5 ms·
In the interest of discussion, would you be up for naming those companies, in your opinion?
by dsacco 10y ago
In the interest of discussion, would you be up for naming those companies, in your opinion?
- tptacek 10y agoGoogle, Microsoft, Facebook, Apple. Maybe 3-4 other "smaller" big startups that have anomalously great programs, which I'm not going to name.
- ryanlol 10y agoYou're giving Apple way too much credit.
- tptacek 10y agoOr you're giving Google and Microsoft too much.
- ryanlol 10y agoMicrosoft certainly, not so sure about Google. Anyone can get access to redmond intranet by spending a day searching for credentials on Github, harder to do with Google.
- tptacek 10y agoThere's not one "security"; of these 4, each has some specific strengths, and some weaknesses.
- lawnchair_larry 10y agoOf the 3, which have you hacked in some form?
- puzzle 10y agoAt some point Apple didn't even store Netscaler configurations under source control. Glad to hear that they got better.
- wmfiv 10y agoSeems like the banking industry has at least a degree of competency here as well. Who would bother with identity theft if you could just hack the banks and steal the money directly?
- tptacek 10y agoStrong disagree. The reason you don't see tons of bank compromises --- apart from the fact that banks don't routinely disclose breaches --- is that it's harder to monetize a breach than people tend to assume it is. Think it through. So: you "hacked" a "bank". You're on their internal network. Talk me through "stealing the money directly".
- wmfiv 10y agoIsn't that the point? If you can't monetize a breach of their network then it seems like they're doing their job.
- tptacek 10y agoNo, that is not the point.
- wmfiv 10y agoI'm genuinely interested in why not? Maybe the way I wrote it was a bit flippant, but surely bank computers that control the flow of trillions of dollars are a huge target. The fact there has never (?) been a massive breach that resulted in billions beings stolen must be a sign that someone is doing something right. No?
- deleted 10y ago[deleted]
- schoen 10y agoAn attacker could still at least get the bank's customers' personal information in that case.