3 ms·

The solution to all of this requires only 2 words: criminal negligence. Prosecute a CEO or 2 from tech companies for criminal negligence, and you will see com

The solution to all of this requires only 2 words: criminal negligence. Prosecute a CEO or 2 from tech companies for criminal negligence, and you will see companies actually investing in actual security. Put some business school graduates in a jail cell on criminal charges for their hiring and corporate practices, which would be criminal negligence if they were building bridges or doing any sort of work in any other industry. Hiring the cheapest, least experienced engineers you can find, not even mentioning the word security on your job listing requirements for software or hardware design engineers, depriving the engineers of the time, tools, and environment they need to do competent work, putting business concerns ahead of engineering concerns when determining product development schedules, etc are things that executives should be judged in a court of law for. They are criminal acts that put not just money in jeopardy but frequently lives.

caleblloyd 10y ago
No way, this is not the answer. Should the CEO of a bank be prosecuted every time one of their branches is robbed because they didn't hire enough security guards?
- pas 10y ago
  It's not about security guards. It's about risk assessment. It's very much like the PCI-DSS for online bankcard usage, at least that forces people to think a bit about it. Document your thinking, sign off of it and upload it to some authority. It should be that easy, and when something bad happens take that document and let's review. And if there is self-assessment questionnare and you went through the checkboxes and signed off of it and uploaded it, but you acutally did jack shit nothing at all, then you're liable. It's not a hard ethical quagmire, it's best practices, it's 80-20, and we're currently at somewhere like 5-95.
ghaff 10y ago
Sure. Of course it goes without saying that the programmers who actually make the coding mistakes through insufficient attention to security best practices should be fully prosecuted as well. That will get their attention. Pour encourage les autres and all that. </s>
- NotSammyHagar 10y ago
  I don't want to prosecute programmers. But how can we incentivize the companies to do better and make more secure systems? By suing companies that have tech that is hacked, it should make them more careful in their security.
  - ghaff 10y ago
    Lawsuits (even fines) against the company, in addition to the inevitable consequences to the business, seem like perfectly reasonable consequences of security carelessness. That's rather different from randomly tossing managers in jail however. Be careful what you wish for though. In many industries, releasing product requires getting explicit permission from government regulators based on trials/plans/etc. often assembled at considerable effort by licensed engineers and others.
zigzigzag 10y ago
I think unfortunately the conclusion reached by the non-Hacker-News world will be "the solution to all of this requires banning Bitcoin". This explosion of ransoms is getting nastier and nastier. It appears to have no end. Bitcoin's block chain has been stalled at 1mb blocks for a year now, it isn't adding users and their plans to make it scale aren't implemented. At what point do the political winds shift and the cost/benefit ratio of keeping Bitcoin around, at least in the USA, tips over to cost > benefit? I don't want to see Bitcoin exchanging sent underground in the west, but it's clear that community has no intention of getting ransomware under control.
- pas 10y ago
  Which community? The Bitcoin community? Or the blockchain community? They know that the effectiveness of ransomware is a direct consequence of quasi-instant almost-anoymous money transfer on the internet. And yes, to a degree it's their responsibiltiy too to solve this, but the dominant share of the responsibiltiy is not really on them, it's on the various service providers that don't care about IT security, yet meddle with IT.
g00gler 10y ago
Gucifer more or less said this at DefCon this summer, blame the IT companies, and I'm definitely in agreement. I don't think anyone should go to jail, like pretty much ever (let me pay a fine or kill me rather than lock me up), but I don't see a reason why whoever set this up, for example, shouldn't be held liable in the same way a doctor is liable with malpractice insurance to cover it. It seems it'd fit the US laws very well, tech companies would buy insurance policies that'd pay out when their shit software or infrastructure is hacked. Huge companies like Google or Apple could self insure. That'd also give some incentive to the MBA's to take security seriously, as proving they take the extra steps would lower their premiums.
- spiffytech 10y ago
  Fines and insurance would provide compensation for the victims, but would provide less pressure to fix the problematic practices at their roots, compared with otakucode's plan. Tech profits are high enough to swallow premiums for that sort of insurance without provoking substantial changes in business practices.
Eridrus 10y ago
We don't hold car companies accountable when their locks are not thief proof or window companies when someone breaks your window. Usually, this isn't a problem because we deal with this through law enforcement, but law enforcement is very difficult and expensive on the internet, particularly now that you can accept payment in bitcoin. The reason we have insecure systems is because we deal with systems that require constant vigilance to make sure we do not make mistakes in the face of adversaries. This doesn't scale for users and this doesn't scale for developers either. There are certainly people who take security more and less seriously, and this would definitely move the needle on that, but I am not really sure it would move the needle on actual security, since actual security is hard. Say good bye to startups if criminal negligence becomes a thing.
- NotSammyHagar 10y ago
  We need to hold car companies liable when they make trivially breakable key systems and ignition systems. Then they will make them more reliable. A guest at that hotel should be able to ask for a refund or sue the hotel for damages (to their time, their trip?), esp. if it was found the hotel didn't take basic steps to secure the card keys (like separating that system from the internet). The hotel should be able to sue the key manu system if they didnt keep their system safe. I stayed in a hotel in Canada recently and their card key system was not on the internet - you had to type in the room number on a keypad. That seems fraught with potential for wrong number or time, but it also keeps that from getting infected from the internet.

caleblloyd 10y ago

No way, this is not the answer. Should the CEO of a bank be prosecuted every time one of their branches is robbed because they didn't hire enough security guards?

pas 10y ago
It's not about security guards. It's about risk assessment. It's very much like the PCI-DSS for online bankcard usage, at least that forces people to think a bit about it. Document your thinking, sign off of it and upload it to some authority. It should be that easy, and when something bad happens take that document and let's review. And if there is self-assessment questionnare and you went through the checkboxes and signed off of it and uploaded it, but you acutally did jack shit nothing at all, then you're liable. It's not a hard ethical quagmire, it's best practices, it's 80-20, and we're currently at somewhere like 5-95.

ghaff 10y ago

Sure. Of course it goes without saying that the programmers who actually make the coding mistakes through insufficient attention to security best practices should be fully prosecuted as well. That will get their attention. Pour encourage les autres and all that. </s>

NotSammyHagar 10y ago
I don't want to prosecute programmers. But how can we incentivize the companies to do better and make more secure systems? By suing companies that have tech that is hacked, it should make them more careful in their security.
- ghaff 10y ago
  Lawsuits (even fines) against the company, in addition to the inevitable consequences to the business, seem like perfectly reasonable consequences of security carelessness. That's rather different from randomly tossing managers in jail however. Be careful what you wish for though. In many industries, releasing product requires getting explicit permission from government regulators based on trials/plans/etc. often assembled at considerable effort by licensed engineers and others.

zigzigzag 10y ago

I think unfortunately the conclusion reached by the non-Hacker-News world will be "the solution to all of this requires banning Bitcoin". This explosion of ransoms is getting nastier and nastier. It appears to have no end. Bitcoin's block chain has been stalled at 1mb blocks for a year now, it isn't adding users and their plans to make it scale aren't implemented. At what point do the political winds shift and the cost/benefit ratio of keeping Bitcoin around, at least in the USA, tips over to cost > benefit? I don't want to see Bitcoin exchanging sent underground in the west, but it's clear that community has no intention of getting ransomware under control.

pas 10y ago
Which community? The Bitcoin community? Or the blockchain community? They know that the effectiveness of ransomware is a direct consequence of quasi-instant almost-anoymous money transfer on the internet. And yes, to a degree it's their responsibiltiy too to solve this, but the dominant share of the responsibiltiy is not really on them, it's on the various service providers that don't care about IT security, yet meddle with IT.

g00gler 10y ago

Gucifer more or less said this at DefCon this summer, blame the IT companies, and I'm definitely in agreement. I don't think anyone should go to jail, like pretty much ever (let me pay a fine or kill me rather than lock me up), but I don't see a reason why whoever set this up, for example, shouldn't be held liable in the same way a doctor is liable with malpractice insurance to cover it. It seems it'd fit the US laws very well, tech companies would buy insurance policies that'd pay out when their shit software or infrastructure is hacked. Huge companies like Google or Apple could self insure. That'd also give some incentive to the MBA's to take security seriously, as proving they take the extra steps would lower their premiums.

spiffytech 10y ago
Fines and insurance would provide compensation for the victims, but would provide less pressure to fix the problematic practices at their roots, compared with otakucode's plan. Tech profits are high enough to swallow premiums for that sort of insurance without provoking substantial changes in business practices.

Eridrus 10y ago

We don't hold car companies accountable when their locks are not thief proof or window companies when someone breaks your window. Usually, this isn't a problem because we deal with this through law enforcement, but law enforcement is very difficult and expensive on the internet, particularly now that you can accept payment in bitcoin. The reason we have insecure systems is because we deal with systems that require constant vigilance to make sure we do not make mistakes in the face of adversaries. This doesn't scale for users and this doesn't scale for developers either. There are certainly people who take security more and less seriously, and this would definitely move the needle on that, but I am not really sure it would move the needle on actual security, since actual security is hard. Say good bye to startups if criminal negligence becomes a thing.

NotSammyHagar 10y ago
We need to hold car companies liable when they make trivially breakable key systems and ignition systems. Then they will make them more reliable. A guest at that hotel should be able to ask for a refund or sue the hotel for damages (to their time, their trip?), esp. if it was found the hotel didn't take basic steps to secure the card keys (like separating that system from the internet). The hotel should be able to sue the key manu system if they didnt keep their system safe. I stayed in a hotel in Canada recently and their card key system was not on the internet - you had to type in the room number on a keypad. That seems fraught with potential for wrong number or time, but it also keeps that from getting infected from the internet.