7 ms·

This is the choice quote: > "This simply is not a company that deserves to be trusted with Americans' personal data," said Sen. Sherrod Brown, D-Ohio, Obvious

by Top19 9y ago

This is the choice quote: > "This simply is not a company that deserves to be trusted with Americans' personal data," said Sen. Sherrod Brown, D-Ohio, Obviously this quote leaves out a lot of nuance, but I like it and I like what Senator Brown has said in general. What Equifax has let happen is very bad, and I think moral judgments and perhaps even shame (which is how a society can enforce morality) should be brought onto its leaders individually. I hate how businesses and business persons have been making horrible, destructive decisions for decades (not that humans in all fields weren’t beforehand) and have been escaping any kind of shame. Indeed they’ve been praised in many cases. If you look at the top-level pages on Wikipedia (there are about 11 of them), one of them is for “Society”. About a third way down you’ll see “Business” listed under Society. I think this is a good reminder that business is a part of and functions for society, not the other way around. https://en.wikipedia.org/wiki/Portal:Contents/Society_and_social_sciences https://en.wikipedia.org/wiki/Portal:Contents/Society_and_so...

X86BSD 9y ago
That is HILLARIOUS coming from the government that spilled MILLIONS of classified background checks from the OMB offices a few years ago. Absolutely hilarious and ironic and hypocritical. Also, the wife and I were one of the millions whose personal details were stolen from the OMB hack.
- deleted 9y ago
  [deleted]
- hossbeast 9y ago
  Sure but do you disagree with the point being made?
  - jeffdavis 9y ago
    There are two points being conflated: We should hold a high standard. We should not hold a double standard.
- bradleyjg 9y ago
  I have to say I think there's something to what you are saying. The Senators are beating up on this CEO for a security breach that happened under his watch -- suggesting he ought to be fired. For the OMB hack they were the ones with the power to fire the CEO of the organization responsible, i.e. the President. Did even a single one of them call for impeachment? Did any senators resign for thier lack of appropriate oversight? They attack equifax for having bad security policies and procedures and dismiss the claim that one misfeasant employee is responsible. Well they are the organization largely in charge of writing and overseeing policies and procedures for the federal government. Did they attack themselves for doing a bad job after the OMB hack? Did they change any of those policies and procedures in response? They are calling on equifax to fully compensate people whose information was released. What laws did they introduce and pass to fully compensate people whose information was lost by the organization they are in charge of? Technically the identity of the speaker is of no moment, but it's a little hard to avoid rolling ones eyes in the face of such blatant hypocrisy.
  - theevilsharpie 9y ago
    > The Senators are beating up on this CEO for a security breach that happened under his watch -- suggesting he ought to be fired. For the OMB hack they were the ones with the power to fire the CEO of the organization responsible, i.e. the President. Did even a single one of them call for impeachment? Did any senators resign for thier lack of appropriate oversight? Katherine Archuleta was in charge of the OMB during the time of the hack, lawmakers _did_ call for her to be fired, and she ultimately resigned due to the breach.
    - deleted 9y ago
      [deleted]
    - bradleyjg 9y ago
      That's the equivalent of the head of HR, not the CEO of the whole company. No one called for Obama to be fired or resign.
      - 9y ago
platz 9y ago
I'll believe it when the Republicans get on board too.
- Top19 9y ago
  FWIW, and perhaps the best evidence of the strange new universe we live in, Steve Bannon called Republican tax cuts on Charlie Rose “an economic hate crime against America” back in early September.
  - r00fus 9y ago
    Trump & Co are definitely talking out both sides of their mouth. Trump is pushing the GOP tax proposal which has massive tax cuts. Bannon appeases the GOP non-rich voting base with these platitudes. Trump trusts Bannon (or Bannon would be out of a job), despite any Kardashians-like fake acrimony. This is just like the pre-election micro-targeting - they are saying whatever message appeals to whoever they talk to.
    - benaiah 9y ago
      > Bannon would be out of a job Bannon _is_ out of his job at the White House.
      - shawn-furyan 9y ago
        Bannon works for Mercer (Breitbart), who is paying Trump's legal bills. Bannon changed positions, not teams. http://www.newsweek.com/trump-legal-fund-paid-billionaire-robert-mercer-day-comey-fired-676383 http://www.newsweek.com/trump-legal-fund-paid-billionaire-ro...
sgustard 9y ago
Is it a moral failing to be slow to update a Struts vulnerability? As an IT engineer that makes be nervous because I don't know which of a hundred actions I take or don't take in a given day will explode on me. Or was the moral failing to agree to build such a system in the first place?
- chickenfries 9y ago
  > to be slow to update a Struts vulnerability If this Struts vulnerability can lead to the personal information of literally half of America? I'm not a lawyer, but that sounds pretty damn negligent to me. I agree with your larger point that the system probably shouldn't be built in the first place, at least not the way it is now, but there are still plenty of things they could have done, like not store it in plaintext at rest.
- fish_fan 9y ago
  My issue is not that they had the vulnerability, but that the vulberability allowed full access to social security numbers and it wasn’t even the “critical” database! You can take proactive efforts to minimize the risk of breaches; they appeared to store large amounts of unencrypted (or encrypted in aggregate) personally identifiably information together and allowed a single struts vulnerability unfettered access. For instance, one could not duplicate social security numbers, or could allow you to encrypt your data so you need to provide a key for others to access it. The possibilities are endless.
  - KekDemaga 9y ago
    My design would be a ZeroMQ message bus between the database server and the application server. Social Security numbers shouldn't need to be displayed to the user (as they should already know it) thus all the message bus should be carrying is "it matches" or "it doesn't match" in regards to them.
- josephg 9y ago
  > Is it a moral failing to be slow to update a Struts vulnerability? Yes. As a professional engineer you are responsible for the systems you build and maintain. The security of the modern internet depends on engineers on the ground understanding and proactively fixing security issues. There is no one else who can take responsiblity for code you deploy to production. The buck stops with you.
philamonster 9y ago
I think Warren has something to say about accountability. https://www.youtube.com/watch?v=vudP3ROnFYI https://www.youtube.com/watch?v=vudP3ROnFYI
bmmayer1 9y ago
It's very difficult, if not impossible, for society or government to enforce moral judgments, shame, punishment, condemnation, etc on every individual / company that deserves it. The amazing thing about our society is that in most cases, the incentives of individuals are such that even bad people engage in good behavior. You say that businesses and business persons have been making destructive decisions "for decades" but there's definitely a reporting bias there; an overwhelming majority of businesses quietly ship bacon, pack boxes, deliver fertilizer, fold laundry, etc without any moral/shame oversight from senators or society at large. In fact, many of these businesses are likely ran by sonofabitches, but they still engage in good behavior because their incentives are aligned with their consumers. The problem with Equifax and other headline news behaviors (pollution, bank crashes, etc) is not 'bad people made terrible decisions' but 'bad people had no incentive to make right decisions' because, for example, the credit bureaus are simply not motivated to protect consumer data. Legal and financial incentives are both aligned against consumers, not for them. It's a little unfair to pile on the CEO of Equifax or the company because that's just fighting yesterday's battle too late. What we should be doing is fixing the incentive structures such that future Equifaxes don't happen. Also, as other commenters have pointed out, we don't want to discourage good people from running credit bureaus out of fear that innocent mistakes may get them hung.
- FLUX-YOU 9y ago
  >It's a little unfair to pile on the CEO of Equifax or the company because that's just fighting yesterday's battle too late. No it's not. He and the CSO are ultimately responsible. That is part of why they get high pay and golden parachutes. That is their job. Their incentive to make the right decisions is being shown right now via investigations and congressional testimonies which may lead to other charges.
  - bmmayer1 9y ago
    My point was not that they don't deserve condemnation, but that punishing them doesn't help correct the system to prevent the same problem from happening again.
- vec 9y ago
tiggybear 9y ago
Then quit supporting these companies by working for them! The elite have this country over a barrel, it sucks. All anyone that isn't rich can do is to choose to die before they will work for these companies. We've got tons of young men and women that sign up to be in the armed forces who happily go die to enrich the already wealthy...and we celebrate them! So as a society can we start shaming workers that work for Palanatir, Comcast, Pfizer, Equifax? You being on your death-bed and unable to afford food is not an excuse to make the world worse. Die with some fucking integrity.

by Top19 9y ago

X86BSD 9y ago

That is HILLARIOUS coming from the government that spilled MILLIONS of classified background checks from the OMB offices a few years ago. Absolutely hilarious and ironic and hypocritical. Also, the wife and I were one of the millions whose personal details were stolen from the OMB hack.

deleted 9y ago
[deleted]
hossbeast 9y ago
Sure but do you disagree with the point being made?
- jeffdavis 9y ago
  There are two points being conflated: We should hold a high standard. We should not hold a double standard.
bradleyjg 9y ago
I have to say I think there's something to what you are saying. The Senators are beating up on this CEO for a security breach that happened under his watch -- suggesting he ought to be fired. For the OMB hack they were the ones with the power to fire the CEO of the organization responsible, i.e. the President. Did even a single one of them call for impeachment? Did any senators resign for thier lack of appropriate oversight? They attack equifax for having bad security policies and procedures and dismiss the claim that one misfeasant employee is responsible. Well they are the organization largely in charge of writing and overseeing policies and procedures for the federal government. Did they attack themselves for doing a bad job after the OMB hack? Did they change any of those policies and procedures in response? They are calling on equifax to fully compensate people whose information was released. What laws did they introduce and pass to fully compensate people whose information was lost by the organization they are in charge of? Technically the identity of the speaker is of no moment, but it's a little hard to avoid rolling ones eyes in the face of such blatant hypocrisy.
- theevilsharpie 9y ago
  > The Senators are beating up on this CEO for a security breach that happened under his watch -- suggesting he ought to be fired. For the OMB hack they were the ones with the power to fire the CEO of the organization responsible, i.e. the President. Did even a single one of them call for impeachment? Did any senators resign for thier lack of appropriate oversight? Katherine Archuleta was in charge of the OMB during the time of the hack, lawmakers _did_ call for her to be fired, and she ultimately resigned due to the breach.
  - deleted 9y ago
    [deleted]
  - bradleyjg 9y ago
    That's the equivalent of the head of HR, not the CEO of the whole company. No one called for Obama to be fired or resign.
    - 9y ago

platz 9y ago

I'll believe it when the Republicans get on board too.

Top19 9y ago
FWIW, and perhaps the best evidence of the strange new universe we live in, Steve Bannon called Republican tax cuts on Charlie Rose “an economic hate crime against America” back in early September.
- r00fus 9y ago
  Trump & Co are definitely talking out both sides of their mouth. Trump is pushing the GOP tax proposal which has massive tax cuts. Bannon appeases the GOP non-rich voting base with these platitudes. Trump trusts Bannon (or Bannon would be out of a job), despite any Kardashians-like fake acrimony. This is just like the pre-election micro-targeting - they are saying whatever message appeals to whoever they talk to.
  - benaiah 9y ago
    > Bannon would be out of a job Bannon _is_ out of his job at the White House.
    - shawn-furyan 9y ago
      Bannon works for Mercer (Breitbart), who is paying Trump's legal bills. Bannon changed positions, not teams. http://www.newsweek.com/trump-legal-fund-paid-billionaire-robert-mercer-day-comey-fired-676383 http://www.newsweek.com/trump-legal-fund-paid-billionaire-ro...

sgustard 9y ago

Is it a moral failing to be slow to update a Struts vulnerability? As an IT engineer that makes be nervous because I don't know which of a hundred actions I take or don't take in a given day will explode on me. Or was the moral failing to agree to build such a system in the first place?

chickenfries 9y ago
> to be slow to update a Struts vulnerability If this Struts vulnerability can lead to the personal information of literally half of America? I'm not a lawyer, but that sounds pretty damn negligent to me. I agree with your larger point that the system probably shouldn't be built in the first place, at least not the way it is now, but there are still plenty of things they could have done, like not store it in plaintext at rest.
fish_fan 9y ago
My issue is not that they had the vulnerability, but that the vulberability allowed full access to social security numbers and it wasn’t even the “critical” database! You can take proactive efforts to minimize the risk of breaches; they appeared to store large amounts of unencrypted (or encrypted in aggregate) personally identifiably information together and allowed a single struts vulnerability unfettered access. For instance, one could not duplicate social security numbers, or could allow you to encrypt your data so you need to provide a key for others to access it. The possibilities are endless.
- KekDemaga 9y ago
  My design would be a ZeroMQ message bus between the database server and the application server. Social Security numbers shouldn't need to be displayed to the user (as they should already know it) thus all the message bus should be carrying is "it matches" or "it doesn't match" in regards to them.
josephg 9y ago
> Is it a moral failing to be slow to update a Struts vulnerability? Yes. As a professional engineer you are responsible for the systems you build and maintain. The security of the modern internet depends on engineers on the ground understanding and proactively fixing security issues. There is no one else who can take responsiblity for code you deploy to production. The buck stops with you.

philamonster 9y ago

I think Warren has something to say about accountability. https://www.youtube.com/watch?v=vudP3ROnFYI https://www.youtube.com/watch?v=vudP3ROnFYI

bmmayer1 9y ago

It's very difficult, if not impossible, for society or government to enforce moral judgments, shame, punishment, condemnation, etc on every individual / company that deserves it. The amazing thing about our society is that in most cases, the incentives of individuals are such that even bad people engage in good behavior. You say that businesses and business persons have been making destructive decisions "for decades" but there's definitely a reporting bias there; an overwhelming majority of businesses quietly ship bacon, pack boxes, deliver fertilizer, fold laundry, etc without any moral/shame oversight from senators or society at large. In fact, many of these businesses are likely ran by sonofabitches, but they still engage in good behavior because their incentives are aligned with their consumers. The problem with Equifax and other headline news behaviors (pollution, bank crashes, etc) is not 'bad people made terrible decisions' but 'bad people had no incentive to make right decisions' because, for example, the credit bureaus are simply not motivated to protect consumer data. Legal and financial incentives are both aligned against consumers, not for them. It's a little unfair to pile on the CEO of Equifax or the company because that's just fighting yesterday's battle too late. What we should be doing is fixing the incentive structures such that future Equifaxes don't happen. Also, as other commenters have pointed out, we don't want to discourage good people from running credit bureaus out of fear that innocent mistakes may get them hung.

FLUX-YOU 9y ago
>It's a little unfair to pile on the CEO of Equifax or the company because that's just fighting yesterday's battle too late. No it's not. He and the CSO are ultimately responsible. That is part of why they get high pay and golden parachutes. That is their job. Their incentive to make the right decisions is being shown right now via investigations and congressional testimonies which may lead to other charges.
- bmmayer1 9y ago
  My point was not that they don't deserve condemnation, but that punishing them doesn't help correct the system to prevent the same problem from happening again.
vec 9y ago

tiggybear 9y ago

Then quit supporting these companies by working for them! The elite have this country over a barrel, it sucks. All anyone that isn't rich can do is to choose to die before they will work for these companies. We've got tons of young men and women that sign up to be in the armed forces who happily go die to enrich the already wealthy...and we celebrate them! So as a society can we start shaming workers that work for Palanatir, Comcast, Pfizer, Equifax? You being on your death-bed and unable to afford food is not an excuse to make the world worse. Die with some fucking integrity.