A Hacker's Mind: How the Powerful Bend Society's Rules, and How to Bend them Back

by Bruce Schneier

It’s not that the security mindset, or a hacking mentality, will solve the world’s problems. It’s that the world’s problems would be easier to solve if everyone just understood a little more about security.

hacks are something the system allows. And by “allows,” I mean something very specific. It’s not that it’s legal, or permitted, socially acceptable or even ethical—although it might be any or all of those. It’s that the system, as constructed, does not prevent the hack from occurring within the confines of that system.

It might sound naive and idealistic, but systems of trust are what make society work. We don’t demand airtight protection in our agreements, because (1) that’s impossible to achieve, (2) any attempt will be too long and unwieldy, and (3) we don’t really need it.

Most people don’t hack systems, and those systems work pretty well most of the time. We rightly trust that most people don’t hack systems. And we have systems to deal with hacks when they occur. This is resilience. This is what makes society work. It’s how we humans have dealt with hacking for millennia.

people react to risk more on the basis of stories than data. Stories engage us at a visceral level, especially if they’re vivid, exciting, or personally involving. A friend’s story about getting mugged in a foreign country is more likely to affect how safe you feel traveling to that country than will a page of abstract crime statistics. Novelty plus dread plus a good story equals overreaction.