4 ms·

I don't think that it is a solvable problem if the economics stay the same. SolarWinds is actually trading almost $2/share more than it did 1 year ago today ($

by genmud 6y ago

I don't think that it is a solvable problem if the economics stay the same. SolarWinds is actually trading almost $2/share more than it did 1 year ago today ($15.67 v $17.23). Sure, it is down from its 52 week high ($24.34). I would argue that SolarWinds should not be allowed to be in business in its current form, considering what a threat they have been to themselves and others in their mis-handling their software practices and subsequent breach. If an individual did what they did as an employee of the government, they would currently be in jail. It is probably one of the most impactful national security events in our lifetimes and the impact of this event will be felt in certain areas for years or even decades.

Quarrelsome 6y ago
I feel like we have to regulate this at a governmental level to get anywhere. We keep automating more and more of our society and its clear we're unable to protect it but the casuals don't get that and keep charging ahead and we enable them. The amount of power we gift to a given attacker seems to just grow and grow. But how do we achieve political intervention when technologists and politics appear to be completely incompatible? The closest I've seen is the Pirate Party which never get more than a few percent or that democratic candidate (Yang was it?) and he was pretty fucking clueless on the tech when poked with any significant vigour.
- genmud 6y ago
  It is certainly a difficult problem and as such, like most difficult problems, it will likely not be fixed in any meaningful manner. We will likely be talking about this exact issue in 5 years, 10 years, and 20 years from now. Cyberspace Solarium Commission [1] created a robust and well documented roadmap for the Biden transition team to address some of these fundamental problems. IMHO, it is one of the better policy documents and has a number of really good recommendations that I believe would be extremely helpful. The #1 thing I think we could do is address accountability, who is responsible for the security of devices/software and what legal recourse should people have if the vendor doesn't adequately secure or support their products. I think that there are a bunch of issues and one of the biggest ones is that what we say vs what we do are 2 different things. We also have issues where many of the core business practices that are commonly accepted are incompatible with building a secure and resilient infrastructure. [1] https://www.solarium.gov/public-communications/transition-book https://www.solarium.gov/public-communications/transition-bo...
- 2OEH8eoCRo0 6y ago
  You don't need to be technical to pass laws for this stuff. Technology doesn't change the fact that underneath it's always greed/negligence/etc. These are things that have existed forever.

by genmud 6y ago

Quarrelsome 6y ago

I feel like we have to regulate this at a governmental level to get anywhere. We keep automating more and more of our society and its clear we're unable to protect it but the casuals don't get that and keep charging ahead and we enable them. The amount of power we gift to a given attacker seems to just grow and grow. But how do we achieve political intervention when technologists and politics appear to be completely incompatible? The closest I've seen is the Pirate Party which never get more than a few percent or that democratic candidate (Yang was it?) and he was pretty fucking clueless on the tech when poked with any significant vigour.

genmud 6y ago
It is certainly a difficult problem and as such, like most difficult problems, it will likely not be fixed in any meaningful manner. We will likely be talking about this exact issue in 5 years, 10 years, and 20 years from now. Cyberspace Solarium Commission [1] created a robust and well documented roadmap for the Biden transition team to address some of these fundamental problems. IMHO, it is one of the better policy documents and has a number of really good recommendations that I believe would be extremely helpful. The #1 thing I think we could do is address accountability, who is responsible for the security of devices/software and what legal recourse should people have if the vendor doesn't adequately secure or support their products. I think that there are a bunch of issues and one of the biggest ones is that what we say vs what we do are 2 different things. We also have issues where many of the core business practices that are commonly accepted are incompatible with building a secure and resilient infrastructure. [1] https://www.solarium.gov/public-communications/transition-book https://www.solarium.gov/public-communications/transition-bo...
2OEH8eoCRo0 6y ago
You don't need to be technical to pass laws for this stuff. Technology doesn't change the fact that underneath it's always greed/negligence/etc. These are things that have existed forever.