Schneier on Security

David Harmon • July 14, 2005 8:37 AM

I agree that the prologue was a bit confusing. The interview as a whole was properly credited, but the layout didn’t distinguish the prologue as such.

Bruce speaks much of the “agenda’ of an agency. I’d say the real problem in America is that the current Administration has its own agenda, unrelated to any proper agenda of the national government as such.

Bluntly, the Bush II administration is led by a cabal which has been operating at least since the Nixon administration. Their agenda is simply to remove all impediments to their own power and profit. Unfortunately for the rest of us, those impediments include the Constitutional rights of the citizenry, accountability of public officials, and the rule of law in general.

As I’ve said before, my primary hope against these guys is that they are sufficiently out-of-touch with reality, that they may not recognize when their grip starts slipping.

David Harmon • July 14, 2005 9:58 AM

Whoops, in editing that last post, I lost my context points:

Actually improving American security is not on BushCo’s agenda, so if we citizens want security, we cannot depend on government action to provide it for us. Bruce’s idea of enforcing liability on companies is not “optimal” in terms of side-effects or edge conditions, but it has two big advantages over “enforcement from above”:

One is that administration or no, the business community needs the liability system to remain functional (lest contracts become unenforcable), and so they will make sure it doesn’t get too badly damaged, at least for intercorporate conflicts.

The other advantage of liability is that instead of depending on a government agency (== single point of failure 😉 ), civil suits are “prosecuted” by the aggrieved party, acting in their own interests. Remember how Microsoft managed to drag out their anti-trust case until a change in administration? (Yes, wealthy companies or persons can also abuse the civil courts, but that’s where the first point came in.)

David Harmon • July 14, 2005 12:16 PM

Wendy, I’d say that what you’re calling “psychological due diligence” amounts to reassuring the public that they’re being taken care of.

I feel that a true leader deals with the problem first, and then explains to the public how it’s been taken care of. In contrast, a mere politician goes for public opinion first, and deals with the problem only as a means to that end. (And a demagogue doesn’t even try to deal with the problem 😉 ) A bit of security theater may well help with public confidence, but not if said public isn’t already confident in the authorities!

David Harmon • July 15, 2005 8:24 AM

Bruce vs. Davi:

Okay, and I thought I was prone to digression… 😉 For starters, the Middle Ages are just irrelevant, notably as per the Chinese Law of Relativity. In any case, we started with Bruce’s:

“Our security intuition evolved in a world where nothing ever changed. Fear of the new made a lot of sense in that kind of world.”

Bruce picked the wrong word here; he probably wanted “instinct”, which evolved over millions of years. It’s not so much that “nothing ever changed”, as that brief changes and challenges just got folded into “long-term conditions”. That is, it didn’t matter if we were dealing with jackals or jaguars, the point was we wanted their food, while they wanted us for food. Negotiations begin with a stare….

But the business of where our decisions come from happens to be something I’m very interested in, so here comes my Big Picture spiel….

The human mind is a many-layered thing, from the spinal cord and medulla (physiology, reflex, pain) through the limbic system (emotion, instinct), and on through several mammalian layers (more “instinct”, learning, intuition, thought, reason) to the cerebral cortex. This stack accumulated through megayears of evolution, culminating in the 1-2 megayear sprint that produced our current bodies and brains. Only the topmost layers on this stack would even notice a blip like the Middle Ages — and our “fast” responses to security-type situations mostly depend on the bottom few layers:

Emotion and reflexive responses vary a good deal among humans (“temperament”), but for a given human, they’re easier to work with than to change. In a group, however, the most suited person for a task will naturally tend to gravitate toward that task.

Instinct for humans is surprisingly flexible on a group level, because much of human instinct seems to have been converted to imprinting and prepared learning. That is, we “draw cards” from a a deck representing much of our primate and mammalian heritage. But that happens very early in life, in response to our earliest comprehensible signs of what sort of world we’ve been born into. (E.g.: Am I getting enough to eat? Which parents are present and attentive? Do passers-by smile at me, or are my parents hiding me from them? etc.)

Our most basic personality patterns and ideas about the world are formed in the first few years of life. This is when we develop expectations about how the world works — first the physical world, then the social world. (Also language, but that’s by the by.) If those expectations don’t match what we meet when we grow up, we get cranky about it. (“When I was a boy, there weren’t all these buttons and blinky lights… and girls didna wear lingerie in public!” 😉 )

True intuition is part of the next layer up, the layer that’s most outraged by our current pace of change. This is where our learning abilities project upwards from “animal territory” to intertwine with language and abstract thought. It’s where we learn the details of our social and physical environment (including customs and laws) and develop the appropriate habits and responses for this year’s environment. This layer was what turned humanity from a scrawny ape into an world-shaper, but it’s not really “finished”, in that much of our learning still happens at sub-verbal levels. “Intuition” describes our access to this sub-verbal learning, including all the expectations and habits that we never really needed to put into words.

Of course, with or without words, we expect what we’ve learned to stay useful, and get upset when it doesn’t: (“I took typing in school, but what’s with all these extra keys?” “Grr, this new program has the commands in all the wrong places!” “Permission denied? Dangit, this is my computer!” etc…) We can learn new things even as adults, but for most humans, this is an anxious and uncomfortable business. The problem with “modern” life is, that’s happening too often. Every time we think we’ve mastered our current environment, it changes (again), keeping us in that anxious “figure it out” condition longer than is really healthy for us.

Of course, “we techies” are individual specialists in new stuff, defined by prolonged curiosity, better abstraction ability, etc. This subtype is useful enough to human groups, that it’s a secure part of our instinct/temperament “library”. We can help explain things to normal folks, and sort out new situations for them. But the thing is, Joe Sixpack is never going to like learning new things as much as we neophiles do. He wants us to deal with the tech problem for him, just as the priestly sorts deal with gods and spirits, the warriors deal with predators and enemies, etc.

These days, we just can’t do that, largely because there are too many new developments for the proportion of neophiles available. Normal people rarely get a chance to learn enough about new technology to have useful “intuition” about it.
So, Joe gets an ulcer from his inability to control his own environment, much less deal with the global demimonde known as the Internet.

Okay, end of spiel. (For now 🙂 ) I’ll be happy to discuss things further by E-mail, but I suspect this comment thread is soon to be left behind by a continuing stream of new topics….