3 ms·

How so? Seems it's spot on. Since the birth of the internet companies haven't given a damn about leaks and there're no real consequences. Now they care because

by Dah00n 5y ago

How so? Seems it's spot on. Since the birth of the internet companies haven't given a damn about leaks and there're no real consequences. Now they care because it hurts them instead of just us.

meowface 5y ago
I work in infosec and agree with the point that a lot of companies are overly lax, ignorant, and negligent about security. But I could probably write like a 10 page essay disputing all of those points. For a summarized version, I wrote some semi-relevant comments about this in another ransomware thread from the other day, so this is a lazy answer but you could Ctrl+F my username in https://news.ycombinator.com/item?id=27096137 https://news.ycombinator.com/item?id=27096137 Basically, I agree in general that a large percentage of the industry is a massive joke, but at the same time, I think in many cases there's more victim-blaming than is warranted. Ransomware isn't what it used to be. Being hit or ruined by a ransomware attack doesn't necessarily imply negligence or lack of care (even if a high percentage of the victims probably are negligent simply due to the high base rate of such companies).
- a1369209993 5y ago
  I see nothing there that invalidates any of those points. At best it weakens points 1, 4 and 5 on the basis that companies will get away with it by paying ransoms[0], and ransomers have a incentive to not be so extractive that they kill the hosts they're parasitising, but that's still a idiot tax for said companies. 0: rather than their previous strategy of ignoring the problem entirely because other poeple's privacy doesn't show up on their balance sheet
  - meowface 5y ago
    Indeed, I'd need to explicitly address each point to explain exactly why and how I disagree. They're not exactly wrong in a general sense (which I know sounds a little contradictory given I said "every single point is completely inaccurate, irrelevant, and/or nonsensical"), but I think they're wrong in a fundamental way when talking about the ransomware problem. And point 1 is a total non-sequitur in at least three different ways. It's a complex topic. Basically, I just think that even though a ton of cynicism (about this, about the infosec industry, about companies' approach to security) is absolutely and overwhelmingly warranted, they're being too cynical.
    - a1369209993 5y ago
      > they're being too cynical. Huh? If anything, they're too optimistic; as you pointed out, it's likely many companies will continue to ignore this and either make backups without improving their security, pay ransoms after the fact or quietly implode when they can't. I agree that 1 is a bit useless (although I took it to mean PGP-for-example, not PGP-specifically), but I didn't see anything particularly relevant to it, aside from what I mentioned above.

by Dah00n 5y ago

How so? Seems it's spot on. Since the birth of the internet companies haven't given a damn about leaks and there're no real consequences. Now they care because it hurts them instead of just us.

meowface 5y ago

I work in infosec and agree with the point that a lot of companies are overly lax, ignorant, and negligent about security. But I could probably write like a 10 page essay disputing all of those points. For a summarized version, I wrote some semi-relevant comments about this in another ransomware thread from the other day, so this is a lazy answer but you could Ctrl+F my username in https://news.ycombinator.com/item?id=27096137 https://news.ycombinator.com/item?id=27096137 Basically, I agree in general that a large percentage of the industry is a massive joke, but at the same time, I think in many cases there's more victim-blaming than is warranted. Ransomware isn't what it used to be. Being hit or ruined by a ransomware attack doesn't necessarily imply negligence or lack of care (even if a high percentage of the victims probably are negligent simply due to the high base rate of such companies).

a1369209993 5y ago
I see nothing there that invalidates any of those points. At best it weakens points 1, 4 and 5 on the basis that companies will get away with it by paying ransoms[0], and ransomers have a incentive to not be so extractive that they kill the hosts they're parasitising, but that's still a idiot tax for said companies. 0: rather than their previous strategy of ignoring the problem entirely because other poeple's privacy doesn't show up on their balance sheet
- meowface 5y ago
  Indeed, I'd need to explicitly address each point to explain exactly why and how I disagree. They're not exactly wrong in a general sense (which I know sounds a little contradictory given I said "every single point is completely inaccurate, irrelevant, and/or nonsensical"), but I think they're wrong in a fundamental way when talking about the ransomware problem. And point 1 is a total non-sequitur in at least three different ways. It's a complex topic. Basically, I just think that even though a ton of cynicism (about this, about the infosec industry, about companies' approach to security) is absolutely and overwhelmingly warranted, they're being too cynical.
  - a1369209993 5y ago
    > they're being too cynical. Huh? If anything, they're too optimistic; as you pointed out, it's likely many companies will continue to ignore this and either make backups without improving their security, pay ransoms after the fact or quietly implode when they can't. I agree that 1 is a bit useless (although I took it to mean PGP-for-example, not PGP-specifically), but I didn't see anything particularly relevant to it, aside from what I mentioned above.