Thread by @ErrataRob

It's the classic issue of "normative" and "positive" descriptions that pretty much every industry faces.

"normative" means things you thing SHOULD happen

"positive" means the things that DO happen

https://twitter.com/hacks4pancakes/status/1494304237593014275

It's probably biggest in Economics, where it's hard to have a rational discussion about what DOES happen because people are so concerned with what SHOULD happen.

It's a lot easier with physics or chemisty.

It's a big problem with law. There's a wide gap between what the CFAA DOES day and what people think it SHOULD say.

Infosec was up in arms that F12 "view-source" isn't criminal hacking, but that was a NORMATIVE statement. Nobody read the Wisconsin law to see what it DOES say.

POSITIVE statements aren't "victim-blaming". Instead, "victim-blaming" relies upon NORMATIVE statements.

It's not victim-blaming to say that if your outside in that area at night you'll get mugged, that's just a fact. It's victim-blaming to say you deserve to get mugged.

Or conversely, it's victim-blaming for the police to say they aren't going to do anything about it, or prosecutors to say they won't prosecute, because you SHOULDN'T (normative) been in that area at night.

With the recent SuperBowl QRcode issue, there's a mixture of both, and on both sides.

The entire purpose of QRcodes is for you to scan them. A SuperBowl add is probably the SAFEST of all QRcodes to scan.

But this comes close to saying "you shouldn't have to worry about the security of QRcodes, because that's what they are there for", which is a NORMATIVE statement.

The question is whether they are secure.

But conversely, the opposite is also normative, "you shouldn't do something risky like scanning QRcodes". This is a normative statement by infosec experts, claiming that your risk-aversion should be the same as their risk-aversion.

What's lacking on either side of "QRcode security" debate is POSITIVE descriptions of what the security risks are.

The answer is that phones ask you to confirm every action, and in a multi-step process, you have a chance to see risk before something happens.

Yes, it's largely safe to click on QRcodes and visit websites. No, it's very unsafe to then enter login information. So scan QRcodes to see the restaurant menu, but don't scan QRcodes to log into your MetaMask or banking account.

(MetaMask is a popular cryptocurrency/NFT wallet where people get hacked a lot through scanning QRcodes -- and then entering in their pass codes).