"Everyone should be deploying BCP 38! Wait, they are ...."

Tue Feb 18 20:56:19 UTC 2014

On 2/18/2014 2:19 PM, James Milko wrote:
> Is using data from a self-selected group even meaningful when
> extrapolated?  It's been a while since Stats in college, and it's very
> likely the guys from MIT know more than I do, but one of the big things
> they pushed was random sampling.
>
> JM
>
>
Isn't it probable that people who know enough to download the spoofer 
projects program and run it might also be in position to fix things when 
it's broken, or they may just be testing their own networks which 
they've already secured, just to verify they got it right.

I may put it on my laptop and start testing random places like 
Starbucks, my moms house, conventions and other things, but if I'm 
running it from my home machine it's just to get the gold "I did this" star.

So yeah, data from the project is probably meaningless unless someone 
uses it as a worm payload and checks 50,000 computers randomly (of 
course I don't advise this.  I just wish there was a way to really push 
this to be run by everyone in the world for a week)

Maybe with enough hype we could get CNN to advise people to download 
it.  Actually, it would be nice if someone who writes security software 
like NOD32 or Malwarebytes, or spybot, adaware, etc, would integrate it 
into their test suite.  Then you get the thousands of users from them 
added to the results.