Why do people, even programmers and geeks, seem to almost feel the urge to "give hackers a fair chance" at stealing their data? [closed]

Question

I once heard that the author of the early NES emulator "Nesticle", clearly a very intelligent person, baffingly used some kind of exploitable "Samba" or "SMB" server running in his home with its source code (and probably other private files/data) on it.

The result was that somebody, somehow, managed to break into it and steal the source code. This made him not want to work on the project anymore, understandably if you understand us folks who don't do "open source" development. (Even if we give away the resulting program for free.)

An old friend of mine mentioned that he would be storing some embarrassing videos and audio recordings we made as kids, on his home "NAS". I shuddered at the thought and asked him to please not do that, since it's not secure. (My own copies were on encrypted disks, without any cables going into them, in a fireproof safe.)

I've heard numerous people talk about their "home networks" and how they make all their files available to "all their computers at home" (what kind of insane office/enterprise setups do they have at home?!), because... they must be... available... at all times? It's unthinkable to simply use an USB stick to put the relevant file(s) on the few times you need them and physically move them to the machine in question?

In numerous other situations, I've noticed that people who aren't idiots in general behave extremely strangely about data security. Even when it's themselves that would get affected by a hack/compromise.

And it happens over and over again. Even if you constantly keep all the software updated, which is extremely rare (most people seem to not have any idea that things ever have to be updated/patched/maintained in any way), there's just so many mistakes and arrogant assumptions made by developers. A popular database software exposed all my databases to the world without even requiring a password, even though I had set one, with my only finding out about this much later. I can only hope that nobody even bothered to try breaking into it, but it was like a cold shower when I realized that this was the case. And it was far from the only such instance.

At this point, I have zero trust left in people and developers of software/hardware. Yet people who seem to be far smarter than I still seem so incredibly casual and careless about even their most private data that I'm left wondering what I'm missing.

Why is it so crucially important to a lot of people to have "occasional convenience" over the ability to sleep at night without thinking about some blackmailer across the world fetching your private photos and personal writings from your always-on file server?

Are they just incredibly naive, in spite of having big houses with tons of computers and even (in many cases) programming/computer skills far surpassing my own? I don't understand it.

Answer 1

Why is it so crucially important to a lot of people to have "occasional convenience" ...

There is no 100% security.

Security has its costs, which is not only the costs of buying some products but also to invest the time to secure everything, to make sure that no strange interactions happen, to gain the knowledge to do all of this etc. On top of this security measures are often in the way, i.e. there are additional costs caused by inconvenience, loss of comfort and impact on a smooth work flow.

Investing time, money and knowledge into securing systems and working with secured systems also means the loss of opportunity to do other interesting and/or profitable things.

Nobody is willing to accept these costs if they don't see a matching risk. While they might see some theoretical threats they might not consider these relevant or they see the probability of attacks low enough to accept the risk. And in many cases they are right. But not always, which is expected if the probability is greater than 0%. In other words: for many successful attack one hears about there are many attacks which were not successful or which were not even attempted. But one usually does not hear about these which results in a biased perception.

Nothing of this is actually specific to cyber security. We accept risks all the time if they seem to be low enough compared to what we can gain. We drive cars even though clearly accidents happen (but hopefully only to others), we gather at large groups even though this increases the risk and impact of a terror attack etc. Since loss of opportunity has its own costs we weigh these costs against the threats and decide often, that the chances outweigh the risks. Most times we are right, some times we fail. Such is live.