Brian in Pittsburgh Profile picture
Sep 16, 2020 19 tweets 3 min read Read on X
Adam may come to regret asking this.🙂 Because I most definitely have thoughts about some of the analytical lessons and methods taught, explicitly and implicitly, to those learning to "think like a lawyer" that can be useful much more broadly.

A perhaps slightly lengthy thread:
First, I think I have to talk about the power of reasoning by analogy.

If you get a legal education in an nation that has an Anglo-American system of legal traditions, you'll spend a lot of time reading case law and learning how to dissect case precedents.
And, eventually (at least in US law schools), to make written and verbal arguments about them yourself.
The whole exercise of extracting legal rules and figuring out how and whether they apply to a current circumstance is really an exercise in reasoning by analogy.
Once you start to get somewhat good at such things, you start to understand a bit about how powerful reasoning by analogy can be. When done well, it allows us to draw on powerful insights of those from the past and take advantage of experiences without reinventing the wheel.
Now, in doing so one must always be careful not to treat as similar things that should not really be treated as similar. And key parts of leaning how to reason and argue about precedent case law involve exactly that.
Second, I think the process of legal education teaches you to be better at separating evaluating the merits of an argument from what opinions you have generally about those that are making it or would benefit from it being accepted.
When you start reading those cases I mentioned, you'll quickly start coming across ones where you dislike what a certain party was doing, but you see the legal merits of what they are arguing in front of a court.
In other words, you see either why the law is on their side or why, for policy reasons and the greater good, the law should be on their side given certain facts in the case that will also be true in many other cases.
Separating out dislike, even revulsion, for one making an argument from evaluating the merits of that argument is a really hard thing. But if you commit yourself with intellectual honesty to the study of law (and, in many roles, the practice of it), you'll have to deal with that.
Third, the fact that in many exercises in legal education--and in many situations in some roles in the practice of law--you don't really get to choose which side of an argument you'd prefer to be on is helpful to your analytical development.
Being assigned a side and told to make the best arguments for or against something actually trains you in evaluating the strengths and weaknesses of positions in more rigorous ways.
If you're really learning the lesson, you start to see that many disputes which might appear clear cut are more closely balanced than many might appreciate.
Fourth, and finally (for now), I'll quickly mention learning the rules and techniques of techniques of litigation (at least under US law) , and some useful analytical lessons I've taken from that.
If you want to practice litigation in the US, you have to learn the rules of evidence and procedure.
Doing so hopefully gets you to think probably more than you ever have about what kind of proof really should be persuasive to you when it comes to accepting or rejecting claims.
(Note: Many who have been educated in and/or practiced law can find the effects of thinking like this seeping into interactions in their personal lives.
Trying to explain to your spouse why a point they're making is actually irrelevant isn't likely to go well.)
When it comes to trial practice and advocacy, let me also throw in a word about learning lessons from cross examination and how to deal with experts.
Cross examination in a court of a law can be one of the greatest devices for ascertaining truth there is. And the process of learning how to prepare cross--the in-depth study of the facts, the bringing of detail-oriented scrutiny--tremendously builds your analytical muscles.
Finally (really finally) the study and practice of litigation teaches you how to evaluate, scrutinize, and critically compare claims made by experts. Especially where there are competing experts on different sides. (And you can *always* find an expert to disagree with another.)
Whew. Anyway, those are my off-the-cuff🙂 thoughts about the question.

[fin]

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Brian in Pittsburgh

Brian in Pittsburgh Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @arekfurt

Apr 20
If you're worried about 0day exploitation of VPNs:
1. Use IPsec VPNs where possible.
2. use separate identity authorities at network and app layers
3. Make sure that at least app-level traffic (RDP, SSH, https) to admin boxes & Tier 0 is using cert pinning or other server auth
4. Actually take advantage of the ability to turn your double layer perimeter setup into a nightmare for any state actor unwise to exploit their way into it by baselining both typical network traffic patterns to and from the VPN and host telemetry from it.
Unless the attacker is pretty darn careful they will take actions on the exploited device that are rarely if ever should legitimately be seen.
("Wait, why did our VPN just initiate an *outbound TLS* connection to a residential ISP range?")
Read 4 tweets
Apr 19
So with all the negative talk about Microsoft security recently it occurred to me it's interesting to remember that MS also achieved one of the most consequential security successes of the last decade. A success that no one--including MS--ever talks about.

Hardening Office.
By Office, I mean of course the Office apps. Principally the Windows desktop apps, and especially the core three: Word, Excel, and PowerPoint.
Three of the most important pieces of software on the planet.

And also, until recently, among the most widely abused for initial entry.
If you have any experience at all with Windows security that runs beyond the last few years you know that very roughly from 2012 - 2022 or so the Office desktop apps provided either one of the most or *the* most widely abused routes for bad actors to get malware onto Windows PCs.
Read 24 tweets
Apr 15
It's honestly pretty funny to me how criticizing Microsoft has gone from almost verboten to The Hot New Thing among prominent infosec folks and journalists.
So let's talk about what is--and isn't--really wrong with Microsoft.
🧵
First of all, let's call out the elephant in the room:

From the standpoint of an MS shareholder who only looks at short-term returns there's nothing wrong with Microsoft's approach to security.

Indeed, things have never been better.
The security concerns of customers have allowed MS to join and then quickly dominate the security industry in selling add-on offerings, collecting tons of new revenue. With no concrete harms to MS's bottom line--to this point-- from leaving security problems underaddressed.
Read 24 tweets
Mar 26
So...
I'm starting to think the most practical software liability regime might use a tiered system of liability standards + safe harbors that--with some limits--would allow software makers themselves to select warranty/attestation levels for their own products.
Let me explain:
The idea behind this regime would be that software makers could largely--but not entirely (see following tweets)--select the degree of security quality they would warrant to customers their products would meet in a way both comprehensible to customers and binding on the makers.
This would help get market forces involved in actually doing things to push software security quality up where customers value more secure software, without trying to prescribe one set of standards for all organizations to meet for all purposes that software can exist to serve.
Read 22 tweets
Mar 3
The specific, urgent problem where gov agency cyber policy & messaging could probably achieve important gains relatively quickly:
Drastically reducing the number of easy-to-exploit, pre-authentication vulnerabilities in Net-facing software in use by critical infrastructure orgs.
(By "relatively quickly" I mean a few years vs decades.)

What if in addition to medium and long-term efforts and things that required extensive discussion, careful consideration, and/or Congressional approval CISA or somebody applied focused, aggressive attention toward that?
How could we go about tackling that?
Some ways:
Push relevant vendors to:

-Urgently conduct code and design reviews, re-reviews, and pen testing on the applicable pre-auth surfaces (Focusing especially on logical vulns). For completion in months, not years.

[cont.]
Read 10 tweets
Jul 14, 2023
Microsoft has released a fascinating, actually pretty transparent post on the recent cloud breach.
Notable:
1. MS unsure how (inactive) consumer/MSA key obtained.
2. A validation flaw allowed that to be used vs Exchange Online.
3. An important API flaw made the situation worse.
The most surprising news concerns point #3. There was a flaw in the GetAccessTokenForResource API that allowed the attacker here to renew access tokens by just providing the previous one, instead of requiring a new token signed by a proper AAD or MSA key. Image
On the one hand, the attacker already had an MSA signing key that (erroneously) allowed it to produce new tokens that could sign in to Exchange Online.
On the other, the API flaw could have allowed the attacker to maintain access if only that signing key issue had been corrected.
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(