This World of Ours (2014) [pdf]
Mood
heated
Sentiment
mixed
Category
tech
Key topics
security
intelligence agencies
cybersecurity
The Hacker News community discusses James Mickens' 2014 essay 'This World of Ours', debating its points on security and the role of intelligence agencies like Mossad, with some praising its insights and others criticizing its tone and assumptions.
Snapshot generated from the HN discussion
Discussion Activity
Very active discussionFirst comment
49m
Peak period
154
Day 1
Avg / period
40
Based on 160 loaded comments
Key moments
- 01Story posted
10/27/2025, 8:28:43 AM
23d ago
Step 01 - 02First comment
10/27/2025, 9:17:26 AM
49m after posting
Step 02 - 03Peak activity
154 comments in Day 1
Hottest window of the conversation
Step 03 - 04Latest activity
11/3/2025, 8:06:35 PM
15d ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
I have a fond memory of being at a party where someone had the idea to do dramatic readings of various Mickens Usenix papers. Even just doing partial readings, it was slow going, lots of pauses to recover from overwhelming laughter. When the reading of The Slow Winter got to "THE MAGMA PEOPLE ARE WAITING FOR OUR MISTAKES", we had to stop because someone had laughed so hard they threw up. Not in an awful way, but enough to give us a pause in the action, and to decide we couldn't go on.
Good times.
I'm going to be job hunting soon and I was planning to prioritize the Bay Area because that's the only place I've encountered a decent density of people like this, but maybe I'm setting my sights too short.
There are nerds everywhere.
My favorite is The Night Watch.
hilarious AND scary levels of prescient writing...
Expect to lose in highly surprising ways.
most have big heavy barriers and multiple bollards and fences. some of the reston va data centers have big glorious planters out front and weird angles to walk up to the mantrap -- to prevent trucks from driving through. the generators usually have some sort of fence or bollards, and most are on multiple power sources from the local and airport grids.
source: used to manage nova data centers and did plenty of attack surface mapping. the truck-through-front-door approach is consistently considered.
However given AWS is so complex (which is required because they want to be a gatekeeping platform) leading the uptime to struggle to match a decent home setup, I'm not sure. I'm sure there's no 6 figure bonus for checking the generators are working, but a rounded corner on a button on an admin page?
When you start successfully reaching many people you can be sure that security agencies will start watching you.
If you vocally oppose your tyrannical government, you won't avoid a bomb on your head. In the best case you'll get a bullet through your head. Worst case, you spend a lifetime in a prison.
"It’s the reductionist approach to life: if you keep it small, you’ll keep it under control. If you don’t make any noise, the bogeyman won’t find you. But it’s all an illusion, because they die too, those people who roll up their spirits into tiny little balls so as to be safe. Safe?! From what? Life is always on the edge of death; narrow streets lead to the same place as wide avenues, and a little candle burns itself out just like a flaming torch does."
If relevant adversaries don't know which computer to burn the exploit on, then they won't burn it on the right one.
Alas, no matter how hard we try to trust our compilers, we must also adopt methods to trust our foundries.
Oh, we don't have our own foundries?
Yeah, thats the real problem. Who owns the foundries?
While having your own foundry is undoubtedly a good thing from the perspective of supply chain resiliency, if hacking is what you're worried about there are probably easier ways to mitigate (e.g. a bit more rigor in QC).
There's a reason the NSA can get Intel CPUs without IME and you can't. Given the incentives and competence of the people involved, it's probably an intentional vulnerability that you can't escape because you don't fab your own chips. There's strong circumstantial evidence that Huawei got banned from selling their products in the US for doing the same thing. And the Crypto AG backdoor (in hardware but probably not in silicon) was probably central to a lot of 20th-century international relations, though that wasn't publicly known until much later.
And this is before we get into penny-ante malicious hardware like laser printer toner cartridges, carrier-locked cellphones, and HDMI copy protection.
No amount of QC is going to remove malicious hardware; at best, it can tell you it's there.
This is also a completely different threat model but whatever.
A small country that imports these chips and wanted to protect its national security by providing "me disabled" chips wouldnt need a whole foundry of its own to turn it off or to verify that there isnt a "hidden" ME. The cost of this would probably run into low millions not billions.
It might not be an intentional backdoor, but it very much seems designed with out-of-band access in mind, with the AMT remote management features and the fact that the network controller has DMA (this enables packet interception).
>Otherwise you're just going to be making stupid mistakes that real cryptographers and security folks found and wrote defenses against three decades ago.
Yeah, thats the point, learn those same techniques, get it in the guild, and watch each others backs.
Rather than just 'trusting' some faceless war profiteers from the midst of an out of control military-industrial complex.
so unless you're worth all that trouble, you're really just trying to avoid being "low hanging fruit" compromised by some batch script probing known (and usually very old) vulnerabilities
or they just pay the $2100 per API call to download it from the telco or social media company.
it's not improper if you agreed to give a company the ability to sell your data to anyone -- the government is anyone, and they have the money.
<NO CARRIER>
If you are a target you are screwed. But clever crypto isn't useless.
Most people just don't care enough until after they're hacked, at which point they care just enough to wish they'd done something more previously, which is just shy of enough to start doing something differently going forward.
It's not that normies are too stupid figure this out, it's that they make risk accept decisions on risks they don't thoroughly understand or care enough about to want to understand. My personal observation is that the concept of even thinking about potential future technology risks at all (let alone considering changing behavior to mitigate those risks) seems to represent an almost an almost pathological level of proactive preparation to normies, the same way that preppers building bunkers with years of food and water storage look to the rest of us.
I do use password manager and disk encryption, just for case of theft. Still feels like one stupid sleepy misclick away from losing stuff and no amount of MFAs or whatever is going to save me, they actually feel like added complexity which leads to mistakes.
And even if the CIA/Mossad/NSA/whoever is "interested" in you - this is the era of mass surveillance. The chances that you're worth a Stuxnet level of effort is 0.000000001%. Vs. 99.999% chance that they'll happily hoover up your data, if you make it pretty easy for their automated systems to do that.
Honestly, the oversimplification here reads to me more like something Bob Jones could use to justify not caring about "b0bj0nes" not being a great password.
Best would be non-text, binary strings. Since I already use a password manager, I don't really need to type passwords by hand. But I do understand most people prefer text passwords that could be entered by hand if necessary.
Or: This is Bob "Dim Bulb" Jones we're talking to. KISS, and maybe we can convince him to upgrade his password to "iwantacoldbeernow".
Sorry, your password does not meet complexity requirements because it does not contain at least one of each of the following: uppercase letters, lowercase letters, numeric digits, nonalphanumeric symbols.
“I want 1 cold beer now.”
Sorry, your password may not contain spaces.
“Iwant1coldbeernow.”
Sorry, your password is too long.
“Iwant1beernow.”
Sorry, your password is too long.
“1Beer?”
Sorry, your password is too short.
“Password1!”
Thank you. Your password has been changed.
(Have you ever attended an academic security conference like Usenix Security?)
Anyone else see all the drones flying over a peaceful No Kings assembly?
Actual security is possible even against the most powerful and determined adversaries, and it's possible even for you.
There's so many cock-ups etc. that you can read about Wikipedia that I don't understand why people hold these people highly and imagine them to be so able. They simply aren't.
(Portions of the US intelligence apparatus knew, but that knowledge didn't transition into action)
It's one of the many asymmetries that changes when you are the defender versus the attacker. As the defender, you have to be right 100% of the time. As the attacker, you have the luxury of being right only 30% of the time. The law of large numbers is on the side of the attacker. This applies to missile offense/defense and to usage of intelligence.
This information asymmetry is also one of the key drivers of the security dilemma, which in turn causes arms races and conflict. The defender knows they can't be perfect all the time, so they have an incentive to preemptively attack if the probability of future problems based on their assessment of current information is high enough.
In the case of Gaza there was also an assessment that Hamas were deterred, which were the tinted glasses through which signals were assessed. Israel also assumed a certain shape of an attack, and the minimal mobilisation of Hamas did not fit that expected template. So the intelligence failure was also a failure in security doctrine and institutional culture. The following principles need to be reinforced: (i) don't assume the best, (ii) don't expect rationality and assume a rival is deterred even if they should be, (iii) intention causes action, believe a rival when they say they want to do X instead of projecting your own worldview onto them, (iv) don't become fixated on a particular scenario, keep the distribution (scenario analyses) broad
An example of this is France cutting off all support after Israel's initiation of the Six Day War, which followed signals such as Egypt massing troops on the border. The problem for Israel was the lack of strategic depth combined with the geographical low ground, which creates these hair trigger scenarios with no room for error, reducing the threshold to act preemptively. The more abstract problem was the absence of a hegemon in the late 20th century that had security control over West Asia, which is a necessary and sufficient condition for resolving the security dilemma.
Interesting number you suggested. That's a pretty normal success rate for a carnivore attacking prey.
b. The Mossad is the equivalent of the CIA, they are not meant to act inside Israel
For that purpose is Gaza inside or not inside Israel?
And asking how did they miss something is like asking how come AWS has downtime. But I'm sure you could come to this conclusion on your own if you didn't really want the answer to be something else.
The amount of examples we've seen of this is staggering.
The real ROI is to land a Jonathan Pollard. Not even a million Hegseths can leak enough info to collect into one Pollard.
> If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone
It's like a Mossad agent read this paper and thought hey that's actually not a bad idea.
But the core rant is about dubious assumptions in academic cryptography papers. I was also reading a lot of academic crypto papers in 2014, and the assumptions got old real fast. Mickens mocks these ideas:
• "There are heroes and villains with fantastic (yet oddly constrained) powers". Totally standard way to get a paper published. Especially annoying were the mathematical proofs that sound rigorous to outsiders but quietly assume that the adversary just can't/won't solve a certain kind of equation, because it would be inconvenient to prove the scheme secure if they did. Or the "exploits" that only worked if nobody had upgraded their software stack for five years. Or the systems that assume a perfect implementation with no way to recover if anything goes wrong.
• "you could enlist a well-known technology company to [run a PKI], but this would offend the refined aesthetics of the vaguely Marxist but comfortably bourgeoisie hacker community who wants everything to be decentralized", lol. This got really tiresome when I worked on Bitcoin. Lots of semi-technical people who had never run any large system constantly attacking every plausible design of implementable complexity because it wasn't decentralized enough for their tastes, sometimes not even proposing anything better.
• "These [social networks] are not the best people in the history of people, yet somehow, I am supposed to stitch these clowns into a rich cryptographic tapestry that supports key revocation and verifiable audit trails" - another variant of believing decentralized cryptography and PKI is easy.
He also talks about security labels like in SELinux but I never read those papers. I think Mickens used humor to try and get people talking about some of the bad patterns in academic cryptography, but if you want a more serious paper that makes some similar points there's one here:
If you have a single company, then that's easy enough for a group like Mossad to infiltrate. Probably easier than a distributed system.
That's assuming they can figure out who you are in the first place. My pipe dream for the internet (that I thought we were getting way back in the 90's) is total anonymity. You can say whatever you like about the mossad, or the NSA or the KGB or whatever you like, and they'll never be able to figure out whose cellphone to replace with a piece of uranium.
We have the technology to make it happen (thanks to the paranoid security researchers!) just not the collective will to allow it.
I mean go read 4chan, a place where there is something like total anonymity. Those people are constantly imagining that half the comments on the site are generated by intelligence agencies and, who knows, maybe they are right? I really do wonder if there is any way to reap the rewards of total anonymity without the poison of bad actors.
I'm somewhat moderate on the issue from a practical point of view. I think citizens have a right to some sort of reasonable privacy and I don't think laws which try to regulate the technical mechanisms by which we can have it make sense, no matter how evil the use of the technology is. But I don't think that, in the end, it is beyond the remit of authority to snoop with, for example, a court order, and the means to do so. I expect authority to abuse power, but I don't think that technological solutions can prevent that. Only a vigilant citizenry can do it.
And for added fun, that same radical decentralization crowd, finally settling on the extremely centralized Lightning crutch, which is not only centralized but also computationally over complicated and buggy.
you dont understand the mating behaviors of naked mole rats bc of some sense of "usefulness". Its just an investigation of nature and how things work. The usefulness comes out unexpectedly. Like you find out naked mole are actually maybe biologically immortal
You should just find interesting phenomena and invetigate. Capitalism figures out the usefulness side of things
Debian is probably the only example of a successful public public-key infrastructure, but SSH keys are a perfectly serviceable form of public-key infrastructure in everyday life. At least for developers.
Mickens's skepticism about security labels is, however, justified; the problems he identifies are why object-capability models seem more successful in practice.
I do agree that better passwords are a good idea, and, prior to the widespread deployment of malicious microphones, were adequate authentication for many purposes—if you can avoid being phished. My own secure password generator is http://canonical.org/~kragen/sw/netbook-misc-devel/bitwords...., and some of its modes are memorable correct-horse-battery-staple-type passwords. It's arguably slightly blasphemous, so you may be offended if you are an observant Hindu.
Oh, you mean PEP 506. I wrote this program in 02012, and PEP 506 wasn't written until 02015, didn't ship in a released Python until 3.6 in 02016, and even then was only available in Python 3, which I didn't use because it basically didn't work at the time.
PEP 506 is just 22 lines of code wrapping SystemRandom. There's no advantage over just using SystemRandom directly.
Can you elaborate on this? I don't understand the context for malicious microphones and how that affects secure passwords.
Microphones on devices such as Ring doorbell cameras are explicitly exfiltrating audio data out of your control whenever they're activated. Features like Alexa and Siri require, in some sense, 24/7 microphone activation, although normally that data isn't transmitted off-device except on explicit (vocal) user request. But that control is imposed by non-user-auditable device firmware that can be remotely updated at any time.
Finally, for a variety of reasons, it's becoming increasingly common to have a microphone active and transmitting data intentionally, often to public contexts like livestreaming video.
With the proliferation of such potentially vulnerable microphones in our daily lives, we should not rely too heavily on the secrecy of short strings that can easily leak through the audio channel.
But this is an example of the kind of thing the OP is talking about. You're probably not at a very realistic risk of having your password hacked via audio exfiltrated from the Ring camera at your front door. Unless it's Mossad et al who want your password.
I'd argue that for every Assange and Snowden, there are 100 (1k? 100k?) people using Tor for illegal, immoral, and otherwise terrible things. If you're OK with that, then sure, fine point.
> SSH keys
Heartbleed and Terrapin were both pretty brutal attacks on common PKI infra. It's definitely serviceable and very good, but vulnerabilities can go for forever without being noticed, and when they are found they're devastating.
That was the quote I was referring to. Also, of course I didn't say that no one should have any privacy; I simply implied a high moral cost for this particular form of privacy.
It is accurate to say that Tor's hidden service ecosystem is focused on drugs, ransomware, cryptocurrency, and sex crime.
However, there are other important things happening there. You can think of the crime as cover traffic to hide those important things. So it's all good.
The third result was "FREE $FOO PORN" where $FOO was something that nearly the entire human race recognizes as deeply Not Okay and is illegal everywhere.
I wonder what % of the heinous-sounding sites are actually providing the things they say they are.
I'm sure that some (most?) of them actually offer heinous stuff. But surely some of them are honeypots run by law enforcement and some are just straight up scams. However, I have no sense of whether that percentage is 1% or 99%.
“Manning up and facing trial” sounds fair in theory, but under the Espionage Act there’s no public-interest defense. He’d be barred from explaining motive or the public value of the disclosures, much of the case would be classified, and past national-security whistleblowers have faced severe penalties. That’s why he sought asylum.
The only thing I see is that both are contained and quarantined. The threat of both has been neutralized to the degree where I think the espionage agencies of all these countries are playing along together to keep the engine of their craft going uninterrupted without fuss.
In other words, you have to be gullible to think an embassy cares about protecting Assange. It’s a phone call from the secret service director saying “Keep him there for now, it’s where we want him.”
Also, the Southern part of the country (which I am pretty much not related culturally at least on folklore and tons of customs) managed to bribe even the Russian mafias. They were that crazy, it's like a force of nature. OFC don't try backstabbing back these kind of people, some 'folklorical' people are pretty much clan/family based (even more than the Southern Italians) and they will kick your ass back in the most unexpected, random and non-spectacular way ever, pretty much the opposite of the Mexican cartels where they love to do showoff and displays. No, the Southern Iberians are something else, mixed along Atlantics and Mediterranean people since millenia and they know all the tricks, either from the Brits/Germanics to Levantine Semitic foes...
You won't expect it. You are like some Mossad random Levi, roaming around, and you just met some nice middle aged woman on a stereotyped familiar bar where the alleged ties to some clan must be nearly zero, and the day after some crazy Islamic terrorist wacko with ties to drug cartels will try to stab you some Sunday in the morning and he might try to succeed with the dumbest and cheapest way ever.
No, is not an exaggeration. We might not be Italy, but don't try to mess up with some kind of people. My country is not Mafia-bound, but criminal cartels, mafias and OFC some terror groups from the Magreb (and these bound to the Middle East ones) have deals with each other because of, you know, weapons and money. And Marbella it's pretty much a hub.
The range of things people do on security is wild. Everything from publicly expose everything and pray the apps login function some random threw together is solid to elaborate intrusion detection systems.
2FA isn't going to protect me from cruising altitude walkie talkie detonation and having the debris scattered over an impossibly wide area.
I guess the best thing to do is not take an airline of a country that has recently showed public support for Gaza specifically during a humanitarian visit in the months prior to my flight.
Thankfully none of this is true and everything the mainstream media and governments tell us are true - imagine if things weren't as they seemed?.. Craziness... Back to my password manager!
I like his using Mossad as the extreme. I guess "Mossad'd" is now a verb.
https://scholar.harvard.edu/files/mickens/files/thenightwatc...
> A systems programmer will know what to do when society breaks down, because the systems programmer already lives in a world without law.
31 more comments available on Hacker News
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.