Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is what I marvel at when I read such (poorly justified) piracy screeds.

Are people insane?

I might not have ultimate faith in Microsoft, but comparatively I have zero faith (and a lot of suspicion) of what are essentially bands of thieves among piracy groups.

I engaged in casual piracy when I was a teen out of necessity, though I never felt the need to invent justifications. In my adult life, though...pirating executables is the domain of the naive or the ridiculously trustworthy.



Eh.

If anything, the scene is demonstration that a completely open, self-regulated market can function in at least some sense. Maybe one group doesn't have any strong disincentive to posting a corrupted release, but other groups have a strong incentive to discredit them, and reputation is valuable (as much as anything can be in a free economy). There is a fairly effective web of trust.

You can't be sure, of course, but then I can't be sure that my "legal" software won't install a rootkit behind my back either-- or if I am, it's because I'm going on the word of criminals who are trying to redistribute it.


I've got a lot more faith in a torrent uploaded by a person with lots of other torrents (who has no motive but reputation and altruism), with lots of seeders than I do in a corporation who has a clear and present motive to make me miserable.

And somehow, I've never been infected by this. It's my conclusion that, much like the *AA groups nonsense comparisons of piracy to theft, the security threats are overstated by companies in an attempt to scare people straight.


If it's a really good root kit, how would you know you have been infected?


Probably because I'd find the appropriated information used somewhere.

It's been at least 5 years with not a hint of fraudulent use of my ID or payment info.

I have, however, been victimized multiple times by corporations being negligent with my data in the same time period. Sony and whatnot.

Kind of interesting that it's safer to download random untrusted OS code from the internet than to give my information to a "safe" corporation...

In any case, it's an interesting thought experiment but it gets absurd quickly when realized. How do you know you're not infected right now by a "really good rootkit"? Unless you wrote the compiler by hand, compiled every bit of the OS by yourself, wrote the firmware for your hardware using the same compiler, etc etc etc, you can't be 100% sure.

You can be reasonably sure, of course. 99% with a few juicy trailing 9's for good measure, but not 100%.

It's the same way you can't objectively prove you're not dreaming right now.


Even if you wrote the compiler by hand, it doesn't matter. See the outstanding "Reflections on Trusting Trust": http://cm.bell-labs.com/who/ken/trust.html


Haha! Believe it or not, I had that story in mind when writing the previous comment. Really the only way to be 100% sure is to manually "bit bash" the compiler together without using ANOTHER compiler (like you would do if you're building a toolset for an entirely new architecture).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: