4 ms·
But to revisit the analogy about stolen police/military arms, are we to blame casualties/victims of these stolen arms for not being able to defend themselves?
by beager 9y ago
But to revisit the analogy about stolen police/military arms, are we to blame casualties/victims of these stolen arms for not being able to defend themselves?
Yes, those tasked with network and infrastructure security should be held to rigorous and constantly increasing standards. But there has to be some accountability from the state purveyors of this malware when it gets intercepted and weaponized. Publication of these tools is one way to help in lieu of that, but it becomes a toss-up as to whether the world will harden against published malware before bad actors, state-sponsored or otherwise, weaponized it for their own gain.
- mindslight 9y agoThere is a world of difference between physical and informational security, so it is an improper analogy. First, it is possible to perfectly defend (and conversely, a vulnerability means one is entirely vulnerable. Don't confuse mitigations that affect the probability of being vulnerable with actually being vulnerable. There is no middle ground as to whether something is secure or not, it is a binary proposition!) Second, attacks are practically free and untraceable. And all the status-quo anonymity-destroying attempts cannot actually change this, as making "network identity" trusted would mean changing every system's attack surface into every other system - eg break a single person's credit card and use Starbucks wifi.