4 ms·

It's not the Hardware not the Software and NOT the Protocols, it's the Human Factor, neglected systems, and often not even a try to use "best practices". The o

by nix23 5y ago

It's not the Hardware not the Software and NOT the Protocols, it's the Human Factor, neglected systems, and often not even a try to use "best practices". The only way to change that is massive fines, there is no chance that a technical system can control human behavior...ATM at least, like Plane-crashes technically it's always human error. EDIT: Corrected Plan-crashes and told Mozilla to pay a 1 Million $ fine, because the auto-correct software did not work correctly ;)

ajdegol 5y ago
> like Plan-crashes technically it's always human error That's a $1M fine for misspelling "Plane". ;) Also, it's definitely the software. There's a wonderful talk by Alan Kay regarding this, but I cannot find it. It might be referenced in Jon Blow's talk: - https://www.youtube.com/watch?v=ZSRHeXYDLko https://www.youtube.com/watch?v=ZSRHeXYDLko
uniqueid 5y ago
I agree it could help to look at legal changes, such as 'massive fines'. That's closer to the 'rethink' we need. In regard to human error, I think we are approaching the point where it is useless to focus on individual hackers, companies, admins or users. To pick the most famous example of something we should rethink (not that it would address the hack in this news story): users on the web mainly read text, yet our browsers enable Javascript by default. To me it seems the ways we store and share data in IT are starting to fail. It's at the point where every interaction a regular person engages in (with banking, shopping, healthcare, social life, work, education, etc) has a real chance of becoming public. That's not sustainable.
- nix23 5y ago
  Very well said, i could not agree more.
- uberswe 5y ago
  There is always a balance between convenience and security. Marketing tends to hate forcing 2FA as it hurts conversions for example. I think we can do a lot by thinking about only storing the data that is needed and for only the time that is needed. I think GDPR has been a first step in the right direction and it also adds fines for abusers.
lbriner 5y ago
The hardware, software and protocols are written by humans so they are definitely part of the problem! Massive fines sounds like an easy win but it doesn't work in practice in the sae way that massive fines don't stop corporate polluters, don't stop medical negligence and don't stop crime in general. Are they useful? Only where it is clear where the responsbility lays. Take the VW emmissions scandal as an equivalent issue imho. Who gets a fine? VW? That isn't really fair if the decision was taken by an employee. The employees? They can't afford to pay a fine. All this would do is make it harder for disruptive startups who can't afford the potential fines. Sadly, I think like most things, it will take a whole raft of things including educating people, punishing people and companies, regulating who is allowed to produce and sign-off systems, have mandatory MOTs for software so they can't be left to languish and even potentially creating seprate WWWs for those who follow the rules and the general public can trust vs those who believe in complete liberty to do whatever they want and who cannot be exposed to the general public who won't understand the risks they are exposing themselves to.
- nix23 5y ago
  >The hardware, software and protocols are written by humans so they are definitely part of the problem! like Plane-crashes technically it's always human error >Take the VW emmissions scandal as an equivalent issue imho. That isn't really fair if the decision was taken by an employee That's a bad example, they got massive fines in the US, not so in germany (for obvious reasons), and yes it was for sure the engineer who took that decision and for sure not the management ;) A example for responsible storage of such data would be: If you want to store my highly private data (health records), you have to use a terminal to a government mainframe...you are not allowed to export, process or store it anywhere else.
- raxxorrax 5y ago
  > have mandatory MOTs for software What does MOTs mean? To be honest, I want in the net for special people that cannot be exposed to the general public.
  - michaelt 5y ago
danielheath 5y ago
It's reasonably well established that humans systematically underestimate low-probability, high-cost outcomes. Getting hacked is already pretty high-cost for most organizations. Given that, I think there's more to be gained by looking at the "low probability" side of things. Some historic examples of attacking the "low probability" side include building codes and speeding fines - both have pretty strong evidence for their efficacy. A comparable initiative for software might fine those found keeping data after they do not need it (like GDPR), or mandate that sensitive data is stored behind appropriate access controls (like PCI does).
belatw 5y ago
Massive fines to whom? In this case the taxpayers will bear the brunt of those fines. In other cases, the consumers.
- _trampeltier 5y ago
  There is a person in charge for this. Just like to drive a companys car to fast. You have to pay by youself. Very simple.
- tjpnz 5y ago
  It doesn't need to be that way. The procurement process used by governments to buy software is broken beyond repair anyway. Maybe this will bring some innovation into the space. For private companies in competitive industries I couldn't see this affecting consumers in a negative way. It may affect the bonuses of the overpaid but few would lose sleep over that.
- DyslexicAtheist 5y ago
  > Massive fines to whom? companies need to be held accountable for the garbage they create. peddling alpha/beta software to consumers or pushing code to production while they don't have a disclosure policy and rather purchase ransomware insurance than invest in quality-control must be forced with fines too big to ignore (make it 1% of annual global turnover _not_ profits) secondly we need to decriminalize hackers that take down vulnerable shit. instead create a business model that allows someone like brickerbot/janit0r to take dangerous devices offline if it is known to be unpatched for x-months still. similar what the feds did with patching of the recent MS exchange exploit but more bottom-up. finally criminalize all cryptocurrency so that they can no longer be converted to FIAT in any legal sort of way. want to use bitcoin? fine your only way to turn it into value is by buying a gift card that only is accepted by a corner shop in Uzbekistan. as another alternative that is also the other extreme, make banks adopt cryptocurrency (https://twitter.com/JoeUchill/status/1393697279941431300 https://twitter.com/JoeUchill/status/1393697279941431300) so it turns into a regulated white-market while outlawing the grey areas. taking these measures further, if you're getting pwned and do not disclose it within 1 week, or info surfaces that you paid ransom without disclosing it then your CEO and CISO bonk! go straight to jail. That would immediately put pressure into solving the boring security shit, like curating and maintaining a good quality SBOM, asset catalogue etc (... come to think of it, if inventory is missing in any org that processes PII, or you get hit by an OWASP top-10 then immediately jail time as well). it all starts and fails with holding people responsible for what they do and make it impossible to hide behind the name of a company. salaries can be adjusted to actual responsibility people carry in the company, no more blaming the intern. ^^ the reason why any of these measures will never happen is because those who would have to enforce it are themselves corrupt and totally dependent on the broken system in order to get cover and plausible deniability for their own crimes: https://www.newsweek.com/exclusive-inside-militarys-secret-undercover-army-1591881 https://www.newsweek.com/exclusive-inside-militarys-secret-u...
sul_tasto 5y ago
I think we need the equivalent of building codes and inspections.
2OEH8eoCRo0 5y ago
It's both but the humans have an excuse- they're human. We should know by now that given enough time humans fuck everything up. We should build things with this in mind. If we keep assuming humans are suddenly going to stop making mistakes then these things will never go away. I almost never blame the user or human, I blame the software.

by nix23 5y ago

ajdegol 5y ago

> like Plan-crashes technically it's always human error That's a $1M fine for misspelling "Plane". ;) Also, it's definitely the software. There's a wonderful talk by Alan Kay regarding this, but I cannot find it. It might be referenced in Jon Blow's talk: - https://www.youtube.com/watch?v=ZSRHeXYDLko https://www.youtube.com/watch?v=ZSRHeXYDLko

uniqueid 5y ago

I agree it could help to look at legal changes, such as 'massive fines'. That's closer to the 'rethink' we need. In regard to human error, I think we are approaching the point where it is useless to focus on individual hackers, companies, admins or users. To pick the most famous example of something we should rethink (not that it would address the hack in this news story): users on the web mainly read text, yet our browsers enable Javascript by default. To me it seems the ways we store and share data in IT are starting to fail. It's at the point where every interaction a regular person engages in (with banking, shopping, healthcare, social life, work, education, etc) has a real chance of becoming public. That's not sustainable.

nix23 5y ago
Very well said, i could not agree more.
uberswe 5y ago
There is always a balance between convenience and security. Marketing tends to hate forcing 2FA as it hurts conversions for example. I think we can do a lot by thinking about only storing the data that is needed and for only the time that is needed. I think GDPR has been a first step in the right direction and it also adds fines for abusers.

lbriner 5y ago

The hardware, software and protocols are written by humans so they are definitely part of the problem! Massive fines sounds like an easy win but it doesn't work in practice in the sae way that massive fines don't stop corporate polluters, don't stop medical negligence and don't stop crime in general. Are they useful? Only where it is clear where the responsbility lays. Take the VW emmissions scandal as an equivalent issue imho. Who gets a fine? VW? That isn't really fair if the decision was taken by an employee. The employees? They can't afford to pay a fine. All this would do is make it harder for disruptive startups who can't afford the potential fines. Sadly, I think like most things, it will take a whole raft of things including educating people, punishing people and companies, regulating who is allowed to produce and sign-off systems, have mandatory MOTs for software so they can't be left to languish and even potentially creating seprate WWWs for those who follow the rules and the general public can trust vs those who believe in complete liberty to do whatever they want and who cannot be exposed to the general public who won't understand the risks they are exposing themselves to.

nix23 5y ago
>The hardware, software and protocols are written by humans so they are definitely part of the problem! like Plane-crashes technically it's always human error >Take the VW emmissions scandal as an equivalent issue imho. That isn't really fair if the decision was taken by an employee That's a bad example, they got massive fines in the US, not so in germany (for obvious reasons), and yes it was for sure the engineer who took that decision and for sure not the management ;) A example for responsible storage of such data would be: If you want to store my highly private data (health records), you have to use a terminal to a government mainframe...you are not allowed to export, process or store it anywhere else.
raxxorrax 5y ago
> have mandatory MOTs for software What does MOTs mean? To be honest, I want in the net for special people that cannot be exposed to the general public.
- michaelt 5y ago

danielheath 5y ago

It's reasonably well established that humans systematically underestimate low-probability, high-cost outcomes. Getting hacked is already pretty high-cost for most organizations. Given that, I think there's more to be gained by looking at the "low probability" side of things. Some historic examples of attacking the "low probability" side include building codes and speeding fines - both have pretty strong evidence for their efficacy. A comparable initiative for software might fine those found keeping data after they do not need it (like GDPR), or mandate that sensitive data is stored behind appropriate access controls (like PCI does).

belatw 5y ago

Massive fines to whom? In this case the taxpayers will bear the brunt of those fines. In other cases, the consumers.

_trampeltier 5y ago
There is a person in charge for this. Just like to drive a companys car to fast. You have to pay by youself. Very simple.
tjpnz 5y ago
It doesn't need to be that way. The procurement process used by governments to buy software is broken beyond repair anyway. Maybe this will bring some innovation into the space. For private companies in competitive industries I couldn't see this affecting consumers in a negative way. It may affect the bonuses of the overpaid but few would lose sleep over that.
DyslexicAtheist 5y ago
> Massive fines to whom? companies need to be held accountable for the garbage they create. peddling alpha/beta software to consumers or pushing code to production while they don't have a disclosure policy and rather purchase ransomware insurance than invest in quality-control must be forced with fines too big to ignore (make it 1% of annual global turnover _not_ profits) secondly we need to decriminalize hackers that take down vulnerable shit. instead create a business model that allows someone like brickerbot/janit0r to take dangerous devices offline if it is known to be unpatched for x-months still. similar what the feds did with patching of the recent MS exchange exploit but more bottom-up. finally criminalize all cryptocurrency so that they can no longer be converted to FIAT in any legal sort of way. want to use bitcoin? fine your only way to turn it into value is by buying a gift card that only is accepted by a corner shop in Uzbekistan. as another alternative that is also the other extreme, make banks adopt cryptocurrency (https://twitter.com/JoeUchill/status/1393697279941431300 https://twitter.com/JoeUchill/status/1393697279941431300) so it turns into a regulated white-market while outlawing the grey areas. taking these measures further, if you're getting pwned and do not disclose it within 1 week, or info surfaces that you paid ransom without disclosing it then your CEO and CISO bonk! go straight to jail. That would immediately put pressure into solving the boring security shit, like curating and maintaining a good quality SBOM, asset catalogue etc (... come to think of it, if inventory is missing in any org that processes PII, or you get hit by an OWASP top-10 then immediately jail time as well). it all starts and fails with holding people responsible for what they do and make it impossible to hide behind the name of a company. salaries can be adjusted to actual responsibility people carry in the company, no more blaming the intern. ^^ the reason why any of these measures will never happen is because those who would have to enforce it are themselves corrupt and totally dependent on the broken system in order to get cover and plausible deniability for their own crimes: https://www.newsweek.com/exclusive-inside-militarys-secret-undercover-army-1591881 https://www.newsweek.com/exclusive-inside-militarys-secret-u...

sul_tasto 5y ago

I think we need the equivalent of building codes and inspections.

2OEH8eoCRo0 5y ago

It's both but the humans have an excuse- they're human. We should know by now that given enough time humans fuck everything up. We should build things with this in mind. If we keep assuming humans are suddenly going to stop making mistakes then these things will never go away. I almost never blame the user or human, I blame the software.