8 ms·

She's blaming the software industry and software failure. That's Apache, and Struts. If she wanted to lay it on Equifax, she might go into the fact that the Ch

by danjoc 9y ago

She's blaming the software industry and software failure. That's Apache, and Struts. If she wanted to lay it on Equifax, she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music, https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic... The people that actually "do" are Chief Peon of Cube Farms, doing whatever the boss with a music degree tells them is priority. >You're right in that this seems to be zero-day which are more difficult to defend against There's no nuance. It is under-reporting the facts to make her hit piece look stronger. It's never the leadership's fault when there's a failure in the US, but they happily take credit when there is success. >but there are practices Which don't help at all against a zero-day in a dependency.

grzm 9y ago
> She's blaming the software industry and software failure. That's Apache, and Struts. I interpret her differently: > There are technical factors that explain why cybersecurity is so weak, but the underlying reason is political, and it’s pretty simple: Big corporations have poured large amounts of money into our political system, helping to create a regulatory environment in which consumers shoulder more and more of the risk, and companies less and less. > This is a general feature of our lopsided world, but software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. Information technology arrived on the scene only recently, so it has faced fewer of the kinds of regulations that consumers and citizens, in more progressive eras, managed to impose on other industries. To me, that reads as taking corporate interests and business motives to task, not software practices. Software development (like any other work) is a cost, and businesses need to balance those costs against business revenues. I'd argue who's chosen for C-level positions is a business decision, not a software practice one. If the costs of failure in production due to bugs were higher, businesses would make different decisions in hiring and how much time was dedicated to security and bug fixing. Do you disagree? Testing and quality control is expensive. If we can roll out a feature (or just continue business) spending as little as possible on testing and QA, it can certainly be an understandable decision (whether or not you agree) to do as little QA and testing as possible: you're not providing any new features (which may increase revenues): you're just increasing cost. > It's never the leadership's fault when there's a failure in the US, but they happily take credit when there is success. It's not clear to me which leadership you're referring to here. The government? The corporate leadership? Someone else? If the corporate leadership, I think that's entirely the point Tufekci is making.
- danjoc 9y ago
  >software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. TIL: No warranty == impunity. Nobody MADE Equifax use Struts. The source is open to inspection. The bug existed there for 8 years. Let's see how many audits Equifax did on the source code with no warranty. >If the costs of failure in production due to bugs were higher, businesses would make different decisions in hiring and how much time was dedicated to security and bug fixing. Do you disagree? If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software. He'd find a different line of work. If he did write it, he would never release it for the world to use for free. Who would do that? "Here's this thing I worked on for over a decade. You can use it for free. Please sue me if you have any issues. Thanks."
  - grzm 9y ago
    I'm sorry. I really think we're talking past each other. At this point I'm having a really hard time figuring out what you're trying to say. I see you equating Struts and software practices with the businesses that use software. I see those as two separate things. > Nobody MADE Equifax use Struts. Yup. > The source is open to inspection. Yup. > Let's see how many audits Equifax did on the source code with no warranty. I'm not sure why you're including this. I think they should have done source code audits in accordance with how they weighed the costs/revenues. Do you disagree? I personally tend to lean towards more tests and code analysis, but I understand others weigh this differently. > If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software. I place the responsibly with the company using Struts in their product, not the Struts dev. I'm not sure how you're getting the impression I (or Zufrekci, for that matter) place this on the Struts dev. I'm responsible for the results of the applications I put into production, including the libraries I choose to use in that application. I don't hold generally hold the devs who wrote those libraries responsible. Like I said, I think we're talking past each other. I still think you're reading too much into (and too little close reading of) Zufrekci, but I'm not sure how better to express what I'm trying to say. I've now read the piece through 3 times fully and I really don't see her making any of the points you're arguing against. If you've got specific questions about what I've written, please ask. Otherwise, I'll sign off. Have a good evening!
ganoushoreilly 9y ago
"she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music," To be fair, I would say a third of the Infosec professionals I know have backgrounds in the ARTS (myself included). While the CISO is definitely suspect, having an arts degree doesn't make one less of an effective INFOSEC practitioner. In fact, the creative nature of those drawn to the arts has proven valuable finding creative solutions to problems within our organization.

by danjoc 9y ago

grzm 9y ago

> She's blaming the software industry and software failure. That's Apache, and Struts. I interpret her differently: > There are technical factors that explain why cybersecurity is so weak, but the underlying reason is political, and it’s pretty simple: Big corporations have poured large amounts of money into our political system, helping to create a regulatory environment in which consumers shoulder more and more of the risk, and companies less and less. > This is a general feature of our lopsided world, but software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. Information technology arrived on the scene only recently, so it has faced fewer of the kinds of regulations that consumers and citizens, in more progressive eras, managed to impose on other industries. To me, that reads as taking corporate interests and business motives to task, not software practices. Software development (like any other work) is a cost, and businesses need to balance those costs against business revenues. I'd argue who's chosen for C-level positions is a business decision, not a software practice one. If the costs of failure in production due to bugs were higher, businesses would make different decisions in hiring and how much time was dedicated to security and bug fixing. Do you disagree? Testing and quality control is expensive. If we can roll out a feature (or just continue business) spending as little as possible on testing and QA, it can certainly be an understandable decision (whether or not you agree) to do as little QA and testing as possible: you're not providing any new features (which may increase revenues): you're just increasing cost. > It's never the leadership's fault when there's a failure in the US, but they happily take credit when there is success. It's not clear to me which leadership you're referring to here. The government? The corporate leadership? Someone else? If the corporate leadership, I think that's entirely the point Tufekci is making.

danjoc 9y ago
>software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. TIL: No warranty == impunity. Nobody MADE Equifax use Struts. The source is open to inspection. The bug existed there for 8 years. Let's see how many audits Equifax did on the source code with no warranty. >If the costs of failure in production due to bugs were higher, businesses would make different decisions in hiring and how much time was dedicated to security and bug fixing. Do you disagree? If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software. He'd find a different line of work. If he did write it, he would never release it for the world to use for free. Who would do that? "Here's this thing I worked on for over a decade. You can use it for free. Please sue me if you have any issues. Thanks."
- grzm 9y ago
  I'm sorry. I really think we're talking past each other. At this point I'm having a really hard time figuring out what you're trying to say. I see you equating Struts and software practices with the businesses that use software. I see those as two separate things. > Nobody MADE Equifax use Struts. Yup. > The source is open to inspection. Yup. > Let's see how many audits Equifax did on the source code with no warranty. I'm not sure why you're including this. I think they should have done source code audits in accordance with how they weighed the costs/revenues. Do you disagree? I personally tend to lean towards more tests and code analysis, but I understand others weigh this differently. > If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software. I place the responsibly with the company using Struts in their product, not the Struts dev. I'm not sure how you're getting the impression I (or Zufrekci, for that matter) place this on the Struts dev. I'm responsible for the results of the applications I put into production, including the libraries I choose to use in that application. I don't hold generally hold the devs who wrote those libraries responsible. Like I said, I think we're talking past each other. I still think you're reading too much into (and too little close reading of) Zufrekci, but I'm not sure how better to express what I'm trying to say. I've now read the piece through 3 times fully and I really don't see her making any of the points you're arguing against. If you've got specific questions about what I've written, please ask. Otherwise, I'll sign off. Have a good evening!

ganoushoreilly 9y ago

"she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music," To be fair, I would say a third of the Infosec professionals I know have backgrounds in the ARTS (myself included). While the CISO is definitely suspect, having an arts degree doesn't make one less of an effective INFOSEC practitioner. In fact, the creative nature of those drawn to the arts has proven valuable finding creative solutions to problems within our organization.