> So why is it that we're so quick to assume that because a safety-critical computer system is exposed to the internet, that this is the worst thing ever?
Because of the Greater Internet Fuckwad Theory (or, more nicely put, the "online disinhibition effect"[1]).
We don't worry as much about random strangers harming us in person because most people are generally well-behaved when they are face to face with someone in real physical space.
On the Internet, where all you see is a screen and all you do is click your mouse, "reality" gets a lot more tenuous. In that environment, people act worse.
If you were walking over an overpass and saw someone left a cinder block up there with a note attached saying "Throw me!" how likely would you be to lumber it up off the ground, carry it to the edge, and heave it over onto to a car you can see passing below, whose occupants are visible to you?
Now imagine you stumble onto a random web page with a button labeled "Click to drop cinder block off overpass". Tempting?
The way our behavior differs in these two circumstances is a big part of why Internet security is so different from physical security. (The other big difference is how data can be replicated for free. It takes 50x as much effort to steal 50 cars. It often takes no more effort to apply the same have 50, or a million times.)
In addition to this, there are differing scales at work. In real life, by your analogy, you might find a cinder block with a "throw me" note. With the internet, you might find a button that says "throw 1.4M cinder blocks." One maniac can cause much more trouble that way.
Because of the Greater Internet Fuckwad Theory (or, more nicely put, the "online disinhibition effect"[1]).
We don't worry as much about random strangers harming us in person because most people are generally well-behaved when they are face to face with someone in real physical space.
On the Internet, where all you see is a screen and all you do is click your mouse, "reality" gets a lot more tenuous. In that environment, people act worse.
If you were walking over an overpass and saw someone left a cinder block up there with a note attached saying "Throw me!" how likely would you be to lumber it up off the ground, carry it to the edge, and heave it over onto to a car you can see passing below, whose occupants are visible to you?
Now imagine you stumble onto a random web page with a button labeled "Click to drop cinder block off overpass". Tempting?
The way our behavior differs in these two circumstances is a big part of why Internet security is so different from physical security. (The other big difference is how data can be replicated for free. It takes 50x as much effort to steal 50 cars. It often takes no more effort to apply the same have 50, or a million times.)
[1]: https://en.wikipedia.org/wiki/Online_disinhibition_effect