4 ms·

You claim that you keep my data safe. You missed it. It's not a trade off, it's a failure on your part...

tptacek 9y ago
It very much is a trade-off, because the expense that would go in to making a large enterprise network reliably secure would be extreme, and would drive prices up, retard economic growth, and most likely result in software engineers making substantially less money. I'm not saying you should like the tradeoff, or that the existence of the tradeoff doesn't have implications for how we should regulate banks and credit ratings agencies. I'm just saying that if you think there's some other CRA that has reliably protected its IT assets from threats like this, you're wrong.
- abiox 9y ago
  > It very much is a trade-off this seems like goalpost moving. first you said 'we as a society', yet there isn't much 'we' in this. it doesn't seem to me that people (the general public) are properly aware at just how vulnerable they are. they haven't therefore 'decided' that this is okay. > the expense that would go in to making a large enterprise network reliably secure would be extreme, and would drive prices up, retard economic growth what is this based on?
  - tptacek 9y ago
    Part of living in a society is recognizing that you still belong to it even when it makes decisions you don't agree with. To more directly answer your question, though, consider a regime of general commercial liability for security incidents caused by failures of engineering (which Equifax is an example of). What would it be like to bring new products to market under such a regime? How much more difficult would it be to enter the field? How much more difficult to hire qualified people? What would that do to the prices of things made possible largely through software engineering work? When the prices of things increase, they're put out of reach of more consumers; markets constrict. What does that do for employment? What does reduced employment in a sector do to wages? I'm not saying this to justify insecurity. I'm ambivalent about the tradeoffs our society has made on these issues. I just don't think we tend to grapple with them honestly on HN.
    - chris_wot 9y ago
      If that new product exposes scads of private data, then it's rather irrelevant. These credit scores aren't something most people signed up for, they are a product for financial lenders and not for the direct consumer.
      - tptacek 9y ago
        Like I said, the fact of the tradeoff probably does have implications for how we regulate companies like Equifax.
        Drdrdrq 9y ago
        Sorry, I have to disagree. Performing regular pen testing is costly, so skiping it is a tradeoff. Employing a team of security engineers is also costly and there aren't enough of them to make that viable for all companies. Tradeoff. But putting such data in direct access of a web server, a single RCE away from exposure? That's not a tradeoff, that's negligence.
        tptacek 9y ago
        You've lost me. I think you may have misunderstood my point about pentests. I mean "success" from the perspective of the testers: you asked me to own your network up, and I succeeded. My point is: the most savvy companies contract annual sitewide pentests, in addition to all the other stuff they do to secure their networks, and virtually all of those pentests "succeed" (from the perspective of the testers). Further: not only have I never personally been on an internal network pentest (the kind where you start with an IP "behind the firewall" and nothing else) that failed, but I'm not sure I've even ever heard of one that failed. I'm certain there are some networks that are so resilient that they've stymied a competent internal pentest --- but again, I wouldn't know which one, because I've never heard of that happening.
    - briandear 9y ago
      Apple’s payments systems haven’t been breached, nor do I recall a breach of Stripe and I would bet my teeth that their security is far better and more proactive than Equifax — a company that’s entire business is based on data brokering. If they can’t handle the “cost” of correct security or, at the very least keeping dependencies updated, then they ought not be in business. If security makes it expensive, then perhaps there should be more competition? The credit bureaus have a near monopoly so they don’t have to be aggressive about security as a Stripe might need to be. That complacency and just general malfeasance means they ought to be sued out of existence. I bet any number of Silicon Valley startups have better security than Equifax — at far lower budgets. It isn’t a cost issue — it’s a competency one.
- justicezyx 9y ago
  I am not sure how can you justify the company's childish security practice.
tedmiston 9y ago
"Safe" is full of grey area, just like security isn't binary.

It very much is a trade-off, because the expense that would go in to making a large enterprise network reliably secure would be extreme, and would drive prices up, retard economic growth, and most likely result in software engineers making substantially less money. I'm not saying you should like the tradeoff, or that the existence of the tradeoff doesn't have implications for how we should regulate banks and credit ratings agencies. I'm just saying that if you think there's some other CRA that has reliably protected its IT assets from threats like this, you're wrong.

abiox 9y ago
> It very much is a trade-off this seems like goalpost moving. first you said 'we as a society', yet there isn't much 'we' in this. it doesn't seem to me that people (the general public) are properly aware at just how vulnerable they are. they haven't therefore 'decided' that this is okay. > the expense that would go in to making a large enterprise network reliably secure would be extreme, and would drive prices up, retard economic growth what is this based on?
- tptacek 9y ago
  Part of living in a society is recognizing that you still belong to it even when it makes decisions you don't agree with. To more directly answer your question, though, consider a regime of general commercial liability for security incidents caused by failures of engineering (which Equifax is an example of). What would it be like to bring new products to market under such a regime? How much more difficult would it be to enter the field? How much more difficult to hire qualified people? What would that do to the prices of things made possible largely through software engineering work? When the prices of things increase, they're put out of reach of more consumers; markets constrict. What does that do for employment? What does reduced employment in a sector do to wages? I'm not saying this to justify insecurity. I'm ambivalent about the tradeoffs our society has made on these issues. I just don't think we tend to grapple with them honestly on HN.
  - chris_wot 9y ago
    If that new product exposes scads of private data, then it's rather irrelevant. These credit scores aren't something most people signed up for, they are a product for financial lenders and not for the direct consumer.
    - tptacek 9y ago
      Like I said, the fact of the tradeoff probably does have implications for how we regulate companies like Equifax.
      - Drdrdrq 9y ago
        Sorry, I have to disagree. Performing regular pen testing is costly, so skiping it is a tradeoff. Employing a team of security engineers is also costly and there aren't enough of them to make that viable for all companies. Tradeoff. But putting such data in direct access of a web server, a single RCE away from exposure? That's not a tradeoff, that's negligence.
        tptacek 9y ago
        You've lost me. I think you may have misunderstood my point about pentests. I mean "success" from the perspective of the testers: you asked me to own your network up, and I succeeded. My point is: the most savvy companies contract annual sitewide pentests, in addition to all the other stuff they do to secure their networks, and virtually all of those pentests "succeed" (from the perspective of the testers). Further: not only have I never personally been on an internal network pentest (the kind where you start with an IP "behind the firewall" and nothing else) that failed, but I'm not sure I've even ever heard of one that failed. I'm certain there are some networks that are so resilient that they've stymied a competent internal pentest --- but again, I wouldn't know which one, because I've never heard of that happening.
  - briandear 9y ago
    Apple’s payments systems haven’t been breached, nor do I recall a breach of Stripe and I would bet my teeth that their security is far better and more proactive than Equifax — a company that’s entire business is based on data brokering. If they can’t handle the “cost” of correct security or, at the very least keeping dependencies updated, then they ought not be in business. If security makes it expensive, then perhaps there should be more competition? The credit bureaus have a near monopoly so they don’t have to be aggressive about security as a Stripe might need to be. That complacency and just general malfeasance means they ought to be sued out of existence. I bet any number of Silicon Valley startups have better security than Equifax — at far lower budgets. It isn’t a cost issue — it’s a competency one.
justicezyx 9y ago
I am not sure how can you justify the company's childish security practice.

tedmiston 9y ago

"Safe" is full of grey area, just like security isn't binary.