4 ms·
I guess it will unfortunately take a long time for the world to realize that the rules of "cyberwar" are different from the conventional military. (Of course, t
by Asdfbla 9y ago
I guess it will unfortunately take a long time for the world to realize that the rules of "cyberwar" are different from the conventional military. (Of course, there's a lot of literature from security and cyberwar researchers, but that doesn't seem to reach the politicians.)
You can't just pour money in offensive capabilities of your intelligence agencies, as is currently done in most countries, and hope to "win". Your exploits and zero days will be stolen, your critical systems will be weaker (because you intentionally weakened them or didn't disclose vulnerabilities) and you simply can't control the weapons you created. Worst of all, the weapons developed by state actors will fall into the hands of ordinary criminals, which makes for an even more complicated world.
- daurnimator 9y agoHow is that any different from manufacturing physical arms that somehow end up in the possession of some enemy foreign power?
- davidgerard 9y agoIt's vastly faster and more reproducible, enough so as to make it a different environment with different considerations.
- cryptarch 9y agoIt's more akin to manufacturing portable arms factories, that can also replicate themselves. Lose one and you're SOL.
- votepaunchy 9y agoSOL except that the arms can be rendered useless with a simple update in defenses.
- rxhernandez 9y agoExcept it could be a simple update after substantial damage has been done.
- deleted 9y ago[deleted]
- WrtCdEvrydy 9y agoYeah, and when the US power grid is offline for three days due to latest NSA cyber toy to get out of fucking Fort Meade, I'm sure the priority of those people stuck in an elevator or families watching their loved ones die due to a life support system failure will be to fucking update Windows XP.
- ams6110 9y agoIf that were to happen it would be more the fault of power companies that do not have critical systems well protected. Fort Meade is hardly the only entity developing these sorts of exploits, so you have to expect them. The patch for this has been out for a while now.
- ng12 9y agoA simple update applied to a few hundred thousand of people, most of which don't work for you or know enough to care.
- lern_too_spel 9y agoIf the vulnerability had come from Google Project Zero, the same worm could have been created. The only difference is a lower barrier to entry, but with enough malware authors out there, even GPZ's descriptions are enough to cause vulnerabilities to turn into exploits in the wild. Why does the discoverer of a vulnerability matter if the vulnerability was patched before it was publicly announced?
- Balgair 9y agoPhysical objects take dollars and time to design and produce at scale. Most of these vectors take time to design and money for living and the initial computer, but the implementation of them takes almost no money nor time (ok, yes a few miliseconds and the electrical power, but it's basically nothing). Corey Doctorow has said it best : "A lot of threat modeling is based on something like economic rationality by your adversary: you assume that no one would spend $10 to steal $1 from you. But with nitwits, all bets are off: this isn't about designing a safe to keep out a smart mastermind cat-burglar, it's trying to figure out if a drunk and belligerent dudebro will walk up to you on the street and punch you in the face to blow off some pent-up hormonal steam." (https://boingboing.net/2017/05/13/heroism-through-domain-squatti.html https://boingboing.net/2017/05/13/heroism-through-domain-squ...)
- bruxis 9y agoThat's exactly right. The strongest offence is a good defense.