7 ms·

Sweet, since we now have the precedence that the FBI can invade your machine without permission whenever they want for national security reasons I can't wait th

by hpoe 6y ago

Sweet, since we now have the precedence that the FBI can invade your machine without permission whenever they want for national security reasons I can't wait the glorious future we have before us. Now the FBI can access your machine and start modifying things because you are expressing displeasure at your public officials which is a sign of "terrorist behavior", oops you're using your blog to say things the government doesn't like they'll go ahead and delete that for you for national security. Oh you installed or even googled Tor well that is only used by drug dealers and terrorists so clearly you are a threat to national security they'll be cutting you off from internet access now.

the-dude 6y ago
Look, in The Netherlands, the largest grocery chain ( AH, Albert Heijn, Ahold ) has empty cheese shelves because their cheese-logistics-company got hacked through this vulnerability. The Dutch, without cheese. Do you see the severity of the problem now? Jeez.
- HenryBemis 6y ago
  Oh every time I fly to/from/through the Netherlands I always shop this 'net' with 4-5-6 different cheese(s). Pretty pricey at the airport, but definitely worth enjoying for the following weeks!
- sjaak 6y ago
  Every Dutchman worth his salt has his own cow and makes his own bespoke cheese. While wearing wooden shoes no less. Don't you worry about us, there is not and will never be a cheese shortage!
- effingwewt 6y ago
  I've seen the 'think of the kids' excuse ad nauseum, but I've never seen 'think of the cheese!' True to Poe's law, I honestly cannot tell if this was in jest or serious.
high_byte 6y ago
do you have an alternative? would you feel better if it wasn't FBI? or if these remained unfixed?
- livre 6y ago
  It is a Microsoft product, it would have been better if Microsoft was forced to push a patch for the vulnerability and code to remove the exploit in their AV definitions or their malicious software removal tool through Windows update.
  - eternalban 6y ago
    But then we wouldn’t have this opportunity to set this far reaching legal precedent.
- miohtama 6y ago
  Make Microsoft pay and be liable.
bostonsre 6y ago
Is it really that bad and different than what they do in the physical world? If someone breaks into your home and they are still inside when the police show up, they won't just give you a call and tell you someone is inside your home. They will go in there and get the criminal out of your home. The threat actors are actively stealing information and are inside the networks of many companies, some with the expertise to get rid of the bad guys but some without that expertise. Yes, invading networks without warrants to investigate and prosecute people would be extremely bad. But this seems like it falls on the exigent circumstances side of the law and doesn't sound so bad.
- Red_Leaves_Flyy 6y ago
  It's a tragic precedent that is the result of decades of technical debt. Of course I'm not at all surprised to learn that the feds would rather take more unchecked power for themselves than use their mouthpieces to pressure Congress into forcing an industry wide focus on security that has teeth. From top to bottom the internet of things needs to be redesigned to treat every port and every communicated bit as potentially hostile. In the current state of affairs it is not outside the realm of possibilities for a lone actor to use a few RCEs in Windows, *nix, android and iPhones to brick billions of devices overnight. We should be glad that terrorists and nation states are using 0 days with relative discretion for profit and reputation protection instead of destroying critical infrastructure that would take in the range of years to decades to rebuild. I fear that our generation is going to have to learn this lesson the same way the Japanese learned about the horrors of nuclear bombs. Shit. Imagine if stuxnet had been given the capabilities to smoke CPUs, RAM, HDDs or anything else it could get write access to, like water pumps, or pressure regulators.
  - bostonsre 6y ago
    > Of course I'm not at all surprised to learn that the feds would rather take more unchecked power for themselves than use their mouthpieces to pressure Congress into forcing an industry wide focus on security that has teeth. I'm not sure this was an exercise of unchecked power, they got a warrant. I'm also not sure that the FBI has the ability to tell congress what legislation should or should not be enacted. To me, congress seems to be more beholden to their constituents around election time, then lobbyists and the rest of their party the rest of the time. Yes, internet security sucks, but that is the world that we and the FBI find ourselves in. Legislation to fix that fact is somewhat plausible but I don't see it being that simple to enact. Security has always been about making a decision that balances risk with the amount of resources it takes to mitigate security risks. Sure, we could push towards perfect security with legislation, but productivity of companies and the economy will take a large hit and I don't see that as something that legislators can push for and expect to be elected again in the future. Again, yes, our internet security sucks and that is the world we live in. A nation state actor infiltrated the networks of thousands of companies in the united states. The FBI is charged with protecting the citizens of the united states. I'm sure there are a few not so great members of the FBI, but the majority truly believe in fighting to protect our citizens. They followed the law and got a warrant for this action, and assuming they kept their word about what they would and would not touch, they took actions to kick those bad actors off systems of companies in the united states. If a nation state invaded a few thousand residences of our citizens, I would expect nothing less than FBI swat teams going in and solving the issue.

by hpoe 6y ago

the-dude 6y ago

Look, in The Netherlands, the largest grocery chain ( AH, Albert Heijn, Ahold ) has empty cheese shelves because their cheese-logistics-company got hacked through this vulnerability. The Dutch, without cheese. Do you see the severity of the problem now? Jeez.

HenryBemis 6y ago
Oh every time I fly to/from/through the Netherlands I always shop this 'net' with 4-5-6 different cheese(s). Pretty pricey at the airport, but definitely worth enjoying for the following weeks!
sjaak 6y ago
Every Dutchman worth his salt has his own cow and makes his own bespoke cheese. While wearing wooden shoes no less. Don't you worry about us, there is not and will never be a cheese shortage!
effingwewt 6y ago
I've seen the 'think of the kids' excuse ad nauseum, but I've never seen 'think of the cheese!' True to Poe's law, I honestly cannot tell if this was in jest or serious.

high_byte 6y ago

do you have an alternative? would you feel better if it wasn't FBI? or if these remained unfixed?

livre 6y ago
It is a Microsoft product, it would have been better if Microsoft was forced to push a patch for the vulnerability and code to remove the exploit in their AV definitions or their malicious software removal tool through Windows update.
- eternalban 6y ago
  But then we wouldn’t have this opportunity to set this far reaching legal precedent.
miohtama 6y ago
Make Microsoft pay and be liable.

bostonsre 6y ago

Is it really that bad and different than what they do in the physical world? If someone breaks into your home and they are still inside when the police show up, they won't just give you a call and tell you someone is inside your home. They will go in there and get the criminal out of your home. The threat actors are actively stealing information and are inside the networks of many companies, some with the expertise to get rid of the bad guys but some without that expertise. Yes, invading networks without warrants to investigate and prosecute people would be extremely bad. But this seems like it falls on the exigent circumstances side of the law and doesn't sound so bad.

Red_Leaves_Flyy 6y ago
It's a tragic precedent that is the result of decades of technical debt. Of course I'm not at all surprised to learn that the feds would rather take more unchecked power for themselves than use their mouthpieces to pressure Congress into forcing an industry wide focus on security that has teeth. From top to bottom the internet of things needs to be redesigned to treat every port and every communicated bit as potentially hostile. In the current state of affairs it is not outside the realm of possibilities for a lone actor to use a few RCEs in Windows, *nix, android and iPhones to brick billions of devices overnight. We should be glad that terrorists and nation states are using 0 days with relative discretion for profit and reputation protection instead of destroying critical infrastructure that would take in the range of years to decades to rebuild. I fear that our generation is going to have to learn this lesson the same way the Japanese learned about the horrors of nuclear bombs. Shit. Imagine if stuxnet had been given the capabilities to smoke CPUs, RAM, HDDs or anything else it could get write access to, like water pumps, or pressure regulators.
- bostonsre 6y ago
  > Of course I'm not at all surprised to learn that the feds would rather take more unchecked power for themselves than use their mouthpieces to pressure Congress into forcing an industry wide focus on security that has teeth. I'm not sure this was an exercise of unchecked power, they got a warrant. I'm also not sure that the FBI has the ability to tell congress what legislation should or should not be enacted. To me, congress seems to be more beholden to their constituents around election time, then lobbyists and the rest of their party the rest of the time. Yes, internet security sucks, but that is the world that we and the FBI find ourselves in. Legislation to fix that fact is somewhat plausible but I don't see it being that simple to enact. Security has always been about making a decision that balances risk with the amount of resources it takes to mitigate security risks. Sure, we could push towards perfect security with legislation, but productivity of companies and the economy will take a large hit and I don't see that as something that legislators can push for and expect to be elected again in the future. Again, yes, our internet security sucks and that is the world we live in. A nation state actor infiltrated the networks of thousands of companies in the united states. The FBI is charged with protecting the citizens of the united states. I'm sure there are a few not so great members of the FBI, but the majority truly believe in fighting to protect our citizens. They followed the law and got a warrant for this action, and assuming they kept their word about what they would and would not touch, they took actions to kick those bad actors off systems of companies in the united states. If a nation state invaded a few thousand residences of our citizens, I would expect nothing less than FBI swat teams going in and solving the issue.