5 ms·

so you want to live in a world where both countries don't have any power? Sounds Utopian. Defence is only card in this game worth playing especially when it co

so you want to live in a world where both countries don't have any power? Sounds Utopian. Defence is only card in this game worth playing especially when it comes to infrastructure attacks.

sillysaurus3 9y ago
Yes, that would suck. But that's the aggresor's decision, not ours. I'm not sure why we collectively decided to lack courage, but it's unsettling.
- Quarrelsome 9y ago
  > I'm not sure why we collectively decided to lack courage In this case courage is stupidity. Why waste time knocking out their power when we can spend that time making our power more secure. You're like a web master with a downed site due to a DDOS going: > Well I've DDOSed the attacker's site so its okay no its not, you've achieved nothing. Get with the program; this is a defence world not an offence one.
  - sillysaurus3 9y ago
    In situations where Person A is attacking Person B and making it sound like Person A's solution is the only one, Person A is usually mistaken. My mind is open. Convince me. Why is it a good idea to remove the threat of retaliation from our toolkit? It seems like one of the most persuasive reasons not to attack us.
    - Quarrelsome 9y ago
      I will attack you yet convince you that someone else attacked you. Now you're off attacking the wrong person and your power grid IS STILL OFFLINE. Just put all the effort into keeping the grid up. Absorb all attacks and then export that IP and tech for healthy profit. Its the only winning move.
      - sillysaurus3 9y ago
        Obviously attribution becomes far more important with cyberattacks, but that's a tangential point. You're acting like the power grid going offline is equivalent to a thermonuclear explosion. Yes, it will suck, but it's temporary. And afterwards, those exploit vectors will be patched.
        Quarrelsome 9y ago
        > Obviously attribution becomes far more important with cyberattacks, but that's a tangential point. No its not, its the whole point. The point of the age of information is that it is a departure from the age of blood and steel. The tactics of blood and steel that you are supporting have no place in this future and are counter-productive. The point of the age of information is that power is no longer solely in the hands of nations. Therefore treating it as a case of "stomping on the bad people" means your attack spread increases from all the nations in the world to all the people in the world. Added to that the evidence of those attacks can and will be forged. You're chasing shadows and its not worth it. Just build a better shield, that's all that matters.
        floatboth 9y ago
        Yes. This. Old government people think of everything in terms of "weapons" and "wars" and they still think the word "cyber" is cool. We need to promote, like, a radical new school of thought about software: Creators of a system should be fully responsible for whatever damage the system causes. A bug is a bug, whether it's exploited by an outside actor or it happens during normal execution. Developers should be responsible for bugs. I like the "defective lock" analogy from https://news.ycombinator.com/item?id=14663474 https://news.ycombinator.com/item?id=14663474
thoth 9y ago
Defense may be the only game worth playing, but how will that work? Unlike the real military where civilians simply don't own the hardware, in computer security they do. NSA isn't a hardware or software vendor, and the corporations that are don't have much of a profit motive to heavily invest in security. They aren't actually liable for problems unlike say a car manufacturer that releases a faulty product, which leaves what exactly... reputation that takes a hit? But every vendor has bugs and security issues and the market isn't really punishing anyone. Is the future effectively an enormous government subsidy to profitable corporations (i.e. NSA and other US government agencies basically become extensions of corporate America's QA department)? Is the future heavy regulations to create the proper financial incentives and/or penalties so corporations start seriously spending on security? It's easy to say "the government should do something!!" but what exactly will that look like?
- Quarrelsome 9y ago
  Regulate operating systems. Fund programs and research to work out how to create operating systems for our infrastructure that contain less zero days. Ensure we're the ones that find the zero days first. The reason we're vulnerable is because we're unwilling to pay the cost of finding the exploits but people in developing nations ARE because they work for "less". Right now our economies and systems reward those that fly by their pants and don't care for security. That is the problem. The free buffet of infinite growth from technology startups is the very thing that also gives us this pain and we need to learn to eat less.
  - SCHiM 9y ago
    I see that going wrong too. If operating systems need to be certified, where does that leave free open source projects?
  - jessespears 9y ago
    This would take an extraordinary departure from our current politics. Government intruding on software would (rightly) cause cries from the most stalwart Free Software advocates and from proprietary software companies. Can you imagine the outcry if a new Linux fork had to seek government approval in order to post their distribution? Can you expect Google or Oracle to fail to lobby the government to make sure they don't have to get each major revision certified?
Razengan 9y ago
> so you want to live in a world where both countries don't have any power? Sounds Utopian. Or post-apocalyptic.

so you want to live in a world where both countries don't have any power? Sounds Utopian. Defence is only card in this game worth playing especially when it comes to infrastructure attacks.

sillysaurus3 9y ago

Yes, that would suck. But that's the aggresor's decision, not ours. I'm not sure why we collectively decided to lack courage, but it's unsettling.

Quarrelsome 9y ago
> I'm not sure why we collectively decided to lack courage In this case courage is stupidity. Why waste time knocking out their power when we can spend that time making our power more secure. You're like a web master with a downed site due to a DDOS going: > Well I've DDOSed the attacker's site so its okay no its not, you've achieved nothing. Get with the program; this is a defence world not an offence one.
- sillysaurus3 9y ago
  In situations where Person A is attacking Person B and making it sound like Person A's solution is the only one, Person A is usually mistaken. My mind is open. Convince me. Why is it a good idea to remove the threat of retaliation from our toolkit? It seems like one of the most persuasive reasons not to attack us.
  - Quarrelsome 9y ago
    I will attack you yet convince you that someone else attacked you. Now you're off attacking the wrong person and your power grid IS STILL OFFLINE. Just put all the effort into keeping the grid up. Absorb all attacks and then export that IP and tech for healthy profit. Its the only winning move.
    - sillysaurus3 9y ago
      Obviously attribution becomes far more important with cyberattacks, but that's a tangential point. You're acting like the power grid going offline is equivalent to a thermonuclear explosion. Yes, it will suck, but it's temporary. And afterwards, those exploit vectors will be patched.
      - Quarrelsome 9y ago
        > Obviously attribution becomes far more important with cyberattacks, but that's a tangential point. No its not, its the whole point. The point of the age of information is that it is a departure from the age of blood and steel. The tactics of blood and steel that you are supporting have no place in this future and are counter-productive. The point of the age of information is that power is no longer solely in the hands of nations. Therefore treating it as a case of "stomping on the bad people" means your attack spread increases from all the nations in the world to all the people in the world. Added to that the evidence of those attacks can and will be forged. You're chasing shadows and its not worth it. Just build a better shield, that's all that matters.
        floatboth 9y ago
        Yes. This. Old government people think of everything in terms of "weapons" and "wars" and they still think the word "cyber" is cool. We need to promote, like, a radical new school of thought about software: Creators of a system should be fully responsible for whatever damage the system causes. A bug is a bug, whether it's exploited by an outside actor or it happens during normal execution. Developers should be responsible for bugs. I like the "defective lock" analogy from https://news.ycombinator.com/item?id=14663474 https://news.ycombinator.com/item?id=14663474

thoth 9y ago

Defense may be the only game worth playing, but how will that work? Unlike the real military where civilians simply don't own the hardware, in computer security they do. NSA isn't a hardware or software vendor, and the corporations that are don't have much of a profit motive to heavily invest in security. They aren't actually liable for problems unlike say a car manufacturer that releases a faulty product, which leaves what exactly... reputation that takes a hit? But every vendor has bugs and security issues and the market isn't really punishing anyone. Is the future effectively an enormous government subsidy to profitable corporations (i.e. NSA and other US government agencies basically become extensions of corporate America's QA department)? Is the future heavy regulations to create the proper financial incentives and/or penalties so corporations start seriously spending on security? It's easy to say "the government should do something!!" but what exactly will that look like?

Quarrelsome 9y ago
Regulate operating systems. Fund programs and research to work out how to create operating systems for our infrastructure that contain less zero days. Ensure we're the ones that find the zero days first. The reason we're vulnerable is because we're unwilling to pay the cost of finding the exploits but people in developing nations ARE because they work for "less". Right now our economies and systems reward those that fly by their pants and don't care for security. That is the problem. The free buffet of infinite growth from technology startups is the very thing that also gives us this pain and we need to learn to eat less.
- SCHiM 9y ago
  I see that going wrong too. If operating systems need to be certified, where does that leave free open source projects?
- jessespears 9y ago
  This would take an extraordinary departure from our current politics. Government intruding on software would (rightly) cause cries from the most stalwart Free Software advocates and from proprietary software companies. Can you imagine the outcry if a new Linux fork had to seek government approval in order to post their distribution? Can you expect Google or Oracle to fail to lobby the government to make sure they don't have to get each major revision certified?

Razengan 9y ago

> so you want to live in a world where both countries don't have any power? Sounds Utopian. Or post-apocalyptic.