Anti-Security Frequently Asked Questions</head> <body> <th valign=top align=left><br><br> <i>(this is free-speach copyright, mean like i told that to you freely in personal/public talk, so you can do anything to it)</i><br> <font color="red">Q: </font>Why security is bad thing?<br> <font color="red">A: </font>In short - <i>hell is totally secure</i>. Do we want live in hell?.. If people follow security at first everywhere - probably we will still live in den.<br><br> <font color="red">Q: </font>What is nature of security?<br> <font color="red">A: </font>Nature of security is restriction, destruction and antagonism to freedom. That thing is balance freedom. Wrong is - in current situation - process of security - grow much faster then freedom. And that speed is not accident - that is artifically stimulated by <i>technology of war</i>. We are now stand on fork and choosing between totalitarism or freedom. And governemt always glad to help us choose first.<br><br> <font color="red">Q: </font>Technology of war in security? What do you mean?<br> <font color="red">A: </font>When <i>people</i> improve weapon to beat other <i>people</i>. Other people, of course, improving own weapon too. Keyword is "people vs. people".<br><br> <font color="red">Q: </font>Who profits from the infosec war?<br> <font color="red">A: </font>Security companies do (this is their line of employment). They need to use scare tactics to motivate more people and companies into thinking their services are not only desirable, but necessary. It's simple Capitalism. These corporations make security popular and fashionable, and turn it into a consumer pastime. Why can't they carry out their jobs with less glamour?<br><br> <font color="red">Q: </font>How do scriptkiddies help security?<br> <font color="red">A: </font>This is an easy answer. The term was coined as a whip fashioned by various "security experts" with which to flog the public. They show us depictions of these lawless, rabid, savage kids who are out of control, so they can impress upon us the demographic from which they defend us.<br><br> <font color="red">Q: </font>Can I sleep safely at night while Bugtraq is around?<br> <font color="red">A: </font>Absolutely not.<br><br> <font color="red">Q: </font>How does Bugtraq help security?<br> <font color="red">A: </font>Bugtraq serves as a front for an underground cabal through which electronic weapons of mass destruction disseminate amongst scriptkiddies. It is also an addictive substance which has hooked admins trying to preserve their systems' security without getting owned by the "early bird" defacer who grabs the exploit before their local ISP has been notified of the vulnerability. However, even Bugtraq publicizes a false concept of "full disclosure," since information about competitors or friends (like @stake) is tossed in the trash. Full disclosure simply serves to sate the scriptkid's addiction to power, and this addiction is very hard to break. antiSecurity aims to help stop that addiction.<br><br> <font color="red">Q: </font>What's wrong with full disclosure?<br> <font color="red">A: </font>Full disclosure attempts to contradict the saying "two wrongs don't make a right" in the sense that it stimulates criminal activities in order to catalyze security awareness. Take the following example:<br>An unrestricted maniac runs around the streets, shooting people in the name of improving security because he aims to increase the public use of bullet-proof vests. And who makes these vests? After everybody is protected by vest v1, the public is complacent, and sales of vest v2 must be stimulated by inventing a shotgun which penetrates the first vest. There is competition in the vest manufacturing business, so they all profit from the development of higher powered munitions. Manufacturers get money, and also lobby for pro-homicidal laws in other countries to spread the market, while innocent people suffer at their expense. The cycle still doesn't end with vest v666, because a newer armor-piercing bullet is in the works. How do you end the rat race? Stop full disclosure!<br><br> <font color="red">Q: </font>We should fix all bugs! How could it be otherwise?<br> <font color="red">A: </font>Imagine terrorist control nuclear bomb from box on internet, and nobody can terminate bomb controlling process to stop countdown. Or your house is absolutely secure but you lost key by accident - how you will return in your own home? In real world security is always limited - nobody make safe doors everywhere and lock them. In case of emergency you will need access w/o keys. Absolute security is nonsense. People forgot about that for computers and trying to reach it..<br><br> <font color="red">Q: </font>Isn't all hackers is a bad people?<br> <font color="red">A: </font>No! People are different, but probabilty of bad person in 10 or in 1000000 is different... (hint about script-kids). And i tell you if compare hard working person who know cost of own work and idling kid or newbie - who will do shit very likely?<br><br> <font color="red">Q: </font>All admins are good/bad people?<br> <font color="red">A: </font>No! Think! So don't attack EVERYBODY, and don't protect EVERYBODY! If you pretect bastards you are on bastard's side. Do you know BOFH admins are exists?<br><br> <font color="red">Q: </font>Why worry about security? Vulnerabilities will always exist and there is no absolute protection against them.<br> <font color="red">A: </font>Exactly correct. But if problem can't be solved in dumb way, this is don't mean it is can't be solved indirect. This is why many of us have safeguarded ourselves with security measures such as encrypted or steganographized filesystems in the case that our sensitive information is accessed in an unauthorized manner. Security will never be absolute, but technological developments will continue to be made to push possible system security as close to absolute system security as possible.<br><br> I can't disallow people come to my computer, but I can make another restriction so even if them come they can't access data. I put encrypted disk. Side efect is i need always enter password myself and id slower disk operation.<br> We can fight spam. But we can disable relaying email thru our system for unknown.<br> Can't stop DDOS attack but can make global tracking system over internet.<br> We can't restrict access for one, so we restrict for everybody. This is cost of security. More and more progressive restrictions.<br> <font color="red">Q: </font>I just love finding bugs, though. What's wrong with that?<br> <font color="red">A: </font>Air Force pilots loving flying planes, too. Sometimes they even find themselves flying missions over Hiroshima and Nagasaki.<br><br> <font color="red">Q: </font>What are "grayhats" and how are they different from whitehats and blackhats?<br> <font color="red">A: </font>Grayhats are indecisive people who consider themselves to be neither blackhats nor whitehats, or both blackhat and whitehat. However, being a grayhat, is not synonymous to existing in a "healthy medium." Rather, these individuals do not pledge allegiance to either side of the controversy, and in not doing so, commit blunders that hurt supporters of both viewpoints.<br><br> <font color="red">Q: </font>Is antiSecurity motivated in any part by personal profit?<br> <font color="red">A: </font>Can true freedom be reduced to the sole notion of economy? What seems odd in all of this is that many of Bugtraq and Packetstorm's followers are aficionados of free, open-sourced operating systems which have been provided as efficient and stable alternatives to highly commercialized and unduly popular OS'es such as Windows. But when it comes to security, they can't understand that measures they take towards "freeing information", such as full disclosure actually serves to fuel commercialism in the security market. How can we bring this to popular attention?<br><br> <font color="red">Q: </font>Is antiSecurity trying to change the world? Isn't that a bit radical?<br> <font color="red">A: </font>Everything is going to sound a bit ambitious at first. But it's got to start somewhere. So far, we have had manifestos published on the net concerning the ethics of hacking, defacement, and the definition of a "hacker", but we have yet to see a comprehensive document or set of documents that defines the parameters of anti-disclosure policies. The discussion has, up until this point, been an imbalanced one. Generally, disclosure is discussed on forums such as Bugtraq, which obviously have a predominant pro-disclosure following. Supporters of non-disclosure very rarely make similar postings for obvious reasons: they avoid the glare of the public limelight. The antiSecurity site is the perfect non-threatening environment in which open intellectual discussion relevant to this topic can take place. (So in answering the question, yes, we are :)<br><br> <font color="red">Q: </font>What does antiSecurity suggest we do about people who siphon their reputations off the hard work and creativity of others (ie Aleph1, route) ?<br> <font color="red">A: </font>This is probably the simplest answer of them all: don't support them. Don't subscribe to their mailing lists, don't read their 'zines, don't use their software. Who said boycotts won't work on the Internet?<br><br> <font color="red">Q: </font>Is there anything I can do to help?<br> <font color="red">A: </font>Yes! We would greatly appreciate any assistance. Please email any proposals or suggestions you might have, including essays or rants to <a href="mailto:anti@security.is">anti@security.is</a>. Whatever happens, don't post to Bugtraq! If you still can't stop yourself from doing this, try posting fake exploits and advisories, or trojaned code :) Remember that anybody who consciously decides to fire a loaded gun at somebody has already decided to accept the consequences.<br><br> <font color="red">Q: </font>Give me your root password, or i don't believe you!<br> <font color="red">A: </font>Obviously, you have failed to either read or comprehend any of the contents of this document. You might want to read this FAQ again, but there's a chance that won't do you much good.<br><br> <br><br> <i>[This page was written by the staff of anti.security.is(RIP). All credit to them.]</i> </body> </html>