On Tue, Aug 03, 2010 at 12:15:33PM -0400, Jarod Wilson wrote:
> Yes, a professional will steal your car no matter what. A dumb kid
> looking for a joyride is slightly more apt to take the car that is
> unlocked with the keys in the ignition than the one that is locked
> with no keys in sight.
 
It's amusing to me that you use this example.  A friend of mine had
his Mustang 5.0 LX stolen right out from under his nose.  He had his
windows up, doors locked, and the car had an alarm, which went off.
After hearing a car alarm, he went to the window to see if it was his,
and arrived just in time to watch the thieves driving his car away...
mere seconds later.  The cops caught up with the theives (though were
unable to apprehend them) and reported that they were kids out on a
joyride.  The car was later found abandoned, and quite damaged.

The police said that those cars are targeted by pros and ameteurs
alike, because they're fairly common, and they're fast, fun cars to
drive, and take for a joyride.  Very often, basic security just isn't
enough, if you're a target.  Running services that have a scripted
exploit makes you a target.

On the other hand, the nature of computer attacks is different from
other types of attacks.  It's more about time vs. numbers:

> Its not about feeling secure. Its about keeping out stupid idiots. SSL
> + auth keeps stupid idiot vandals out. And to me, that's Good Enough
> for a non-critical system like a mythtv box. The determined will
> always find a way in if they really want to.

It's probably enough.  The script kiddies usually don't much care if
they don't get you, because their script is going to get dozens or
hundreds of others.  They're not going to try very hard, because they
don't need to.   Having been one myself, I know that security
types tend to get a bit overzealous about security of things that just
don't need it.  But I also know that non-security types are often
appeased by things that are just not helping...

FWIW, I also tend to disbelive Richard's suggestion that The Club
actually makes your care more likely to be stolen...  I can't find any
hard statistics, but (purported) experts still say it deters casual
theives (i.e.  joyriders), which I believe.  Insurance companies are
still offering a discount for using it AFAIK.  Insurance actuaries
know what they are doing, and take their business very seriously; if
the Club made your car more likely to be stolen, offering a discount
for using one would eat into their profits, and they would stop the
practice.

-- 
Derek D. Martin    http://www.pizzashack.org/   GPG Key ID: 0xDFBEAD02
-=-=-=-=-
This message is posted from an invalid address.  Replying to it will result in
undeliverable mail due to spam prevention.  Sorry for the inconvenience.