,
14 tweets,
2 min read
Read on Twitter
1/ Okay, this is a good analogy with cybersec. Let's explore it. I've lost 40 pounds in the last year and now regularly exercise.
2/ The tl;dr of this discussion is that your doctor is wrong.
3/ Doctors don't really know what a "good diet" is. Woody Allen joked about constantly changing diet advice in his movie "Sleeper" in 1973, and it's been constantly changing since them.
4/ I mean, they know a lot about what "bad diets" are, so it's not like they are stupid or ignorant. It's just that we demand from them more information about the subject than they really know.
5/ So we have the same problem as in infosec. It's a trope or cliche that the problem stems from some sort of moral weakness, like a bad diet, that if only you were stronger, you can fix.
6/ This "argument from authority" doesn't work, because people still lack understanding. They think their doctors says they need to cut down on fats, so they instead eat more sugary things instead, when sugar is probably even worse.
7/ It's like how people in infosec regularly do dumb things like use the same password for every website, so they don't have to write it down, because they think that's what infosec experts want: "don't write down your password".
8/ Eating less doesn't really work to lose weight, btw. I mean, it does, but your body is homeostatic. If you eat less it responds by lowering your metabolism. That's why losing weight is hard. It not simply "not be bad", but requires a lot of effort.
9/ So I got rid of my last doctor because she was the moralistic type, following those cliches. My new doctor is excellent. I have a back issue. His advice wasn't "here's what you should do" to fix it.
10/ Instead, his advice was "here's an exercise I think you will do", and "here's a pamphlet to learn more about it".
11/ I've almost completely resolved that back issue, btw, only experiencing the rare minor twinge.
12/ If your doctor's premise is that it's not their fault, because they told you the right thing, and you didn't follow their advice, then they are a bad doctor. The same is true of infosec, "I told them to keep patches up to date, they didn't, therefore it's not my fault"
13/ I'm not saying your health isn't your responsibility. Only you can decide what to eat. Only you an exercise. Only you can follow through on taking pills. Doctors can't make you do the right thing, only you can.
14/ But doctors giving you advice that they know you will ignore are bad doctors.
