5 ms·

> But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability. If I leave my gr

by orf 6y ago

> But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability. If I leave my ground floor window open with cash sitting just inside and someone reaches in and steals it, that's my fault. It's dishonest to suggest that dishonest actors don't exist or are anything other than a fact of life/force of human nature. As such they don't bear much discussion - I left the window open. That's on me.

zo1 6y ago
You blame yourself, sure. "It's on you". But the other person committed a crime, and that's separate to your view on the matter.
- FeepingCreature 6y ago
  The fact that the attacker committed a crime and carries sole blame does not absolve you from your responsibility to secure your belongings.
- heavenlyblue 6y ago
  Not every crime means businesses are not liable for the results of their negligence. If the business does not provide the reasonable means for dealing with fraud it’s their responsibility in front of the law for the result of given fraud.
Juliate 6y ago
No. That was not thoughtful of you given the threat model. But the fault is always, _always_ on the one who commits the crime. Claiming the contrary is exactly victim blaming.
- AnimalMuppet 6y ago
  The moral fault is always on the perpetrator. Always. But in a world that contains muggers, and that you know contains muggers, walking around the bad part of town with cash visibly hanging out of your pocket is not very wise. It's not a moral failure, but it is a failure of common sense and reasonable prudence.
  - Juliate 6y ago
    We're saying exactly the same thing, but well...
- orf 6y ago
  _always_ finding fault with the one who commits the crime is as pointless as finding fault with a hurricane for destroying your property, or the sea for drowning you without an oxygen tank. In the case of murder, sure. But I'm with you. But bad actors (in the form of petty theft, exploitation, confidence tricks, etc) are a fact of life. Failing to account for them, just as failing to account for hurricanes if you live in hurricane alley, is completely on you. You can reduce that down to a blanket "but you're just victim shaming!" if you'd like, but it doesn't make it any less true.
buran77 6y ago
Not all exploits are due to negligence or at least not crass negligence. Sure, something may have been forgotten (although the present article says nothing about this), systems are complex and as the "defender" you only have to make one mistake. But your "it's on me" is very much victim blaming unless you can show a pattern of intentional ignorance or malfeasance within a network. I can get in your house even if you close the window. It's a window and can be opened. Are you still to blame? I can look for money even if you hide them, I'll search around. Are you still to blame? You could have taken the precaution of not having money in the house or at least not living on the ground floor if you do. Many attacks are 0day, many others are supply chain attacks, many exploit the weakest of links, the human. There's a limit to how much you can protect yourself from one attack in an instant before you cause yourself harm slowly but continuously. No matter how many locks you put you're not guaranteeing anything. It's a calculated risk and sometimes the calculation doesn't pay off.

by orf 6y ago

zo1 6y ago

You blame yourself, sure. "It's on you". But the other person committed a crime, and that's separate to your view on the matter.

FeepingCreature 6y ago
The fact that the attacker committed a crime and carries sole blame does not absolve you from your responsibility to secure your belongings.
heavenlyblue 6y ago
Not every crime means businesses are not liable for the results of their negligence. If the business does not provide the reasonable means for dealing with fraud it’s their responsibility in front of the law for the result of given fraud.

Juliate 6y ago

No. That was not thoughtful of you given the threat model. But the fault is always, _always_ on the one who commits the crime. Claiming the contrary is exactly victim blaming.

AnimalMuppet 6y ago
The moral fault is always on the perpetrator. Always. But in a world that contains muggers, and that you know contains muggers, walking around the bad part of town with cash visibly hanging out of your pocket is not very wise. It's not a moral failure, but it is a failure of common sense and reasonable prudence.
- Juliate 6y ago
  We're saying exactly the same thing, but well...
orf 6y ago
_always_ finding fault with the one who commits the crime is as pointless as finding fault with a hurricane for destroying your property, or the sea for drowning you without an oxygen tank. In the case of murder, sure. But I'm with you. But bad actors (in the form of petty theft, exploitation, confidence tricks, etc) are a fact of life. Failing to account for them, just as failing to account for hurricanes if you live in hurricane alley, is completely on you. You can reduce that down to a blanket "but you're just victim shaming!" if you'd like, but it doesn't make it any less true.

buran77 6y ago

Not all exploits are due to negligence or at least not crass negligence. Sure, something may have been forgotten (although the present article says nothing about this), systems are complex and as the "defender" you only have to make one mistake. But your "it's on me" is very much victim blaming unless you can show a pattern of intentional ignorance or malfeasance within a network. I can get in your house even if you close the window. It's a window and can be opened. Are you still to blame? I can look for money even if you hide them, I'll search around. Are you still to blame? You could have taken the precaution of not having money in the house or at least not living on the ground floor if you do. Many attacks are 0day, many others are supply chain attacks, many exploit the weakest of links, the human. There's a limit to how much you can protect yourself from one attack in an instant before you cause yourself harm slowly but continuously. No matter how many locks you put you're not guaranteeing anything. It's a calculated risk and sometimes the calculation doesn't pay off.