. Only idiots would break open a car in a supervised lot. ut aggressive behaviour, and especially the so-called "anti-social behaviour" that most british apologists claim cctv to be usefull against, is something you do without using your head. drunken fights, being abusive and brutal is not something you plan. therefore, it might get caught on camera, but the fact that you might be filmed is not a deterrent.

Re:CCTV - Worth its weight in gold (0)

Anonymous Coward | more than 6 years ago | (#22231536)

Image enhancement software has become very advanced. In certain government departments and in law enforcement, even the worst, grainy images with bad lighting can be zoomed in on an infinite amount when enhanced with a progressive de-pixellation effect. The same technology has filtered down to TV shows such as NCIS, which is based on a true story.

Re:CCTV - Worth its weight in gold (1)

Vskye (9079) | more than 6 years ago | (#22232104)

All you'll be able to say is, "Subject is hatless...REPEAT...HATLESS!" (And that's even if he's in the frame). The PTZ will just pan around aimlessly on a tour program, or be pointed at the wrong thing.
In other words, you have crap ass cameras, or placement. I have NO idea on how this was rated +4 minus dumb ass mods.

Schnier's List (5, Funny)

jakepmatthews (1142845) | more than 6 years ago | (#22230564)

I think that would of been a catchier title...

Re:Schnier's List (1)

ScrewMaster (602015) | more than 6 years ago | (#22230956)

That's actually funny, mods. And it's not offtopic (God some people with mod points have no sense of humor.)

Re:Schnier's List (1)

jakepmatthews (1142845) | more than 6 years ago | (#22230996)

Thanks for that... those assholes are the same reason i have bad karma

Re:Schnier's List (0)

Anonymous Coward | more than 6 years ago | (#22231916)

Your spelling may have something do with it too. Getting the guys name wrong kind of ruins the joke.

Sacred Cows? (1)

devnullkac (223246) | more than 6 years ago | (#22230592)

Around here, they're more like whipping boys. Now, if he'd started in on Linux security...

Re:Sacred Cows? (1)

Zeinfeld (263942) | more than 6 years ago | (#22230978)

Around here, they're more like whipping boys. Now, if he'd started in on Linux security...

Well yes, kinda difficult to think of any forum where this type of presentation would be considered 'risky material'. But that does not stop it being any less true or needing to be said.

I do wish that Bruce would choose his targets a bit more carefully though. He has a tendency to come out with sweeping statements that sound good but don't mean quite what he intends them to mean.

Success... (0)

Anonymous Coward | more than 6 years ago | (#22230626)

depends on your definition.

As per Bruce Schneier: 'For most of my career I would insult "security theater" and "snake oil" for being dumb. In fact, they're not dumb.

This is an argument I have to make with friends when I claim that Bush-Cheney is the most successful administration in US history. I agree with exactly ZERO of what they have done but as far as scaring the shit out of people, robbing us blind, and in general being dicks you cannot argue that they are unsuccessful.

It is simply a matter of motivation and intention and the folks engaging in security theater are selling products. It's all about money and power.

Frito: "I like money though!"

Re:Success... (2, Insightful)

ScrewMaster (602015) | more than 6 years ago | (#22231002)

This is an argument I have to make with friends when I claim that Bush-Cheney is the most successful administration in US history. I agree with exactly ZERO of what they have done but as far as scaring the shit out of people, robbing us blind, and in general being dicks you cannot argue that they are unsuccessful.

It's all about your frame of reference.

I think of these things as kind of like an electric heater. Most people would argue that an electric heater is one of the most inefficient devices known to mankind. However, when viewed with the proper perspective, it's anything but. Put it this way: an electric heater is basically designed to waste power by transducing electrical energy into heat and spewing it into the immediate environment. A heater does this with virtually no losses. Therefore, an electric heater is almost 100% efficient, as long as there's nothing coming out of it that doesn't qualify as waste.

Which pretty much describes the Bush Administration.

Re:Success... (1)

novakyu (636495) | more than 6 years ago | (#22231574)

Put it this way: an electric heater is basically designed to waste power by transducing electrical energy into heat and spewing it into the immediate environment. A heater does this with virtually no losses.
Have you heard of Heat pumps [wikipedia.org] ? These things can put actually more heat into a house than the amount of electrical (anything other than thermal) energy spent.

This is one of the reasons that one shouldn't use the word "efficiency" with any device that actually turns work into heat. The best thing to an accurately representative "efficiency" would be the ratio of heat output per work, with that of Carnot heat pump at the top and that of electric heater at the bottom.

On the topic of the thread though, I do agree that the Bush administration was/is successful in their own way. They got all the tax cuts that they wanted passed, they got two terms (a traditional marking of a "good" president versus a "bad" president), and, heck, because of the spineless Democrats, they might even get scot-free with the NSA warrantless tapping responsibilities.

Re:Success... (1)

Petrushka (815171) | more than 6 years ago | (#22232734)

A heater does this with virtually no losses. Therefore, an electric heater is almost 100% efficient, as long as there's nothing coming out of it that doesn't qualify as waste.

I'm trying, but I can't imagine what might qualify as "waste" when all energy output is by definition the desired output. What are the things that you're thinking of that lead you to insert "virtually" and "almost" into the above?

Re:Success... (1)

bhima (46039) | more than 6 years ago | (#22233750)

I'm not sure I understand your point. Are you saying that if we had shoved an electric heating element up all the members of the Bush Administration ass's we get better efficiency from them. Or are you saying if we redefine success to mean something more along the lines of abject failure that we'd be seeing more successes from them? Or perhaps both?

Electronic Voting Security Theater (5, Interesting)

r7 (409657) | more than 6 years ago | (#22230628)

For many of the same reasons there is no semblance of a secure electronic voting platform on the horizon. The reason is not that such a platform would be difficult to design. The reason is that it would not be profitable.

To be secure it would have to be open. In the case of voting platforms that means every line of code, every encryption algorithm, and all the hardware has to be open, published, and known. Nobody has yet figured out how to make enough money from such a system to outspend Diebold's lobbyists and earn considered from election officials.

Re:Electronic Voting Security Theater (2, Interesting)

cduffy (652) | more than 6 years ago | (#22231208)

For many of the same reasons there is no semblance of a secure electronic voting platform on the horizon.
Does its support for using paper disqualify punchscan [punchscan.org] from being "electronic"?

Re:Electronic Voting Security Theater (0)

NoMaster (142776) | more than 6 years ago | (#22231562)

To be secure it would have to be open.
Bullshit.

It just has to be proved trustworthy. There's plenty of ways of doing that without having "every line of code, every encryption algorithm, and all the hardware ... open, published, and known".

Despite the fanboy-prattle, Open Source is not actually a solution to the age-old problem of "Quis custodiet custodes ipsos".

Re:Electronic Voting Security Theater (1)

bhima (46039) | more than 6 years ago | (#22231690)

The requirement that an algorithm be open has a lot less to do with Open Source as in Linux or BSD and lot more to do with the algorithm development process. This is the origin of the Obscurity is not Security mantra.

Show us a modern closed encryption algorithm which does not have significant vulnerabilities. Off the top of my head I am not aware of one. However, there are plenty of examples of closed algorithms which are abject failures. Like what's used on DVDs, HD-DVDs, or Phillips' RFID tags. There are also examples of secure algorithms which are secure. Like AES.

To my knowledge the difference is having the algorithm open to scrutiny during the development process. Like the contest which created AES.

Bruce describes these observations (and factual history) in his book "Practical Cryptology" and publishes a virtually constant stream of positive examples on his blog. I am unaware of any examples which negate these observations.

Electronic Voting Security Theater-DES. (1, Insightful)

Anonymous Coward | more than 6 years ago | (#22231770)

"Show us a modern closed encryption algorithm which does not have significant vulnerabilities. "

DES in stream mode.

Re:Electronic Voting Security Theater-DES. (1)

bhima (46039) | more than 6 years ago | (#22231996)

DES is not closed. It's not all that modern either.

We nerds and geeks need to wake up to theater (4, Interesting)

mlwmohawk (801821) | more than 6 years ago | (#22230754)

As a nerd and geek and long time hacker, it is perfectly clear to me that I've been missing the "theater" aspect of the technology that I love.

Take Linux for instance. I have had varying levels of success getting non-geeks to use it, but what is missing is the warm and fuzzies that make it psychologically comfortable to not be using Windows or a Macintosh.

There are two sides to change of any kind. (1) The actual details of change. (2) The psychological affirmation that it is worth the effort. No matter how valid the argument presented by the first, if it does not provide the second, it will fail.

If we wish to push Linux, we have to create theater around it.

Re:We nerds and geeks need to wake up to theater (1)

prxp (1023979) | more than 6 years ago | (#22230992)

And you think that's the reason Scheneier does what he does, right?

Re:We nerds and geeks need to wake up to theater (1)

MightyYar (622222) | more than 6 years ago | (#22231026)

Take Linux for instance. I have had varying levels of success getting non-geeks to use it, but what is missing is the warm and fuzzies that make it psychologically comfortable to not be using Windows or a Macintosh.
The warm and fuzzies is better known as Microsoft Office with Outlook.

Re:We nerds and geeks need to wake up to theater (0)

Anonymous Coward | more than 6 years ago | (#22232666)

You mean you get pins and needles trying to use it?

That's why we have Compiz & Emerald... (0)

Anonymous Coward | more than 6 years ago | (#22231100)

I must admit, the desktop cube is a luxury we could live without - but until I tried it, I did not realize that it is useful: Compiz makes the multi-desktop environment much more accessible during actual work sessons. It's an ergonomic success story.

The theater of wobbly windows with transparent borders, the 3D close order drill app switcher, and of course the dancing cube effect, break the non-user's paradigms about (and against) Linux in about 20 seconds.

Re:We nerds and geeks need to wake up to theater (1)

novakyu (636495) | more than 6 years ago | (#22231602)

Take Linux for instance.
Don't you mean GNU/Linux? There is already a "theater" fo GNU/Linux: Freedom. We are not just fighting for technical superiority, we are fighting for the freedom of the people—just like a secure e-voting machine would, by the way of allowing fair and efficient election to be held.

Why would you go looking for a "theater", when you have such a ready-made cause (one that's been around for over two decades, no less!) for you? All you have to do is join.

Re:We nerds and geeks need to wake up to theater (1)

zcat_NZ (267672) | more than 6 years ago | (#22231738)

There isn't the "Black Ice stopped a portscan" "AVG detected a virus" "Adaware detected 3275 cookies which could have reporting your every move directly to the NSA" "Windows has detected a NEW MOUSE!! OMFG!! [Allow] [Deny]" kind of security theatre though...

Re:We nerds and geeks need to wake up to theater (2, Interesting)

novakyu (636495) | more than 6 years ago | (#22231838)

I guess it might be just me ... but some of those sound like those annoying popups these "security" applications have.

A colleague of mine has something called "Comodo" on some kind of paranoid mode on his computer, and whenever I use his computer (we share it because in addition to being his office computer, it's also used for some common task), it's annoying. I think I usually see something around 1 popup a minute, like "pidgin.exe is writing to XXX", allow or deny? "blah.com attempted to connect to xxx.xx.xxx.xxx", allow or deny?

Unless I am the only one really annoyed by those needless warnings that condition the user into clicking "allow" for everything, I'm not sure if that's such a good thing.

Anyways. If you are looking for a simple catch phrase that might impress others, I think uptime of most GNU/Linux servers might be a good thing (this is "security" in a different sense---security from developer idiocy)---my notebook didn't need any reboots for a month or longer (numerous hibernations, though), until some proprietary application wanted me to reboot (for no apparent reason) and I naively followed, until I realized that neither the application nor its author had a freaking clue about how things are in GNU/Linux (or, indeed, simple Unix) world.

Re:We nerds and geeks need to wake up to theater (1)

mlwmohawk (801821) | more than 6 years ago | (#22233538)

Why would you go looking for a "theater", when you have such a ready-made cause

Yes, I used to have that attitude, but in the past few years, I have sort of changed my mind. When you think that half the people you meet are below average intelligence.

Time and again, I've seen people too afraid or too unenthusiastic to use or stay with Linux. I've told them the arguments, they all say they agree, they all say they hate Windows, but they go back because they are comfortable with it. That's what "Cheerleaders" and fans do at a football game, they add a psychological support and create "comfort."

With all the marketing that Microsoft puts out, even with all the crap that Windows has/is, people still feel better using it. The cheerleading adds rah! rah! to Windows use. It doesn't make sense to me, but it is a fact.

We Linux users have made that psychological leap that is more than just the facts. People who are more emotional in their thinking, need the emotional comfort probably more than the comfort. To bring it back to the originalk argument, that's why people buy stuff that makes them "feel" secure as opposed to actually being secure.

Re:We nerds and geeks need to wake up to theater (1)

zcat_NZ (267672) | more than 6 years ago | (#22231704)

This is why I always install avscan and firestarter when setting up Linux for recently defenestrated users...

Obligatory Bruce Schneier Fact (1)

kwabbles (259554) | more than 6 years ago | (#22230856)

Bruce Schneier expects the Spanish Inquisition.

Re:Obligatory Bruce Schneier Fact (0)

Anonymous Coward | more than 6 years ago | (#22231468)

In Soviet Russia, the Spanish Inquisition expects YOU!

who cares? (-1, Flamebait)

Anonymous Coward | more than 6 years ago | (#22230902)

linux is for dick smokers

Schneier is an expert of the chaos! (0, Redundant)

prxp (1023979) | more than 6 years ago | (#22230930)

Bruce Scheneier specializes himself on saying the obvious about the chaos. In other words, he is an expert on publicizing what most serious researches already know about general security flaws and problems. I dare anyone to find any real, down to earth, proposal from this man that would mitigate any of the problems he so easily evidentiates.

Its futile. (1)

madbawa (929673) | more than 6 years ago | (#22231106)

There's no point in designing a good security system that provides 'actual' security coz Schneier can hack it with one roundhouse kick to the keyboard.

The Reality and Perception of Security (4, Insightful)

canterbury rod (1229414) | more than 6 years ago | (#22231330)

In Bruce Schneier's keynote address at Linux.conf.au, he essentially admonishes that "security theater" is not only a necessity, it's a critical component that needs to accompany real security solutions. In the article, he states

the best security solution will fail if it doesn't cater to both the reality and perceptions to do with security.
He's affirming that sales in the marketplace will be driven when security theater and real security products are matched. That's when end-users will also experience a real sense of security.

It's Still Dumb! (2, Interesting)

Jane Q. Public (1010737) | more than 6 years ago | (#22231538)

These "perception of security" things are still bad, because they create REAL threats to security, in the name of trying to make people feel more secure.

I will take the reality over a false perception, any day.

Re:It's Still Dumb! (0)

Anonymous Coward | more than 6 years ago | (#22233846)

Unfortunately, you don't have that choice when it comes to society as a whole as opposed to your own personal security.

The only choices are have are snake oil - making people feel good without actually doing anything - or making people feel good *while also* actually doing something. "Actually doing something without making people feel good" would require an intelligent population that doesn't swallow every last bit of FUD and fear-mongering bait, hook and sinker, but we don't have that.

Don't confuse the way things OUGHT to be with the way things ARE. A less-than-perfect solution that works in reality is better than a perfect solution that doesn't - and can't.

Ah...NOW I get it! (2, Insightful)

hyades1 (1149581) | more than 6 years ago | (#22231630)

I guess this would explain why just about everybody in Canada thinks crime is on the increase, even though the numbers conclusively prove otherwise.

You can't sell security hardware and convince nervous old women to throw away their rights if they know there's a long list of things more important than so-called "security". And a lot of those "nervous old women", by the way, are male, in their 30's, and convinced that everything will be fine if we just forget all that due process nonsense and start trusting the cops to throw the right people in jail.

Re:Ah...NOW I get it! (2, Interesting)

BlackCreek (1004083) | more than 6 years ago | (#22232546)

I guess this would explain why just about everybody in Canada thinks crime is on the increase, even though the numbers conclusively prove otherwise.

You can't sell security hardware and convince nervous old women to throw away their rights if they know there's a long list of things more important than so-called "security".

I often think about the political impact of the population ageing in Europe (where I live). There is a lot of political analysis about everything but never around the fact that, well, the population is getting on average older, and that older people tend to have a more conservative take on life, and IMO are easier to be made afraid of "different new stuff" (like having more non-Caucasians and/or Muslims living in their society).

The other day I read about strong xenophobic language being used by politicians in Treviso, Italy. It went about how African immigrants were a great danger for the old people. The article was keen to mention that none of the perceived wave of violence was backed by official statistics. (Note that that is just something I read in the news, so I might be missing lots about it).

In Belgium, and the Netherlands there is often very strong xenophobic language being used by (relatively) successful mainstream politicians.

As I see it, dangerous foreigners/muslims/immigrants youngsters are really in the forefront of the justifications for the increase in surveillance in Europe nowadays (along with the "think about the children" argument).

I'm often under the impression that a strong factor in the success of this line of argumentation is the fact that these populations are getting older, affecting not only their own opinion but also the whole cultural tone of their societies.

I don't argue that that is only the cause, but I think its role its mostly underestimated.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?