3 ms·

Nobody said that they were equivalent, just that there are multiple guilty parties. Not guilty of the same thing, but guilty nonetheless. It's not victim blami

Nobody said that they were equivalent, just that there are multiple guilty parties. Not guilty of the same thing, but guilty nonetheless. It's not victim blaming because the victims are the patients. The people who were in charge of securing the records and left the creds as root:root are not victims.

TeaDrunk 6y ago
IMO we are using the language of someone who we know to act maliciously on a massive scale (tens of thousands of people, including minors)as if their words can mean anything without corroboration. Frankly I wouldn't believe a rapist saying "but look at what they were wearing" or a serial killer for saying "but they went home alone". Similarly, I don't hold any credence to a black hat saying "but look at how insecure they were".
- deleted 6y ago
  [deleted]
- fastball 6y ago
  Again, nobody is blaming the victims. People hired to secure records that then do an exceedingly poor job are not the victims in this situation. Victims == patients. In your analogies of rape/murder, the (almost) equivalent would be if there was a doorman at an apartment building who was supposed to verify the identity of everyone entering the building, but failed to do so, letting the unauthorized perpetrator into the building and thus allowing the victim to be raped/murdered. It was literally his job to prevent such a situation, and he failed. You maintain that he has no responsibility in this matter?
  - TeaDrunk 6y ago
    I'm just saying why assume a malicious actor is saying any truth about the circumstances of their malice?
    - fastball 6y ago
      I agree, but the comment I was responding to was operating under the assumption that the claim was true and was making a different point than merely "don't accept things hackers say at face value". Probably because the OC had already hedged: > if true, I see two quilty parties here.
      - TeaDrunk 6y ago
        Yes, and my response is "I don't see why we need to give it any credence whatsoever enough to comment on it".
  - deleted 6y ago
    [deleted]
hn_throwaway_99 6y ago
> The people who were in charge of securing the records and left the creds as root:root are not victims. We have to stop designing systems where if one administrative task is mistakenly skipped, the result is catastrophic. Imagine if when you tried to start your car that if you didn't have the brake fully pressed that your car blew up. Would you say "Oh, wow, how irresponsible it is to not fully press the brake"? No, you'd blame the manufacturer for building an exploding car. Systems should not start if strong admin credentials are not the first thing that are set up.
- fastball 6y ago
  I agree that better design is imperative. However that is not the situation we are in currently. If you are hired to secure a system and leave the credentials as root:root, you are derelict in your duty. Period. If there is a system with external access, someone set it up. It is the responsibility of whoever setup that system to ensure access controls are in place. The barest minimum of that is to change the default creds to something unguessable.
- spurgu 6y ago
  It's more like the car left the factory with the blow-up function still enabled. The equivalent of whomever left the root:root in place.
- Memosyne 6y ago
  > No, you'd blame the manufacturer for building an exploding car. A better analogy would be accidentally crashing the vehicle - an action resulting from negligence or incompetence rather than some 1/1000000 chance of your car exploding due to a failure in functional safety. If someone is operating a vehicle in a manner that it was not intended to be used should we blame the manufacturer? You expect litigation to follow someone forgetting their keys, driving their car into a lake, or running out of gas on a busy freeway? The solution should be to mandate more certifications and security audits for high-risk organizations. The safety mechanisms should be legal and not technical; you shouldn't be permitted to operate a business dealing with sensitive data if you haven't been audited. Delegating more responsibility to the system architects doesn't solve the fact that you have incompetent people performing the administrative tasks and malicious actors abusing this incompetence. It isn't about someone making a mistake, it's about someone being irresponsible in a security sensitive environment - something that should carry severe legal repercussions.

TeaDrunk 6y ago

IMO we are using the language of someone who we know to act maliciously on a massive scale (tens of thousands of people, including minors)as if their words can mean anything without corroboration. Frankly I wouldn't believe a rapist saying "but look at what they were wearing" or a serial killer for saying "but they went home alone". Similarly, I don't hold any credence to a black hat saying "but look at how insecure they were".

deleted 6y ago
[deleted]
fastball 6y ago
Again, nobody is blaming the victims. People hired to secure records that then do an exceedingly poor job are not the victims in this situation. Victims == patients. In your analogies of rape/murder, the (almost) equivalent would be if there was a doorman at an apartment building who was supposed to verify the identity of everyone entering the building, but failed to do so, letting the unauthorized perpetrator into the building and thus allowing the victim to be raped/murdered. It was literally his job to prevent such a situation, and he failed. You maintain that he has no responsibility in this matter?
- TeaDrunk 6y ago
  I'm just saying why assume a malicious actor is saying any truth about the circumstances of their malice?
  - fastball 6y ago
    I agree, but the comment I was responding to was operating under the assumption that the claim was true and was making a different point than merely "don't accept things hackers say at face value". Probably because the OC had already hedged: > if true, I see two quilty parties here.
    - TeaDrunk 6y ago
      Yes, and my response is "I don't see why we need to give it any credence whatsoever enough to comment on it".
- deleted 6y ago
  [deleted]

hn_throwaway_99 6y ago

> The people who were in charge of securing the records and left the creds as root:root are not victims. We have to stop designing systems where if one administrative task is mistakenly skipped, the result is catastrophic. Imagine if when you tried to start your car that if you didn't have the brake fully pressed that your car blew up. Would you say "Oh, wow, how irresponsible it is to not fully press the brake"? No, you'd blame the manufacturer for building an exploding car. Systems should not start if strong admin credentials are not the first thing that are set up.

fastball 6y ago
I agree that better design is imperative. However that is not the situation we are in currently. If you are hired to secure a system and leave the credentials as root:root, you are derelict in your duty. Period. If there is a system with external access, someone set it up. It is the responsibility of whoever setup that system to ensure access controls are in place. The barest minimum of that is to change the default creds to something unguessable.
spurgu 6y ago
It's more like the car left the factory with the blow-up function still enabled. The equivalent of whomever left the root:root in place.
Memosyne 6y ago
> No, you'd blame the manufacturer for building an exploding car. A better analogy would be accidentally crashing the vehicle - an action resulting from negligence or incompetence rather than some 1/1000000 chance of your car exploding due to a failure in functional safety. If someone is operating a vehicle in a manner that it was not intended to be used should we blame the manufacturer? You expect litigation to follow someone forgetting their keys, driving their car into a lake, or running out of gas on a busy freeway? The solution should be to mandate more certifications and security audits for high-risk organizations. The safety mechanisms should be legal and not technical; you shouldn't be permitted to operate a business dealing with sensitive data if you haven't been audited. Delegating more responsibility to the system architects doesn't solve the fact that you have incompetent people performing the administrative tasks and malicious actors abusing this incompetence. It isn't about someone making a mistake, it's about someone being irresponsible in a security sensitive environment - something that should carry severe legal repercussions.