4 ms·

> Would you dispute my characterization of those expired certs as "negligence"? I would. Does the report indicate that the cert was expired due to budget issu

> Would you dispute my characterization of those expired certs as "negligence"? I would. Does the report indicate that the cert was expired due to budget issues? Does it show that cybersecurity was low priority? Again, the report shows the opposite: they had solid policies and procedures in place, but the failures seem to be in execution and training. > Monetary penalties for undesirable behavior is insane. No, that's just fine. And Equifax took a huge stock hit, had to make a potentially cash generating service free for everyone, has to earn back its reputation, etc. > Let's repeal all tort laws and cancel criminal fines, and make no attempt to levy proportional damages for anything. Let the C-suite keep their options! Show the criminal activity that resulted in the breach (by Equifax, not the attackers). Show the damages that have resulted from the breach. > If all else fails, a yellow vest might help. I'm hoping it doesn't come to that here. If it does, it won't be over the Equifax breach (or even the other 4 larger breaches: https://abcnews.go.com/Technology/marriotts-data-breach-large-largest-worst-corporate-hacks/story?id=59520391 https://abcnews.go.com/Technology/marriotts-data-breach-larg...).

arduanika 8y ago
> Does the report indicate... > Does it show... > the report shows... I'm not asking you whether the House Republicans would call the expired certs negligent, or the security underprioritized. I'm asking you, as the reader of a technical forum. Do you believe everything the government tells you? Or here, what one party tells you? At the very least, read the minority report linked elsewhere in this thread, and interpolate. > huge stock hit Nowhere near huge enough, and it rebounded once it was clear there were basically no consequences. > has to earn back its reputation Why? Equifax could care less what its unwilling inventory thinks of it. > Show the criminal activity... Name one victim whose damages are large enough to merit hiring a lawyer to comb all the contracts to identify the line where a bank promised that Equifax promised that the victim's data would be safe, and I'll show you a breach of contract. Hint: it's a different line for each victim. > Show the damages... Precisely my point: the damages to the public are "massively distributed" and infeasible to pin down, which is why there should be a criminal penalty, like we do for say, ozone-depleting chemicals. > it won't be over the Equifax breach (sigh) you're probably right.
- g051051 8y ago
  > I'm not asking you whether the House Republicans would call the expired certs negligent, or the security underprioritized. I'm asking you, as the reader of a technical forum. No, that's not negligent. Nor was security "underprioritized". If you read the reporting on the issue (whether the government report or just reputable news), it show solid processes and procedures, but there were implementation flaws. There is no amount of security that will ever be perfect. > Do you believe everything the government tells you? Or here, what one party tells you? At the very least, read the minority report linked elsewhere in this thread, and interpolate. Considering that the report matches all the other reputable reporting on the issue? Yes, I believe it. Equifax is claiming "factual errors", but I'd have to see their response before commenting on that. > Nowhere near huge enough That's your opinion, but the market has decided otherwise. > Equifax could care less what its unwilling inventory thinks of it. Correct. I was talking about their customers...the businesses that supply and use their data and services. > Name one victim whose damages are large enough to merit hiring a lawyer to comb all the contracts to identify the line where a bank promised that Equifax promised that the victim's data would be safe, and I'll show you a breach of contract. Hint: it's a different line for each victim. Once you do that, prove that the information came from the Equifax breach, and not one of the dozens of other breaches, let alone the 4 other large breaches I cited. > the damages to the public are "massively distributed" and infeasible to pin down, which is why there should be a criminal penalty, like we do for say, ozone-depleting chemicals. Or their negligible and impossible to detect at any meaningful level. > (sigh) you're probably right. It's troubling that you seem to think violence is some sort of solution to any problem, let alone this problem.
  - arduanika 8y ago
    > the market has decided Like do you understand what an externality is? When I say it's not huge enough, it's pretty clear that I don't mean Equifax is overvalued & people should all go out and short it. The lawmakers and regulators have decided that the externality will have no significant consequences. The market hardly decides anything here; it reacts. My reading of the reports is that this company was roughly in line with common practices. My point is that common practices must change.

arduanika 8y ago

> Does the report indicate... > Does it show... > the report shows... I'm not asking you whether the House Republicans would call the expired certs negligent, or the security underprioritized. I'm asking you, as the reader of a technical forum. Do you believe everything the government tells you? Or here, what one party tells you? At the very least, read the minority report linked elsewhere in this thread, and interpolate. > huge stock hit Nowhere near huge enough, and it rebounded once it was clear there were basically no consequences. > has to earn back its reputation Why? Equifax could care less what its unwilling inventory thinks of it. > Show the criminal activity... Name one victim whose damages are large enough to merit hiring a lawyer to comb all the contracts to identify the line where a bank promised that Equifax promised that the victim's data would be safe, and I'll show you a breach of contract. Hint: it's a different line for each victim. > Show the damages... Precisely my point: the damages to the public are "massively distributed" and infeasible to pin down, which is why there should be a criminal penalty, like we do for say, ozone-depleting chemicals. > it won't be over the Equifax breach (sigh) you're probably right.

g051051 8y ago
> I'm not asking you whether the House Republicans would call the expired certs negligent, or the security underprioritized. I'm asking you, as the reader of a technical forum. No, that's not negligent. Nor was security "underprioritized". If you read the reporting on the issue (whether the government report or just reputable news), it show solid processes and procedures, but there were implementation flaws. There is no amount of security that will ever be perfect. > Do you believe everything the government tells you? Or here, what one party tells you? At the very least, read the minority report linked elsewhere in this thread, and interpolate. Considering that the report matches all the other reputable reporting on the issue? Yes, I believe it. Equifax is claiming "factual errors", but I'd have to see their response before commenting on that. > Nowhere near huge enough That's your opinion, but the market has decided otherwise. > Equifax could care less what its unwilling inventory thinks of it. Correct. I was talking about their customers...the businesses that supply and use their data and services. > Name one victim whose damages are large enough to merit hiring a lawyer to comb all the contracts to identify the line where a bank promised that Equifax promised that the victim's data would be safe, and I'll show you a breach of contract. Hint: it's a different line for each victim. Once you do that, prove that the information came from the Equifax breach, and not one of the dozens of other breaches, let alone the 4 other large breaches I cited. > the damages to the public are "massively distributed" and infeasible to pin down, which is why there should be a criminal penalty, like we do for say, ozone-depleting chemicals. Or their negligible and impossible to detect at any meaningful level. > (sigh) you're probably right. It's troubling that you seem to think violence is some sort of solution to any problem, let alone this problem.
- arduanika 8y ago
  > the market has decided Like do you understand what an externality is? When I say it's not huge enough, it's pretty clear that I don't mean Equifax is overvalued & people should all go out and short it. The lawmakers and regulators have decided that the externality will have no significant consequences. The market hardly decides anything here; it reacts. My reading of the reports is that this company was roughly in line with common practices. My point is that common practices must change.