5 ms·

As cynical as I may sound, but cybersecurity threats like this will continue to be ignored until they sufficiently escalate into consequences. And that stateme

by tetha 7y ago

As cynical as I may sound, but cybersecurity threats like this will continue to be ignored until they sufficiently escalate into consequences. And that statement, while obvious, is darker than it seems. Companies going under aren't sufficient consequences (many ransomware cases). Universities going offline isn't enough (look for the uni giessen). The bureaucracy of cities going offline isn't enough (e.g. New Orleans). This is just going to continue to escalate until something really really ugly happens and kills many people. And then we'll be presented with some grand legislation that I don't look forward to.

deleted 7y ago
[deleted]
K0SM0S 7y ago
Let me share this thought experiment. - most companies are really bad at security - most people do not care about the security of their data, passwords, etc. Based on these facts, I've been operating for a decade now under the assumption that one day within my lifetime, all of our logged online activity may become public after some hack. All of it that's logged somewhere. Chats, pics, posts, history, notes, cloud drives... It may be slightly paranoid, but better safe than sorry. I should add that I live "normally", I don't care about my pics or discussions becoming public when it happens to everyone else too. I just remain cognizant that there's high probability here. As outlandish as this assumption might be, the opposite (that security holds and most of our stuff never gets hacked) seems even more implausible to me. Educated guess, you know, which speaks less of tech/security than it does of human nature (carelessness or laziness, until a real crash happens). Hopefully this is very Western-centric and other cultures are better at long-term wisdom and planning.
- solotronics 7y ago
  I think this is actually by design. My theory is they built a panopticon intended to move humanity towards being more cooperative and docile. A feature of this is that people become self policing much like in the USSR. You yourself just admitted to what is equivalent to thought policing.
  - mindfulhack 7y ago
    Instead of downvoting, I'll reply with my own logic: 1. Science and clear thinking demonstrates more often than not that the world is chaotic and random. 2. Conspiracy thought like yours can be a psychological attempt to quell one's unease from seeing such chaos by insisting that everything is controlled, so that you gain an emotional feeling of control and security once more. Like 9/11, I think what you speak of (people's increasing self censorship as a result of draconian dragnet surveillance) is more pure accident - not design - but it's then taken advantage of by opportunists (where in the case of 9/11, it was warmongers and American oil barons).
    - solotronics 7y ago
      https://medium.com/insurge-intelligence/how-the-cia-made-google-e836451a959e https://medium.com/insurge-intelligence/how-the-cia-made-goo... Both Facebook and Google were nurtured by In-Q-Tel and Highlands Forum members. I don't think this is wrong or bad. Just like Huawei and ZTE are highly correlated with the Chinese government, our biggest tech companies are interwoven with our national defense organizations.
  - nine_k 7y ago
    Why — store everything you don't want to ever be public (like your private documents allowing for ID theft, medical records, business plans, nudes of yourself, etc) encrypted, and be the only one to know the key. Those are not many. Use SpiderOak, or Tarsnap, or any backup program that does this. Anything you share with others, online or not, has a fair chance to become more widely known; just keep it in mind. This has always been si, afaict.
    - geofft 7y ago
      What's the point of having identity documents, medical records, business plans, or nudes of yourself that you don't share with anyone?
      - tialaramex 7y ago
- pmontra 7y ago
  > I've been operating for a decade now under the assumption that one day within my lifetime, all of our logged online activity may become public after some hack. Unfortunately we can't control which information about ourselves other people exchange in conversations with us or between them. Anything they know about us could be stored and hacked later on, even if we never went online or used a computer or phone.
- tetha 7y ago
  The danger of these kinds of threats is not limited to exposure of personal information, though. For example, take a look at Norsk Hydro. A ransomware situation took down the control systems of an aluminum plant. The company mostly got lucky - they still had senior engineers around who could control the system by pen and paper. Otherwise, you'd have a lot of half-processed slag solidify inside the line. At that point, there's little to do besides ripping all of it out and rebuilding the line in a newfound empty factory building. And at that point, there are two scary areas to research: Industrial control networks which are abused in a wide area scenario. And the industrial ability to recover from these kinds of outages, if rebuilding a factory takes years. And I guess the security practices and budgets in that sector.
- chousuke 7y ago
  I think most people do care about security, they just don't understand it. People will just assume that they're secure instead of actually figuring out the true state of things, and then they'll be surprised when something happens. This kind of "not my problem" mentality is common across everything humans do, and while it can be due to laziness, a lot of it is just ignorance.
joe_the_user 7y ago
"As cynical as I may sound, but cybersecurity threats like this will continue to be ignored until they sufficiently escalate into consequences." I guess an even more cynical take would be that nothing will be done even after extreme consequences become visible. The analogy that occurs to me is war. Every politician theoretically wants to stop war but for the modern state, there is never an end to war and conflict, just rearrangements and strategies based on power and circumstances. IE, they expect war forever and just want to win it. Lack of cyber security seems similar and the plan seems to be to merge them.
- thaumasiotes 7y ago
  > Every politician theoretically wants to stop war What? No they don't.
- PeterisP 7y ago
  The war analogy is not really adequate. War is an extension of diplomacy, a continuation of policy with other means, an instrument that may allow politicians to achieve certain foreign policy goals which they could not otherwise. War is not something that magically happens on it's own, it's started intentionally to achieve certain goals, by a politician who did not want to stop that war but who wanted and chose to start it. Even in the absence of actual conflict, having that option (and others knowing that you have that option) gives you lots of leverage and influence, and unilaterally abandoning that capability gives up that influence and ensures that you'll have to concede things to others who do have that option. And it's not just that unilateral withdrawal doesn't work (si vis pacem, para bellum), but also that a multilateral agreement to end all war and capability for it is not something that all politicians and countries desire - some do, but some countries are militarily more capable than others, and they benefit from that, so it's simply not in their best interest to have a world where war isn't an option and they lose that influence. Case in point - nuclear disarmament; the powers that do have nuclear weapons have a strategic advantage over those that don't, and they would not be willing to give that up to have a world with no nuclear weapons even if it would be possible to have a working multilateral agreement between all of the nuclear powers.
  - 7y ago
tjpnz 7y ago
Government has a role to play here. How about fining corporations for cyber security f-ups? I live in Japan which doesn't have much to teach the world in terms of good governance. But if a Japanese company leaks PII the government already has legislation in place to impose heavy fines and even halt trading for a period of time. Makes for sober reading during company orientation.

by tetha 7y ago

deleted 7y ago

[deleted]

K0SM0S 7y ago

Let me share this thought experiment. - most companies are really bad at security - most people do not care about the security of their data, passwords, etc. Based on these facts, I've been operating for a decade now under the assumption that one day within my lifetime, all of our logged online activity may become public after some hack. All of it that's logged somewhere. Chats, pics, posts, history, notes, cloud drives... It may be slightly paranoid, but better safe than sorry. I should add that I live "normally", I don't care about my pics or discussions becoming public when it happens to everyone else too. I just remain cognizant that there's high probability here. As outlandish as this assumption might be, the opposite (that security holds and most of our stuff never gets hacked) seems even more implausible to me. Educated guess, you know, which speaks less of tech/security than it does of human nature (carelessness or laziness, until a real crash happens). Hopefully this is very Western-centric and other cultures are better at long-term wisdom and planning.

solotronics 7y ago
I think this is actually by design. My theory is they built a panopticon intended to move humanity towards being more cooperative and docile. A feature of this is that people become self policing much like in the USSR. You yourself just admitted to what is equivalent to thought policing.
- mindfulhack 7y ago
  Instead of downvoting, I'll reply with my own logic: 1. Science and clear thinking demonstrates more often than not that the world is chaotic and random. 2. Conspiracy thought like yours can be a psychological attempt to quell one's unease from seeing such chaos by insisting that everything is controlled, so that you gain an emotional feeling of control and security once more. Like 9/11, I think what you speak of (people's increasing self censorship as a result of draconian dragnet surveillance) is more pure accident - not design - but it's then taken advantage of by opportunists (where in the case of 9/11, it was warmongers and American oil barons).
  - solotronics 7y ago
    https://medium.com/insurge-intelligence/how-the-cia-made-google-e836451a959e https://medium.com/insurge-intelligence/how-the-cia-made-goo... Both Facebook and Google were nurtured by In-Q-Tel and Highlands Forum members. I don't think this is wrong or bad. Just like Huawei and ZTE are highly correlated with the Chinese government, our biggest tech companies are interwoven with our national defense organizations.
- nine_k 7y ago
  Why — store everything you don't want to ever be public (like your private documents allowing for ID theft, medical records, business plans, nudes of yourself, etc) encrypted, and be the only one to know the key. Those are not many. Use SpiderOak, or Tarsnap, or any backup program that does this. Anything you share with others, online or not, has a fair chance to become more widely known; just keep it in mind. This has always been si, afaict.
  - geofft 7y ago
    What's the point of having identity documents, medical records, business plans, or nudes of yourself that you don't share with anyone?
    - tialaramex 7y ago
pmontra 7y ago
> I've been operating for a decade now under the assumption that one day within my lifetime, all of our logged online activity may become public after some hack. Unfortunately we can't control which information about ourselves other people exchange in conversations with us or between them. Anything they know about us could be stored and hacked later on, even if we never went online or used a computer or phone.
tetha 7y ago
The danger of these kinds of threats is not limited to exposure of personal information, though. For example, take a look at Norsk Hydro. A ransomware situation took down the control systems of an aluminum plant. The company mostly got lucky - they still had senior engineers around who could control the system by pen and paper. Otherwise, you'd have a lot of half-processed slag solidify inside the line. At that point, there's little to do besides ripping all of it out and rebuilding the line in a newfound empty factory building. And at that point, there are two scary areas to research: Industrial control networks which are abused in a wide area scenario. And the industrial ability to recover from these kinds of outages, if rebuilding a factory takes years. And I guess the security practices and budgets in that sector.
chousuke 7y ago
I think most people do care about security, they just don't understand it. People will just assume that they're secure instead of actually figuring out the true state of things, and then they'll be surprised when something happens. This kind of "not my problem" mentality is common across everything humans do, and while it can be due to laziness, a lot of it is just ignorance.

joe_the_user 7y ago

"As cynical as I may sound, but cybersecurity threats like this will continue to be ignored until they sufficiently escalate into consequences." I guess an even more cynical take would be that nothing will be done even after extreme consequences become visible. The analogy that occurs to me is war. Every politician theoretically wants to stop war but for the modern state, there is never an end to war and conflict, just rearrangements and strategies based on power and circumstances. IE, they expect war forever and just want to win it. Lack of cyber security seems similar and the plan seems to be to merge them.

thaumasiotes 7y ago
> Every politician theoretically wants to stop war What? No they don't.
PeterisP 7y ago
The war analogy is not really adequate. War is an extension of diplomacy, a continuation of policy with other means, an instrument that may allow politicians to achieve certain foreign policy goals which they could not otherwise. War is not something that magically happens on it's own, it's started intentionally to achieve certain goals, by a politician who did not want to stop that war but who wanted and chose to start it. Even in the absence of actual conflict, having that option (and others knowing that you have that option) gives you lots of leverage and influence, and unilaterally abandoning that capability gives up that influence and ensures that you'll have to concede things to others who do have that option. And it's not just that unilateral withdrawal doesn't work (si vis pacem, para bellum), but also that a multilateral agreement to end all war and capability for it is not something that all politicians and countries desire - some do, but some countries are militarily more capable than others, and they benefit from that, so it's simply not in their best interest to have a world where war isn't an option and they lose that influence. Case in point - nuclear disarmament; the powers that do have nuclear weapons have a strategic advantage over those that don't, and they would not be willing to give that up to have a world with no nuclear weapons even if it would be possible to have a working multilateral agreement between all of the nuclear powers.
- 7y ago

tjpnz 7y ago

Government has a role to play here. How about fining corporations for cyber security f-ups? I live in Japan which doesn't have much to teach the world in terms of good governance. But if a Japanese company leaks PII the government already has legislation in place to impose heavy fines and even halt trading for a period of time. Makes for sober reading during company orientation.