8 ms·

Book Review: "This Is How They Tell Me the World Ends"

78 points by wglb 6y ago

nielsbot 6y ago
It's sort of driving me crazy that "Add" isn't capitalized like the other ops: "ADD"
- edflsafoiewq 6y ago
  HN's title mangler strikes again?
  - nielsbot 6y ago
    HN has one of those?
goatinaboat 6y ago
I've started it and a few pages in I would largely agree with this review, it's very America-centric. You have to simultaneously believe that the NSA are the best in the world, and that foreign hackers despite being nowhere near as smart managed to steal all their hacking tools, and it's lucky for them that they did otherwise they would have no chance against the NSA because they are the BEST! USA! USA! If it doesn't get better than that pretty quickly I'm unlikely to finish it.
- ConnorLeet 6y ago
  Wasn't the NSA tool leak due to an ex-NSA contractor intentionally leaking it?
  - goatinaboat 6y ago
    Wasn't the NSA tool leak due to an ex-NSA contractor intentionally leaking it? No one knows who the Shadow Brokers are, unless that’s covered later in the book.
    - IggleSniggle 6y ago
      No one knows! I thought this was a compelling theory that I haven't seen mentioned elsewhere: https://threadreaderapp.com/thread/1224880979258441729.html https://threadreaderapp.com/thread/1224880979258441729.html
- tptacek 6y ago
  I listened to a discussion with Perlroth on a podcast where she said things that implied strongly that exploits, in general, writ large, were leaked NSA tradecraft. I don't have even 1/5th the skin in this game Halvar does, and I found it offensive enough to yell out loud in my car, just at the implication. In reality I think it's kind of an embarrassment how much CNE technology goes the other way, from industry and research to the IC. Not for moral reasons (though: I would have ethical problems selling bugs to attackers of any sort and am thankful I don't produce the kinds of bugs that have this market) so much as "it's not that hard to do this work and we should be getting more for our tax dollars".
- ForHackernews 6y ago
  I don't know if the NSA are the best in the world, but they're probably among the best-funded in the world. Stuxnet is close to a work of art; the degree of effort involved in hiding self-reinstalling malware inside hard-drive firmware is staggering.[0] Anyone who's ever tried to write Linux drivers for undocumented hardware can appreciate how insane it is that they managed to do it for a dozen different hard drive manufacturers. [0] https://www.theverge.com/2015/2/16/8048243/nsa-hard-drive-firmware-virus-stuxnet https://www.theverge.com/2015/2/16/8048243/nsa-hard-drive-fi...
  - secfirstmd 6y ago
    Let's not forget. Stuxnet is 15ish years old also.
  - moyix 6y ago
    Keep in mind that a motivated academic research team was able to write a hard drive firmware implant on their own as well: https://www.impeachdonaldtrump.net/Implementation.and.Implications.of.a.Stealth.Hard-Drive.Backdoor.pdf https://www.impeachdonaldtrump.net/Implementation.and.Implic... But yes, making it work for a bunch of manufacturers would be a lot of additional work (though easier if you can obtain the data sheets for the embedded microcontroller, which is probably doable if you're the NSA). Side note: don't blame me for the URL, it was just the first place I found that had a PDF of the paper.
- cambalache 6y ago
  Americans are quite insular so not really knowledgeable about the "outside" world. Maybe because the country is so big and important, maybe because arrogance or intellectual laziness. I would never forget this fragment from a class on El Quijote at Yale. "So what is spoken in the Bronx, Mexico City and Madrid? Castilian, which is Spanish, is what’s spoken, it’s spoken in those places. So you can erase that American prejudice from your mind if you ever had it. It is true — I mean, I had a colleague at Cornell, a very distinguished American medievalist who would ask me, “In what language do you write your scholarship, Roberto?” I said, “What do you mean? In English and Spanish.” He was worried that if I didn’t write in English being in Latin America, I didn’t have a language of culture in which I could write, because he didn’t think that in Latin America we had a language of culture. It is an American prejudice." https://oyc.yale.edu/spanish-and-portuguese/span-300/lecture-1 https://oyc.yale.edu/spanish-and-portuguese/span-300/lecture...
- no-dr-onboard 6y ago
  My organization was part of the author's book tour, we had a webinar with her earlier this year as she provided the book to the entire company. A couple of takeaways: - Author believes (or is at least attempting to make others believe that she believes) that the NSA is benevolent and not committed to any specific domestic program - Author frequently stated that 0-day purchasing platforms should not exist as it is a matter of opaque moral policy. - Author frequently states that contractors like Immunity are problematic because they sell tradecraft to "bad nations" for profit. - Worth noting that the author is also a NYT contributor and clings to a lot of those same notions. The overall sentiment of the author after her webinar was that she was egotistically confined to believing in US supremacy and very much in the midst of an ideological war against competing beliefs. Probably not going to get far in her book either in light of that webinar.
jackpirate 6y ago
Does anyone here have a recommendation on an actually good book about cybersecurity policy? My sense is that all existing books are trash.
- WrtCdEvrydy 6y ago
  I kinda like the Bruce Scheiner books but they're mostly examples of security failures.
- 1MachineElf 6y ago
  This might be a cliché answer, but the (ISC)2 CISSP CBK Reference. Among cybersecurity certifications, the CISSP is notable for it's focus on cybersecurity policy laws & implementation frameworks.
- SCHiM 6y ago
  I like Network Attacks and Exploitation: A Framework by Matthew Monte. It makes a clear and comprehensible case about the various asymmetries in cybersecurity and gives a detailed overview of failed past strategies, and strategies currently being tried.
- jkonline 6y ago
  > policy (Government, Politics & Diplomacy) a plan of action adopted or pursued by an individual, government, party, business, etc [1] Are you genuinely interested in a book on policy? (If not, I might have some recommendations, depending on what you're interested in). If so, you might need to adjust your expectation bar toward the lower spectrum. I honestly can't imagine a book about policy that isn't trash, but maybe that's just me. [1]: freedictionary.com
- jmuguy 6y ago
  Not exactly what you asked for but I always recommend The Cuckoo's Egg by Cliff Stoll whenever hacking comes up. And he deals with the early days of computer networks when there basically was no cybersecurity, policy or otherwise.
Animats 6y ago
"This Is How They Tell Me the World Ends" tackles an important question: What causes the vulnerability of our modern world to "cyberattacks"? What causes that vulnerability? Lack of liability for software vendors. If Microsoft had to pay the costs of vulnerabilities, we'd have far more secure systems. There's one area of the industry where companies are held financially responsible for their mistakes - gambling systems. A few percent of revenue goes to paying for mistakes. For GTech, before they were acquired by a non-US company, you could see the numbers in their annual report. It's not a killer.
- tptacek 6y ago
  Since nobody knows how to reliably ship secure commercial software, liability will mostly have the effect of making it difficult to start new software businesses. Liability would make more sense to me if we could converge on a common understanding of a secure development process, but working on that has taken up most of my career and I don't think it's even on the horizon. The industry is still debating memory safety.
  - devonkim 6y ago
    We have things like cybersecurity insurance that's required to be carried for vendors when working with the government, but much greater investment in both private and public sectors into secure coding and operational practices (namely by making commonly insecure things much more secure) would be helpful to at least some trends away from the current dominant mentality of "ship it first, ship it fast" dominating the software business. I don't think it makes much sense for a random one-off script written by some lone developer starting a company to be subjected to all the alphabet soup of regulation, but I don't think letting everyone get away with security breaches forever is a good idea nor is just throwing up our hands and going "oh well, we're going to keep getting break-ins" for another 50 years.
  - ampdepolymerase 6y ago
    Galois, if you are listening, there is a billion dollar opportunity for building a provably secure SAP/Salesforce.
benibela 6y ago
Reminds me of the Demon/Freedom novels. The world is ended by zero days, but that is a good thing
- KirillPanov 6y ago
  autonomous motorcycles with permanently-blinding laser weapons = not a good thing
- goatinaboat 6y ago
  I think it was Ken Mcleod did a sci-fi novel where the only software to survive an infocalypse was the firmware in the Kalashnikov rifles of the day

78 points by wglb 6y ago

nielsbot 6y ago

It's sort of driving me crazy that "Add" isn't capitalized like the other ops: "ADD"

edflsafoiewq 6y ago
HN's title mangler strikes again?
- nielsbot 6y ago
  HN has one of those?

goatinaboat 6y ago

I've started it and a few pages in I would largely agree with this review, it's very America-centric. You have to simultaneously believe that the NSA are the best in the world, and that foreign hackers despite being nowhere near as smart managed to steal all their hacking tools, and it's lucky for them that they did otherwise they would have no chance against the NSA because they are the BEST! USA! USA! If it doesn't get better than that pretty quickly I'm unlikely to finish it.

ConnorLeet 6y ago
Wasn't the NSA tool leak due to an ex-NSA contractor intentionally leaking it?
- goatinaboat 6y ago
  Wasn't the NSA tool leak due to an ex-NSA contractor intentionally leaking it? No one knows who the Shadow Brokers are, unless that’s covered later in the book.
  - IggleSniggle 6y ago
    No one knows! I thought this was a compelling theory that I haven't seen mentioned elsewhere: https://threadreaderapp.com/thread/1224880979258441729.html https://threadreaderapp.com/thread/1224880979258441729.html
tptacek 6y ago
I listened to a discussion with Perlroth on a podcast where she said things that implied strongly that exploits, in general, writ large, were leaked NSA tradecraft. I don't have even 1/5th the skin in this game Halvar does, and I found it offensive enough to yell out loud in my car, just at the implication. In reality I think it's kind of an embarrassment how much CNE technology goes the other way, from industry and research to the IC. Not for moral reasons (though: I would have ethical problems selling bugs to attackers of any sort and am thankful I don't produce the kinds of bugs that have this market) so much as "it's not that hard to do this work and we should be getting more for our tax dollars".
ForHackernews 6y ago
I don't know if the NSA are the best in the world, but they're probably among the best-funded in the world. Stuxnet is close to a work of art; the degree of effort involved in hiding self-reinstalling malware inside hard-drive firmware is staggering.[0] Anyone who's ever tried to write Linux drivers for undocumented hardware can appreciate how insane it is that they managed to do it for a dozen different hard drive manufacturers. [0] https://www.theverge.com/2015/2/16/8048243/nsa-hard-drive-firmware-virus-stuxnet https://www.theverge.com/2015/2/16/8048243/nsa-hard-drive-fi...
- secfirstmd 6y ago
  Let's not forget. Stuxnet is 15ish years old also.
- moyix 6y ago
  Keep in mind that a motivated academic research team was able to write a hard drive firmware implant on their own as well: https://www.impeachdonaldtrump.net/Implementation.and.Implications.of.a.Stealth.Hard-Drive.Backdoor.pdf https://www.impeachdonaldtrump.net/Implementation.and.Implic... But yes, making it work for a bunch of manufacturers would be a lot of additional work (though easier if you can obtain the data sheets for the embedded microcontroller, which is probably doable if you're the NSA). Side note: don't blame me for the URL, it was just the first place I found that had a PDF of the paper.
cambalache 6y ago
Americans are quite insular so not really knowledgeable about the "outside" world. Maybe because the country is so big and important, maybe because arrogance or intellectual laziness. I would never forget this fragment from a class on El Quijote at Yale. "So what is spoken in the Bronx, Mexico City and Madrid? Castilian, which is Spanish, is what’s spoken, it’s spoken in those places. So you can erase that American prejudice from your mind if you ever had it. It is true — I mean, I had a colleague at Cornell, a very distinguished American medievalist who would ask me, “In what language do you write your scholarship, Roberto?” I said, “What do you mean? In English and Spanish.” He was worried that if I didn’t write in English being in Latin America, I didn’t have a language of culture in which I could write, because he didn’t think that in Latin America we had a language of culture. It is an American prejudice." https://oyc.yale.edu/spanish-and-portuguese/span-300/lecture-1 https://oyc.yale.edu/spanish-and-portuguese/span-300/lecture...
no-dr-onboard 6y ago
My organization was part of the author's book tour, we had a webinar with her earlier this year as she provided the book to the entire company. A couple of takeaways: - Author believes (or is at least attempting to make others believe that she believes) that the NSA is benevolent and not committed to any specific domestic program - Author frequently stated that 0-day purchasing platforms should not exist as it is a matter of opaque moral policy. - Author frequently states that contractors like Immunity are problematic because they sell tradecraft to "bad nations" for profit. - Worth noting that the author is also a NYT contributor and clings to a lot of those same notions. The overall sentiment of the author after her webinar was that she was egotistically confined to believing in US supremacy and very much in the midst of an ideological war against competing beliefs. Probably not going to get far in her book either in light of that webinar.

jackpirate 6y ago

Does anyone here have a recommendation on an actually good book about cybersecurity policy? My sense is that all existing books are trash.

WrtCdEvrydy 6y ago
I kinda like the Bruce Scheiner books but they're mostly examples of security failures.
1MachineElf 6y ago
This might be a cliché answer, but the (ISC)2 CISSP CBK Reference. Among cybersecurity certifications, the CISSP is notable for it's focus on cybersecurity policy laws & implementation frameworks.
SCHiM 6y ago
I like Network Attacks and Exploitation: A Framework by Matthew Monte. It makes a clear and comprehensible case about the various asymmetries in cybersecurity and gives a detailed overview of failed past strategies, and strategies currently being tried.
jkonline 6y ago
> policy (Government, Politics & Diplomacy) a plan of action adopted or pursued by an individual, government, party, business, etc [1] Are you genuinely interested in a book on policy? (If not, I might have some recommendations, depending on what you're interested in). If so, you might need to adjust your expectation bar toward the lower spectrum. I honestly can't imagine a book about policy that isn't trash, but maybe that's just me. [1]: freedictionary.com
jmuguy 6y ago
Not exactly what you asked for but I always recommend The Cuckoo's Egg by Cliff Stoll whenever hacking comes up. And he deals with the early days of computer networks when there basically was no cybersecurity, policy or otherwise.

Animats 6y ago

"This Is How They Tell Me the World Ends" tackles an important question: What causes the vulnerability of our modern world to "cyberattacks"? What causes that vulnerability? Lack of liability for software vendors. If Microsoft had to pay the costs of vulnerabilities, we'd have far more secure systems. There's one area of the industry where companies are held financially responsible for their mistakes - gambling systems. A few percent of revenue goes to paying for mistakes. For GTech, before they were acquired by a non-US company, you could see the numbers in their annual report. It's not a killer.

tptacek 6y ago
Since nobody knows how to reliably ship secure commercial software, liability will mostly have the effect of making it difficult to start new software businesses. Liability would make more sense to me if we could converge on a common understanding of a secure development process, but working on that has taken up most of my career and I don't think it's even on the horizon. The industry is still debating memory safety.
- devonkim 6y ago
  We have things like cybersecurity insurance that's required to be carried for vendors when working with the government, but much greater investment in both private and public sectors into secure coding and operational practices (namely by making commonly insecure things much more secure) would be helpful to at least some trends away from the current dominant mentality of "ship it first, ship it fast" dominating the software business. I don't think it makes much sense for a random one-off script written by some lone developer starting a company to be subjected to all the alphabet soup of regulation, but I don't think letting everyone get away with security breaches forever is a good idea nor is just throwing up our hands and going "oh well, we're going to keep getting break-ins" for another 50 years.
- ampdepolymerase 6y ago
  Galois, if you are listening, there is a billion dollar opportunity for building a provably secure SAP/Salesforce.

benibela 6y ago

Reminds me of the Demon/Freedom novels. The world is ended by zero days, but that is a good thing

KirillPanov 6y ago
autonomous motorcycles with permanently-blinding laser weapons = not a good thing
goatinaboat 6y ago
I think it was Ken Mcleod did a sci-fi novel where the only software to survive an infocalypse was the firmware in the Kalashnikov rifles of the day