Comic 916: Randall, the Security Expert

Well, well, well. Raven SO badly wanted to do a review, and I was ready to take a well-deserved break, but then she was all "I can't post it until Saturday!" Since I respect you guys far too much to force you to wait that long, I'll take over. I wouldn't want this to turn into xkcdsucks, and I'm sure none of you want that either.

So what have you got for us, Randall?


Title: Unpickable; alt-text: The safe is empty except for an unsolved 5x5 Rubik's cube.

Well, the good news is that Randall has ditched the wordy, drawn-out, monochrome format of yesterday's comic, and instead given us a half-colored single panel. At first glance, I like this: whatever point he's making is likely to be punchy, there are no characters so there's no stilted dialogue, and the art isn't awful. It's not his best work, but it's far from his worst.

The basic idea here is that if you're going to be attacked by geeks, you're best leaving your stuff in an inconspicuous place while giving them a problem to keep them occupied. I expect this is a response to how hacking groups like LulzSec conduct their attacks; they hit high-profile targets just to show they can, so you're better off being under the radar. In short, Randy makes a semi-legitimate point about the nature of hackers, and he does it with color and the right amount of panels. Good job, I guess. You look at it, you laugh, and you move along.

However, this wouldn't be a criticism blog if I didn't dig deeper into the strip and pick it apart. Let's start with the obvious flaw. Anon 1:12 on the xkcdsucks blog said, "Security through obscurity does not a joke make." I disagree with the premise; it's solely because the idea is nonsensical that it becomes a joke. However, he has a very valid point about security through obscurity. It's AWFUL. It's probably the worst "security" there is, and if you're trying to keep your stuff safe, leaving it out in the (hidden) open is the worst thing you can do, regardless of who's attacking you.

Also, in the course of reading and reviewing the strip, I was reminded of another xkcd. If you can't be bothered to click the link, the summary is that nerds think that if they make their security system elaborate enough they'll be safe forever, when the reality is that all it takes is one weak link (in this case, the drugged and bludgeoned owner of the system) to get through. Today, Randall is saying just the opposite: If the security is elaborate enough, you can toss your valuable stuff in a shoebox, because the hackers will never get through the (incidentally unimportant) safe, and they won't think to go the easy route first.

That's why this strip fails when 538 doesn't. Comic 538 presented a stupid situation based on a geeky stereotype, but then it went deeper and showed the problem with that situation! Comic 916 shows no such self-awareness. It presents the stupid idea and just runs with it. Perhaps if the alt-text has said something like, "Of course, security by obscurity is doomed to fail. But a nerd can dream, can't he?", I might be more tolerent. But, much to my chagrin, it says nothing like that.

And having said that, we've reached my biggest annoyance with the strip: the alt-text. "The safe is empty except for an unsolved 5x5 Rubik's cube." But you just said the safe is unopenable! How did the cube get in there? How will it be gotten out? And why would the hackers bother with it? If you're breaking into a website, you're doing it to steal or screw with the data underneath. Remember when the PSN got hacked and credit card numbers were compromised? Do you think the hackers would've sat there and tried to defraud those accounts right then and there? No! If the Rubik's cube interested the hacker, he would take it and be on his way. He wouldn't sit there playing with it.

So, in summary: decent comic on the surface, lousy composition underneath. It's still one of Randall's better works recently (which admittedly isn't saying much).


P.S. The original image of the comic had an ugly, out of place line of color on the right side of the safe; you can see it on Raven's mock-up (get it? because she's MOCKING it? -_-) of the strip here (by the Z). As of the writing of this post, that's gone. Now, I don't really fault Randy for not going "DOO DOO DAH DOO! I MADE AN ERROR!" However, it just shows what a hack he is. He's sloppy and doesn't actually review his work before posting it for the world to see. I guess that's what you get when your brainstorming process starts at 11:50 PM.