3 ms·
> You obviously don't have much experience with security and you make a lot of assumptions here. You obviously work in security and want to sell me bs. > Firs
by majkinetor 6y ago
> You obviously don't have much experience with security and you make a lot of assumptions here.
You obviously work in security and want to sell me bs.
> First of all, you seem to make the assumption that when an organization gets compromised, they will know about it.
No, you assume a lot about me while knowing 0. The bigger problem here is that you assume that people in corp care that there are hidden agents taking some data out. Let me open your eyes: they usually don't and ESPECIALLY if its not visible. If you replace their main site front page they will care.
> What valuables does your organization have?
Dude... go read my post again.
> Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free?
I don't care. Its up to my stakeholders, I don't work for my granpas company. WHEN they care, I do it. Mine is to inform. Theirs to decide. Guess what: they always decide against it, naturally, as it costs more otherwise. Security is a feature. It costs money. It can be theoretically done forever and take infinite amount of money. In last decade I had just 1 stakeholder requesting "unbreakable system" and we did the best we could.
Your main mistake seems to be to extrapolate your context to entire world. Context is everything.
- gypsyharlot 6y ago"> Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? I don't care. Its up to my stakeholders, I don't work for my granpas company." Enough said.
- majkinetor 6y agoThe other name for what I tell is professionalism. The other name for what you tell is racketeering. What part of "educating stakeholder and let them decide" you didn't understand ?
- gypsyharlot 6y ago"majority of tools don't need any updates if they already work as designed" This is just about the dumbest thing I've read on HN. It's fascinating that you think of yourself as professional. Like I said, most organizations have no clue what's actually happening in their networks - mostly due to people like you. Have fun when the digital forensics team is dispatched to one of your sites that has had all its data lost to some crypto virus (because when that happens, they notice). And the forensics guys will write a report which outlines the reason why it happened. And the reason is nearly always outdated software.
- jcelerier 6y ago> Like I said, most organizations have no clue what's actually happening in their networks you act like most software is on the network. But a majority of the software I use either for my work or for my leasure time don't even open a socket.
- Mediterraneo10 6y agoLots more software today is on the network than many people think. Even if network access is not required for an application’s functionality, the software may still do an update check to a remote server so that it can alert users to a new update available.
- Silhouette 6y agoBut we're talking about software that we are writing. If we have any dependencies that are connecting to the network without us knowing about it, we have a serious problem already!
- Mediterraneo10 6y agoI was responding to the grandparent post’s statement "A majority of the software I use either for my work or for my leasure time don't even open a socket".
- jcelerier 6y ago> the software may still do an update check to a remote server so that it can alert users to a new update available. most of my day-to-day software is linux distro software which definitely does not do that except a few rare exceptions.