5 ms·

Nothing can be done. It's a wildly asymmetrical relationship that means 9 billion people get a try to knock you out and your team of what??? 25, 50, 100, 1000?

Nothing can be done. It's a wildly asymmetrical relationship that means 9 billion people get a try to knock you out and your team of what??? 25, 50, 100, 1000? Security specialists have to see everything possible and plan for any and all possibilities. It's never going to happen. This is the simple reality of the internet and I'm sure you know this, but I saw your comment and thought I'd add this for the next person who may not realize this. I'm personally curious to know, because I'm no SecOps; if there is even a theoretical solution to the internet that would have greater integrity for the users or if this is as good as it gets.

rhizome 7y ago
>Nothing can be done. Please don't do this. Something can be done, we all know it, but for some reason don't think it's possible? Prison sentences should have started with the Target CTO in 2013 (at the very latest), but the more the public is cowed by shrug emojis, the less likely companies will protect your data for anything other than commercial advantage.
- deleted 7y ago
  [deleted]
- jjeaff 7y ago
  Imprisoning CTOs for incompetence would be unprecedented. We don't imprison people for that reason and I can't imagine any knowledgeable CTO ever taking that position again once that precedent was set. But we do need much more oversight and serious punishment for companies that lose data like this.
  - 616c 7y ago
    Security engineer here. Why? US soldiers fight in combat knowing failure to obey orders can land them in jail for years. The US Code of Military Justice is not fun, and you sign up for it when you join implicitly. Is there an armed service staffing problem? Our general US legal system is flawed, but cops can go to jail for ethical violations and criminal behavior for actions that are integral parts of their job function. Is there a cop staffing shortage? I have argued this, ironically, about US Congresspeople: if we have a volunteer army with stringent legal codes with special punishment by virtue of their job, serving us, why are other classes of people not worthy of higher standards and why do we suspect people will shy away from that? How can we pay others more for higher probability of incompetence and less repercussions? I am not trolling. When I suggested this shows the power of commitment in volunteer armies and I wish Congress had that kind of self respect people tell me I'm nuts. I would like a CTO and security industry jobs to mean something.
    - jjeaff 7y ago
      A CTO can go to jail for unethical and illegal behavior. But you are suggesting they be jailed for incompetence. And considering the fact that no amount of competence will protect you from a sufficiently motivated and resourceful hacker, seems unfair. Now if we come up with a framework and a security checklist that must be followed and certified by the CTO every quarter or something, and they don't do it, or lie, then sure, jail them.
  - rhizome 7y ago
    Everything was "unprecedented" at some point before they existed. It's only a matter of choice and priorities.
- paulddraper 7y ago
  There has to be a felony for someone to go to prison.
  - rhizome 7y ago
    Yes, legislation is the first step. They made it illegal to access certain data with the CFAA, there's no reason illegally accessing data of a person can't be legislated too. Well, except for "businesses should be allowed to do anything they want."
- badsectoracula 7y ago
  I have another proposal: let's stop connecting every computer together for the sake of connecting them together. Unless there is real functionality provided by said connection that doesn't exist just to excuse the connection, computers should do all their work locally. We rely way too much on Other People's Computers to do stuff. The only real way to avoid issues is to make them technically impossible, not to rely on laws (that can be abused). (yes, i know i am asking for putting the cat back in the bag long after the cat's own grandchildren have died...)
DoctorOetker 7y ago
there is of course still such a thing as formal proofs and verification. with enough attention on information theoretic security (or unconditional security), things may change
pbhjpbhj 7y ago
A fine of 4% of global revenue might start to focus their minds?

rhizome 7y ago

>Nothing can be done. Please don't do this. Something can be done, we all know it, but for some reason don't think it's possible? Prison sentences should have started with the Target CTO in 2013 (at the very latest), but the more the public is cowed by shrug emojis, the less likely companies will protect your data for anything other than commercial advantage.

deleted 7y ago
[deleted]
jjeaff 7y ago
Imprisoning CTOs for incompetence would be unprecedented. We don't imprison people for that reason and I can't imagine any knowledgeable CTO ever taking that position again once that precedent was set. But we do need much more oversight and serious punishment for companies that lose data like this.
- 616c 7y ago
  Security engineer here. Why? US soldiers fight in combat knowing failure to obey orders can land them in jail for years. The US Code of Military Justice is not fun, and you sign up for it when you join implicitly. Is there an armed service staffing problem? Our general US legal system is flawed, but cops can go to jail for ethical violations and criminal behavior for actions that are integral parts of their job function. Is there a cop staffing shortage? I have argued this, ironically, about US Congresspeople: if we have a volunteer army with stringent legal codes with special punishment by virtue of their job, serving us, why are other classes of people not worthy of higher standards and why do we suspect people will shy away from that? How can we pay others more for higher probability of incompetence and less repercussions? I am not trolling. When I suggested this shows the power of commitment in volunteer armies and I wish Congress had that kind of self respect people tell me I'm nuts. I would like a CTO and security industry jobs to mean something.
  - jjeaff 7y ago
    A CTO can go to jail for unethical and illegal behavior. But you are suggesting they be jailed for incompetence. And considering the fact that no amount of competence will protect you from a sufficiently motivated and resourceful hacker, seems unfair. Now if we come up with a framework and a security checklist that must be followed and certified by the CTO every quarter or something, and they don't do it, or lie, then sure, jail them.
- rhizome 7y ago
  Everything was "unprecedented" at some point before they existed. It's only a matter of choice and priorities.
paulddraper 7y ago
There has to be a felony for someone to go to prison.
- rhizome 7y ago
  Yes, legislation is the first step. They made it illegal to access certain data with the CFAA, there's no reason illegally accessing data of a person can't be legislated too. Well, except for "businesses should be allowed to do anything they want."
badsectoracula 7y ago
I have another proposal: let's stop connecting every computer together for the sake of connecting them together. Unless there is real functionality provided by said connection that doesn't exist just to excuse the connection, computers should do all their work locally. We rely way too much on Other People's Computers to do stuff. The only real way to avoid issues is to make them technically impossible, not to rely on laws (that can be abused). (yes, i know i am asking for putting the cat back in the bag long after the cat's own grandchildren have died...)

DoctorOetker 7y ago

there is of course still such a thing as formal proofs and verification. with enough attention on information theoretic security (or unconditional security), things may change

pbhjpbhj 7y ago

A fine of 4% of global revenue might start to focus their minds?