4 ms·

The same thing you do if physical tax/medical/financial records get lost in a fire, or any other data for that matter. It's a major loss, maybe even an economi

The same thing you do if physical tax/medical/financial records get lost in a fire, or any other data for that matter. It's a major loss, maybe even an economic crisis for some, but not an unrecoverable one. Worst case scenario you move foreword with less data and insurance does what it can. Create countermeasures so it doesn't happen again. Said data should also be backed up for this very reason. Also, just because devices are on the same network does not mean they're homogenous. A Windows vulnerability won't take out a Linux server or an IoT webcam. For everything to truly "die at once due to the same bug" you'd need a network layer attack. Compromising the internet protocol itself, even if possible would cut off the attacker as well, so that leaves us with denial of service attacks, which are common. But services like Cloudflare already effectively defend against such attacks, and even compromising an entire major cloud platform (as in the author's AWS hypothetical) will simply result in the cloud provider as well as other interested parties pouring all possible effort into fixing the problem as quickly as possible. Imagine that your monoculture crop could develop immunity to a new disease within hours, days or weeks, with immunity developing faster for more serious diseases. Then all you need is a big enough field to absorb any potential losses.

__jal 9y ago
> Worst case scenario you move foreword with less data and insurance does what it can Well, yes. Just like, after a house fire, you rebuild and try to carry on. It is still catastrophic. > Also, just because devices are on the same network does not mean they're homogenous. Of course not. The point is that there are many pressures towards running homogenous systems - easier to hire for, easier to manage, fewer support systems to run, fewer interop problems, bigger vendor discounts, etc. etc. These pressures are hard to resist, but we have to do better at running heterogenous systems, because without them, your entire farm can burn down before you notice. Nothing you say is wrong, but just because "it's just software" doesn't mean these aren't catastrophes.
- scottLobster 9y ago
  Not saying they're not, but the author specifically mentions "existential threat", "paralyzed economies", and worlds where people without technical skills are instantly hacked upon connecting to the internet. He uses the example of water supply so completely poisoned that no one can drink from it. The author seems to be making an assumption that we could enter a world where insecure technology could be taken offline all at once by some random hacker(s) and remain in such a state long enough to completely destroy economies and institutions. Frankly the system just isn't that brittle, if it was it would have failed long ago. It's like looking at Hurricane Katrina, which while catastrophic was never an existential threat to the US, and saying, "now imagine if Hurricane Katrina happened everywhere, every day!" without considering if such a thing were possible or likely in the first place. As for heterogeneous systems, what do you think the cloud is? Sure it may be homogenous for users, but that's all abstraction for what is a VERY heterogeneous system under the hood. Sure having independent/redundant subsystems is ideal for reliability, but at the end of the day I don't see the need for all the frightful abstractions. The farm isn't going to burn down without anyone noticing, there are simply too many powerful interested parties and too much built-in resiliency. I'm all for building in more resiliency/redundancy to prevent catastrophes as you mention, but the author takes a couple of major security incidents and spins them into apocalyptic techno-panic.
digi_owl 9y ago
Reminds me that one of the first things that would happen during uprisings in the past was the burning of the local bank's loan ledgers...
crpatino 9y ago
> The same thing you do if physical tax/medical/financial records get lost in a fire, or any other data for that matter. The thing you fail to grasp is the resilience of physical records. Imagine Germany trying to take down England's records during World War I, one hundred years ago. The destruction of merely 3-5% of all relevant documents would have required the coordinated strikes of hundreds if not thousands of arsonists, all of whom would need to be part of an even bigger spy network. That's for England proper; you might be able to scale it up to Scotland and Walles, but it would be completely unimaginable to pull this off accross the whole British Empire. Today, it might be harder to take down one hospital, but once you have gone that far, scale it up to national level should be pretty feasible. > Imagine that your monoculture crop could develop immunity to a new disease within hours, days or weeks You never have opened a priority bug in one of the big software companies, have you?
- scottLobster 9y ago
  If properly backed up digital records are even more resilient, and it's not like this is a new concept. Banks are incredibly resilient when it comes to backups, for example. As are most of the major tech companies. Sure other institutions like hospitals and some underfunded government agencies might need to catch up, but once the will is there the technology is just waiting to be implemented. Not to mention the insecure institutions are insecure in different ways. Whatever methods used to take down one hospital is unlikely to work on the next, although standardized National Healthcare systems like the NHS might be more vulnerable to such things. Opening a priority bug is an entirely different animal than responding to an active attack. If something was able to shut down AWS, Google, a bunch of hospitals, or any other critical service, it gets immediate attention and reaction. Humans become incredibly productive once shit hits the fan.
  - crpatino 9y ago
    > If properly backed up digital records are even more resilient, and it's not like this is a new concept. If people would be willing and able to make proper digital records, the Cloud would not exist. Actually, most of the technology stacks in use today do not make any sense until you consider the fact that a very large segment of the market wants to have all the goodies IT-fairy-godmother can provide, but are too damned stingy to pay for even 10% of the cost. Your characterization of Banks is correct, but irrelevant. In many ways they are the perfect IT customer: deep pockets, an inner culture that values detail orientation and rational risk assesment, appreciation of external expertise, etc. Most organizations are very not like this. Healthcare IT, in particular, are the stuff of nightmares. A culture of bikeshedding, - excesive regulation of what systems ought to do, plus borderline criminal negligence of the implementation details, - reliance on obsolete OSes that cannot be updated anymore, needlessly large attack vectors... do I need to say more?

__jal 9y ago

> Worst case scenario you move foreword with less data and insurance does what it can Well, yes. Just like, after a house fire, you rebuild and try to carry on. It is still catastrophic. > Also, just because devices are on the same network does not mean they're homogenous. Of course not. The point is that there are many pressures towards running homogenous systems - easier to hire for, easier to manage, fewer support systems to run, fewer interop problems, bigger vendor discounts, etc. etc. These pressures are hard to resist, but we have to do better at running heterogenous systems, because without them, your entire farm can burn down before you notice. Nothing you say is wrong, but just because "it's just software" doesn't mean these aren't catastrophes.

scottLobster 9y ago
Not saying they're not, but the author specifically mentions "existential threat", "paralyzed economies", and worlds where people without technical skills are instantly hacked upon connecting to the internet. He uses the example of water supply so completely poisoned that no one can drink from it. The author seems to be making an assumption that we could enter a world where insecure technology could be taken offline all at once by some random hacker(s) and remain in such a state long enough to completely destroy economies and institutions. Frankly the system just isn't that brittle, if it was it would have failed long ago. It's like looking at Hurricane Katrina, which while catastrophic was never an existential threat to the US, and saying, "now imagine if Hurricane Katrina happened everywhere, every day!" without considering if such a thing were possible or likely in the first place. As for heterogeneous systems, what do you think the cloud is? Sure it may be homogenous for users, but that's all abstraction for what is a VERY heterogeneous system under the hood. Sure having independent/redundant subsystems is ideal for reliability, but at the end of the day I don't see the need for all the frightful abstractions. The farm isn't going to burn down without anyone noticing, there are simply too many powerful interested parties and too much built-in resiliency. I'm all for building in more resiliency/redundancy to prevent catastrophes as you mention, but the author takes a couple of major security incidents and spins them into apocalyptic techno-panic.

digi_owl 9y ago

Reminds me that one of the first things that would happen during uprisings in the past was the burning of the local bank's loan ledgers...

crpatino 9y ago

> The same thing you do if physical tax/medical/financial records get lost in a fire, or any other data for that matter. The thing you fail to grasp is the resilience of physical records. Imagine Germany trying to take down England's records during World War I, one hundred years ago. The destruction of merely 3-5% of all relevant documents would have required the coordinated strikes of hundreds if not thousands of arsonists, all of whom would need to be part of an even bigger spy network. That's for England proper; you might be able to scale it up to Scotland and Walles, but it would be completely unimaginable to pull this off accross the whole British Empire. Today, it might be harder to take down one hospital, but once you have gone that far, scale it up to national level should be pretty feasible. > Imagine that your monoculture crop could develop immunity to a new disease within hours, days or weeks You never have opened a priority bug in one of the big software companies, have you?

scottLobster 9y ago
If properly backed up digital records are even more resilient, and it's not like this is a new concept. Banks are incredibly resilient when it comes to backups, for example. As are most of the major tech companies. Sure other institutions like hospitals and some underfunded government agencies might need to catch up, but once the will is there the technology is just waiting to be implemented. Not to mention the insecure institutions are insecure in different ways. Whatever methods used to take down one hospital is unlikely to work on the next, although standardized National Healthcare systems like the NHS might be more vulnerable to such things. Opening a priority bug is an entirely different animal than responding to an active attack. If something was able to shut down AWS, Google, a bunch of hospitals, or any other critical service, it gets immediate attention and reaction. Humans become incredibly productive once shit hits the fan.
- crpatino 9y ago
  > If properly backed up digital records are even more resilient, and it's not like this is a new concept. If people would be willing and able to make proper digital records, the Cloud would not exist. Actually, most of the technology stacks in use today do not make any sense until you consider the fact that a very large segment of the market wants to have all the goodies IT-fairy-godmother can provide, but are too damned stingy to pay for even 10% of the cost. Your characterization of Banks is correct, but irrelevant. In many ways they are the perfect IT customer: deep pockets, an inner culture that values detail orientation and rational risk assesment, appreciation of external expertise, etc. Most organizations are very not like this. Healthcare IT, in particular, are the stuff of nightmares. A culture of bikeshedding, - excesive regulation of what systems ought to do, plus borderline criminal negligence of the implementation details, - reliance on obsolete OSes that cannot be updated anymore, needlessly large attack vectors... do I need to say more?