3 ms·

> Would taxpayers/stockholders fund it? And who pays the ransomware when it happens, if not the taxpayers/stockholders? Or does money just get created out of n

> Would taxpayers/stockholders fund it? And who pays the ransomware when it happens, if not the taxpayers/stockholders? Or does money just get created out of nothing when needed? > Would a small business have the cash flow to do better? IME small businesses can do it if they want to. It takes care, meaning policies, it's not expensive. Also small businesses are less attractive to large criminals. > If they were told it was secure from the tech folks, would the non-tech folks have any way to prove this wrong? If they got publicly ransomed, it would become very obvious something needed looking at. The process of potentially hammering them legally would involve them being taken to court where their level of culpability would be decided (and it may be they did do enough so get let off, and everyone can see what happened, and other businesses can decide perhaps to up their security based on the results). These are all strawmen. I'm not asking for uncrackability, merely due diligence. A little of that goes a long way. These arguments don't stand up. You seem to be arguing for... what?

afiori 7y ago
> And who pays the ransomware when it happens, if not the taxpayers/stockholders? considering the order of magnitude of place that do not receive a ransom compared to places that get ransomed, the cost is probably on the security side. > These are all strawmen. I'm not asking for uncrackability, merely due diligence. but you apparently define due diligence as "not getting cracked," which while different from uncrackability is still an unfeasible demand.
- tempguy9999 7y ago
  > considering the order of magnitude of place that do not receive a ransom compared to places that get ransomed, the cost is probably on the security side. And if ransoming is profitable, what does that do to the market? Does it a) inhibit more ransoming or b) encourage more ransoming? > but you apparently define due diligence as "not getting cracked," Don't misrepresent me - here's what I actually said: "The process of potentially hammering them legally would involve them being taken to court where their level of culpability would be decided (and it may be they did do enough so get let off..." So they can be let off. It says clearly.
  - afiori 7y ago
    An alternative is that by working together with law enforcement you can use the interactions with the criminals (together with tracking the money) to better understand the criminal organizations. How is this different from making it illegal to give your wallet to a thief at gunpoint? (obviously here there is the difference of personal harming which correctly resides at a different level; at the same time the stance of non-negotiation with terrorist organization was also justifiable in my opinion. If what we can agree on is that you must way for the permission of law enforcement before you pay ransom so that they can reasonably confirm you are not inadvertently funding ISIS and also put in place all available precautions that is already a step forward. Nobody think that paying ransom is a good thing that should be done as soon as possible. At the same time not everything is a nail.)
    - tempguy9999 7y ago
      > An alternative is that by working together with law enforcement... If we put that on the table, yes, that's a grand idea.

afiori 7y ago

> And who pays the ransomware when it happens, if not the taxpayers/stockholders? considering the order of magnitude of place that do not receive a ransom compared to places that get ransomed, the cost is probably on the security side. > These are all strawmen. I'm not asking for uncrackability, merely due diligence. but you apparently define due diligence as "not getting cracked," which while different from uncrackability is still an unfeasible demand.

tempguy9999 7y ago
> considering the order of magnitude of place that do not receive a ransom compared to places that get ransomed, the cost is probably on the security side. And if ransoming is profitable, what does that do to the market? Does it a) inhibit more ransoming or b) encourage more ransoming? > but you apparently define due diligence as "not getting cracked," Don't misrepresent me - here's what I actually said: "The process of potentially hammering them legally would involve them being taken to court where their level of culpability would be decided (and it may be they did do enough so get let off..." So they can be let off. It says clearly.
- afiori 7y ago
  An alternative is that by working together with law enforcement you can use the interactions with the criminals (together with tracking the money) to better understand the criminal organizations. How is this different from making it illegal to give your wallet to a thief at gunpoint? (obviously here there is the difference of personal harming which correctly resides at a different level; at the same time the stance of non-negotiation with terrorist organization was also justifiable in my opinion. If what we can agree on is that you must way for the permission of law enforcement before you pay ransom so that they can reasonably confirm you are not inadvertently funding ISIS and also put in place all available precautions that is already a step forward. Nobody think that paying ransom is a good thing that should be done as soon as possible. At the same time not everything is a nail.)
  - tempguy9999 7y ago
    > An alternative is that by working together with law enforcement... If we put that on the table, yes, that's a grand idea.