Hackers Do Not Break, They Build

(This column was originally published by NewsFactor Network, June 17, 2002.)

Kirk L. Kroeker

Contrary to popular misconception -- perpetuated through mass-market consensus and countless media sources -- hackers do not, by definition, break into systems.

Setting aside the argument that categorical conflation works just fine for casual conversations -- in which you might need to employ verbal shorthand to communicate more quickly -- it irks me when I hear the term "hacker" used solely to indicate a person who breaks into systems with malicious intent.

All the portscans, inbound UDP frags and SubSeven Trojan attacks that my firewall blocks aren't perpetuated by hackers, who have far better things to do with their time. No, these small-scale attacks are well within the province of crackers and script kiddies, who almost always use easily acquired software to play their game.

Language Evolution

Let language evolve, you say, and let the popular meaning of the term "hacker" win in the end. Proponents of letting the popular meaning win are implicitly arguing that we should all subscribe to the idea that Humpty Dumpty proposed to Alice: "When I use a word, it means just what I choose it to mean -- neither more nor less. The question is which is to be master -- that's all."

I'm fine with Humpty-Dumptyism, but I still prefer to make distinctions where they can actually turn out to be useful. If we stop distinguishing between the various meanings of the term "hacker" -- both the popular meaning and the more accurate old-school meaning -- then we lose the ability to say what we mean when we want to be precise.

What irks me most is when people -- I confess I'm guilty of it myself -- knowingly misuse the term "hacker" when they mean something else. It's a choice that, ironically, runs counter to the very spirit of hacking, at whose core is the celebration of skilled precision and understanding.

Source Code

I could point to several sources that make the same point I'm making here. But despite all the arguments for using the term correctly -- like Eric S. Raymond's excellent hacker FAQ or even the definition in the New Hacker's Dictionary -- the word "hacker" still is misused everywhere, with few exceptions.

So how do I define a hacker? For starters, hackers built the Internet. Hackers celebrate the advanced understanding of systems. In the New Hacker's Dictionary, the primary definition of hacker is "a person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary."

If you look far down the definition chain in the New Hacker's Dictionary, you'll see the revered dictionary tipping its hat -- albeit somewhat reluctantly -- to the populist definition: "a malicious meddler who tries to discover sensitive information by poking around." The dictionary says the correct term for this meaning is "cracker," a term invented by the hacker community more than 15 years ago to stem the tide of the mass media's misappropriation of "hacker."

Going Beyond

Ask anybody who recognizes the names Eric S. Raymond, Larry Wall or Bjarne Stroustrup, and they'll tell you the same thing I'm suggesting here. It is not an elitist position. It is common knowledge that while most computer users remain satisfied with a minimum amount of working knowledge, hackers go beyond; they go way beyond.

And that's the primary, defining trait of all good hackers. In the pursuit of advanced systems knowledge, hackers might indeed penetrate systems, but they are not interested primarily in breaking into a system for its own sake.

Most of my friends who work in the computer industry understand this difference, but they have largely given up trying to convert their less computer-literate friends and colleagues to using the more appropriate term "cracker."

Now that the incorrect meaning of the term "hacker" has become almost completely entrenched in popular culture, it is truly an uphill battle to convince people that a hacker is not necessarily somebody who steals bank account numbers.

Alt Labels

As mentioned above, I'm guilty of misuse myself. When I'm talking to friends who don't work in the computer industry, I revert to "hacker" when I'd rather use something like "cracker," "phreak," "script kiddie" or even "that annoying larval deviant who made multiple attempts to bring down my server last weekend."

I'd argue that perhaps the best replacements for the term "hacker" are, in fact, "cracker," "phreak" or "script kiddie," depending on the context. But these are loaded terms, too, and they are sometimes problematic for those working outside the industry.

For example, if you mention to somebody outside the industry that one of your friends is unusually obsessed with "phreaking," the response might not be what you anticipated. And in addition to its U.S.-oriented pejorative connotation that means "a poor white guy," the term "cracker" also can mean a cookie-like food item.

The term "script kiddie" is, of course, completely despised by the people to whom it applies, who prefer to refer to themselves as hackers. If you anger a script kiddie, you might find yourself, like Steve Gibson did, bearing the brunt of a massive denial of service (DoS) attack.

Most IT people generally feel some amount of low-level anxiety about script kiddies because of the damage they can wreak while trying to prove they can "hack." While script kiddies do break into systems -- often simply to plant something like "DraGonZ waz here" in your root directory -- I definitely don't respect them.

No-Win Debate

Most editors and writers, unfortunately, side with the often-compelling, broad-appeal argument that readers might not understand the difference between the hacker and cracker communities. They argue that since making the distinction in print typically takes too much valuable space, it is ultimately best to side with popular misconception.

While this debate has been continuing for a long time, it is not likely to go away soon. And I'll likely continue to use the term "hacker" in conversations with computer-illiterate friends when I don't have enough time to go into the details. There really doesn't seem to be a solution to satisfy all parties.

But when I'm reading something that uses the term "hacker" incorrectly, the media source loses a little credibility in my eyes. Some people don't care to differentiate between closely related terms. But I'll never praise these people -- as fine hackers of language -- when they don't.