Why the infosec community is ahead of the curve and rationalists and nihilists
I want to believe this is somewhat accurate given the names dropped in this... tootstorm, but then the more I read it, the more alarm bells went off. The whole thing reads like a tired, old &quot;critique&quot; of a strawman of a group one doesn&#x27;t like, with a mix of hocus pocus nonsense on top.<p>The last two toots make for a particularly clear example:<p>&gt; <i>Chapman calls this &quot;fluidity&quot;, and that&#x27;s what today&#x27;s infosec community seems to be in: an acceptance of the coexistence of both &quot;nebulosity&quot; (boundaries are fuzzy, nothing is ever cut and dried, there are no universal truths) and &quot;pattern&quot; (form and structure still exist, things can still be &quot;more or less&quot; X or Y in a certain context).</i><p>I mean... this &quot;fluidity&quot; is <i>literally what the bayesian stuff is for</i>. Probabilistic reasoning isn&#x27;t in opposition to &quot;fuzzy boundaries&quot;, it&#x27;s <i>a formalization of it</i>. From this description, &quot;fluidity&quot; isn&#x27;t something new or superior, it&#x27;s just informal baby steps in the direction of what later became Bayesian modeling.<p>&gt; <i>the infosec community may be ahead of society at large in understanding change, nuance, and complexity. The world is filled with conflicts over boundaries and meanings.</i><p>Not if it rejects reason and starts buying into mathematical equivalent of homeopathy.<p>&gt; <i>Some want to impose rigid norms, definitions, and structures on everyone in a flailing attempt to restore certainty and order.</i><p>It&#x27;s definitely not those evil rationalists, given how rationalist movement is all about handling uncertainty (with maths!), and insistence on &quot;rigid norms, definitions and structures&quot; is the first thing it makes you unlearn.<p>EDIT:<p>Disclaimer is in order, I suppose - I&#x27;m triply biased here, because: 1) I have positive feelings towards the LessWrong flavor of rationality movement as it was in its heyday, and its intellectual contributions; 2) I have negative feelings towards the infosec industry in general, and 3) some years ago I actually worked on an infosec product and tried to add some provably correct probabilistic reasoning capacity to it, and found it to be an uphill battle against corporate and infosec cultures.