7 ms·

Articles like these make me wonder if the long-term progression of the PC revolution will follow the sexual revolution of the 1960s. The AIDS crisis of the 80s

Articles like these make me wonder if the long-term progression of the PC revolution will follow the sexual revolution of the 1960s. The AIDS crisis of the 80s did everything it could to undermine the last few decades worth of free love. Not only was promiscuity tinged with risk, that risk alone (and the lgbt association) opened the door to conservative ridicule. Fast forward to 2016 and sex is better and safer than ever: hookup apps give you the opportunity to connect with people without the prerequisite of an alcohol-soaked atmosphere. Condom quality is light years ahead of what it used to be. Truvada and low-cost antiretrovirals have chipped away at HIV stigma. STI test results are an app away. If an apocalyptic hack resembling this article occurs, it could spur on a similar security revolution among businesses and consumers. Only when people realize how insecure they have made their own lives will there be any chance of saving them from themselves.

michaelvoz 10y ago
I think what you are describing is just action-reaction. Cause and effect. Something happens, people react. I hate to oversimplify, but this is at the very core of human nature. A societal supply and demand...
ryanmarsh 10y ago
In large companies we're already in the beginning of a backlash. Companies are going overboard on IT security, throwing tons of money at it relative to the past. CIO's used to fear failed projects and downtime. Now they tell me they fear hackers. Many large companies in America are dealing with APT's as well. I'm sure others here can comment on their experience with this. Instead of a backlash like the 80's I think there will be a split. I'm already seeing tech haves and have-nots. My gut tells me there will be those with amazing tech at their fingertips and those left out or even punished for trying. I recently commented here that security and privacy are a feature not a product. I want to retract that statement. Security and privacy may become an essential product offering.
- superuser2 10y ago
  If decision makers want to improve security, there are readily available levers they can pull: give a shit about code quality, put 5 minutes of thought into authorization decisions inside their applications, escape strings, take advantage of memory safety, upgrade unpatched legacy garbage, stop using and creating protocols that are trusting by default, etc. They don't do those things. They buy bolt-on antivirus suites and magic Cisco gateway boxes and when a 12 year old who's heard of SQL injection comes along they throw up their hands and go "APT nation-states, what could we have done?" They continue to believe in perimiter-based security, where network drops in unlocked conference rooms and hallways are inside the perimeter. They continue to laugh off email encryption and signing. We aren't seeing sophisticated attacks, by and large. We're just seeing someone finally bothering to attack all the crap that was designed in the assumption of "who would ever want to attack this?" or that pre-existing viruses for which signatures are published are the only relevant threats.
  - shaftway 10y ago
    But by and large, the decision makers can't make those decisions, because of dependencies on open source systems that are too large to audit, or closed source systems where all they can do is trust the vendor's salesperson who says "oh yeah, it's secure".
    - CaptSpify 10y ago
      The beauty of open source though, is that if we can start funding them, we can start getting them audited. Look at openssl. The past method of "taking from open-source, but giving nothing back" may just need to go away
    - superuser2 10y ago
      Vendors can be held to published standards. The industry seems to take operational/sysadmin standards seriously when required to (HIPAA, PCI, etc), including across the client/contractor boundary. Problem is, there don't seem to be equivalent standards in widespread use for programs themselves, only the environments they're running in. That could change, if the holders of the purse strings were to demand it. Attacks on dependencies are tricky. But it seems like the dumbest, most high-profile attacks are against the core line-of-business applications. I'm sure AT&T has the very best firewalls money can buy, but it operated a consumer-facing application which did not check whether a user-supplied primary key actually belonged to the logged-in user before displaying private data! This is the disconnect I'm talking about. If they're being outsourced to the lowest bidder, then maybe they shouldn't be. If they're being bought off the shelf, purchasers could either demand certifications that meaningfully eliminate at least the elementary classes of vulnerabilities or go in-house and do it right.
Zigurd 10y ago
That's a good analogy, but there is an entirely orthogonal dimension: A significant part of out telecom and computing ecosystem was built to be friendly for surveillance. And why not? The US was far in the lead in the surveillance and hacking race. APTs are showing us that era might be over. Someone might get it into their head that the only way to win is not to play. If computing and telecom rebalance in favor of security from outside hacking and surveillance threats, as we are seeing in OTT communications apps, that will propel a virtuous cycle.
- eric_h 10y ago
  > A significant part of out telecom and computing ecosystem was built to friendly for surveillance. A very interesting point. We've all collectively raised the cry against building backdoors into products when the very backbone of much of our (commercial) network infrastructure has been friendly to backdoors (required by law, I believe) for decades. Perhaps, in the near future, some catastrophic network incursion will make the concept of "tapping a phone line" a relic of the past, requiring much more intensive, in-person intelligence gathering to collect similar information. Although, given the complete lack of progress on homicidal maniacs with guns in the US, it seems unlikely that a massive telecom breach will really change anything, unless it reveals the improprieties of a majority of our elected officials. (Note: I'm not arguing that legislation will fix that particular problem (read: maniacs w/guns), just that inertia has prevented any real progress or attempts at progress from being made in that regard)
yuhong 10y ago
Remember Blaster, Sasser, and SQL Slammer? Even now there is still UEFI.
joshkpeterson 10y ago
Yeah just wait for an Ashley Madison style leak, but instead with all conversations logged on Tinder. It would change the internet.
mirimir 10y ago
Well, "[t]he AIDS crisis of the 80s" was as much about free transportation as free love. The chimp-to-human jump had occurred decades before. It was long-distance trucking and international air travel that got it out of Central Africa.
whuh 10y ago
Hookup apps give you the opportunity to connect with people without the prerequisite of an alcohol-soaked atmosphere. Condom quality is light years ahead of what it used to be. Truvada and low-cost antiretrovirals have chipped away at HIV stigma. Oh... well... I wouldn't quite jump the gun on that one, sir. Those are words spoken by an unrealistic outsider, or a spectacularly negligent individual. When was the last time you faced down an STD? If it was more than a decade ago, why not give it another whirl? C'mon take the plunge, and brave the antiretroviral white water rapids!
- tr1ck5t3r 10y ago
  Whilst HIV is a retrovirus, the same type used for gene therapy, thus why its a difficult challenge, its interesting to note that in ancient Egypt before the French moved in, fasting was used to treat syphilis amongst other health problems. Marriage is a religious invention designed to curb the transmission of STD's in the ancient bed hopping world. Nothing like fear to curtail the activities of the less risk taking members of the public is there?
fractal618 10y ago
> Articles like these make me wonder if the long-term progression of the PC revolution will follow the sexual revolution of the 1960s. Unfortunately, I think it's more likely to follow the banking revolution of the 2000's.

michaelvoz 10y ago

I think what you are describing is just action-reaction. Cause and effect. Something happens, people react. I hate to oversimplify, but this is at the very core of human nature. A societal supply and demand...

ryanmarsh 10y ago

In large companies we're already in the beginning of a backlash. Companies are going overboard on IT security, throwing tons of money at it relative to the past. CIO's used to fear failed projects and downtime. Now they tell me they fear hackers. Many large companies in America are dealing with APT's as well. I'm sure others here can comment on their experience with this. Instead of a backlash like the 80's I think there will be a split. I'm already seeing tech haves and have-nots. My gut tells me there will be those with amazing tech at their fingertips and those left out or even punished for trying. I recently commented here that security and privacy are a feature not a product. I want to retract that statement. Security and privacy may become an essential product offering.

superuser2 10y ago
If decision makers want to improve security, there are readily available levers they can pull: give a shit about code quality, put 5 minutes of thought into authorization decisions inside their applications, escape strings, take advantage of memory safety, upgrade unpatched legacy garbage, stop using and creating protocols that are trusting by default, etc. They don't do those things. They buy bolt-on antivirus suites and magic Cisco gateway boxes and when a 12 year old who's heard of SQL injection comes along they throw up their hands and go "APT nation-states, what could we have done?" They continue to believe in perimiter-based security, where network drops in unlocked conference rooms and hallways are inside the perimeter. They continue to laugh off email encryption and signing. We aren't seeing sophisticated attacks, by and large. We're just seeing someone finally bothering to attack all the crap that was designed in the assumption of "who would ever want to attack this?" or that pre-existing viruses for which signatures are published are the only relevant threats.
- shaftway 10y ago
  But by and large, the decision makers can't make those decisions, because of dependencies on open source systems that are too large to audit, or closed source systems where all they can do is trust the vendor's salesperson who says "oh yeah, it's secure".
  - CaptSpify 10y ago
    The beauty of open source though, is that if we can start funding them, we can start getting them audited. Look at openssl. The past method of "taking from open-source, but giving nothing back" may just need to go away
  - superuser2 10y ago
    Vendors can be held to published standards. The industry seems to take operational/sysadmin standards seriously when required to (HIPAA, PCI, etc), including across the client/contractor boundary. Problem is, there don't seem to be equivalent standards in widespread use for programs themselves, only the environments they're running in. That could change, if the holders of the purse strings were to demand it. Attacks on dependencies are tricky. But it seems like the dumbest, most high-profile attacks are against the core line-of-business applications. I'm sure AT&T has the very best firewalls money can buy, but it operated a consumer-facing application which did not check whether a user-supplied primary key actually belonged to the logged-in user before displaying private data! This is the disconnect I'm talking about. If they're being outsourced to the lowest bidder, then maybe they shouldn't be. If they're being bought off the shelf, purchasers could either demand certifications that meaningfully eliminate at least the elementary classes of vulnerabilities or go in-house and do it right.

Zigurd 10y ago

That's a good analogy, but there is an entirely orthogonal dimension: A significant part of out telecom and computing ecosystem was built to be friendly for surveillance. And why not? The US was far in the lead in the surveillance and hacking race. APTs are showing us that era might be over. Someone might get it into their head that the only way to win is not to play. If computing and telecom rebalance in favor of security from outside hacking and surveillance threats, as we are seeing in OTT communications apps, that will propel a virtuous cycle.

eric_h 10y ago
> A significant part of out telecom and computing ecosystem was built to friendly for surveillance. A very interesting point. We've all collectively raised the cry against building backdoors into products when the very backbone of much of our (commercial) network infrastructure has been friendly to backdoors (required by law, I believe) for decades. Perhaps, in the near future, some catastrophic network incursion will make the concept of "tapping a phone line" a relic of the past, requiring much more intensive, in-person intelligence gathering to collect similar information. Although, given the complete lack of progress on homicidal maniacs with guns in the US, it seems unlikely that a massive telecom breach will really change anything, unless it reveals the improprieties of a majority of our elected officials. (Note: I'm not arguing that legislation will fix that particular problem (read: maniacs w/guns), just that inertia has prevented any real progress or attempts at progress from being made in that regard)

yuhong 10y ago

Remember Blaster, Sasser, and SQL Slammer? Even now there is still UEFI.

joshkpeterson 10y ago

Yeah just wait for an Ashley Madison style leak, but instead with all conversations logged on Tinder. It would change the internet.

mirimir 10y ago

Well, "[t]he AIDS crisis of the 80s" was as much about free transportation as free love. The chimp-to-human jump had occurred decades before. It was long-distance trucking and international air travel that got it out of Central Africa.

whuh 10y ago

Hookup apps give you the opportunity to connect with people without the prerequisite of an alcohol-soaked atmosphere. Condom quality is light years ahead of what it used to be. Truvada and low-cost antiretrovirals have chipped away at HIV stigma. Oh... well... I wouldn't quite jump the gun on that one, sir. Those are words spoken by an unrealistic outsider, or a spectacularly negligent individual. When was the last time you faced down an STD? If it was more than a decade ago, why not give it another whirl? C'mon take the plunge, and brave the antiretroviral white water rapids!

tr1ck5t3r 10y ago
Whilst HIV is a retrovirus, the same type used for gene therapy, thus why its a difficult challenge, its interesting to note that in ancient Egypt before the French moved in, fasting was used to treat syphilis amongst other health problems. Marriage is a religious invention designed to curb the transmission of STD's in the ancient bed hopping world. Nothing like fear to curtail the activities of the less risk taking members of the public is there?

fractal618 10y ago

> Articles like these make me wonder if the long-term progression of the PC revolution will follow the sexual revolution of the 1960s. Unfortunately, I think it's more likely to follow the banking revolution of the 2000's.