Hacker News Search

viraptor 5y ago

That could sounds interesting to to a lawmaker, but it wouldn't change anything in practice. Those hacks don't come directly from the authors nicely identified by their affiliation and location. They'll come from a trusted node in the US. Some many already do.

handrous 5y ago
It would force the attackers to enter the jurisdiction of a state that will prosecute them if they're discovered, to carry out the attack, or else resort to much more difficult and slower methods (sneaker-net introduction of initial malware infections in the target state, say).

unclebucknasty 5y ago
>Maybe it's time to accept that this industry is greedy, arrogant and negligent in a way that's unmatched by almost anyone, except maybe hedgefunds. "This industry"? Which industry is that? I mean, it's a tempting narrative: a big greedy industry, etc. But, this is not isolated to any one industry or any one company. These are attacks by foreign actors on a variety of our companies, government agencies, infrastructure, etc. And they result in real harm to our economy, infrastructure, and people. >allow companies to sell vulnerable routers, IP cameras, internet enables printers and phones with knows vulnerabilities at the time of release, and leave it without updates Again, this sounds like a compelling narrative, and sure, there need to be improvements. But, the reality is that the attack surface is vast and includes zero-days in well-maintained software, social engineering, OSS, custom software, network configs, etc. In general, it seems like there's a lot of anger in your post, but none of it directed at the actual criminals (or their national sponsors) who are actually responsible for the attacks. That's really puzzling to the point where it almost reads like defending the criminals.
- ClumsyPilot 5y ago
  "These are attacks by foreign actors" We have plenty of our own hackers and ransomware, i am not seeing how foreign-angle adds anything to the debate "none of it directed at the actual criminals" There will always be criminals. If a bank was robbed by two kids armed with a banana, then the real fault lies with the bank's management for being negligent, and every court will recognise it. As it stands, most data leaks and hacks are not unpreventable zerodays, they are people being negligent and irreaponsible. Large organisations need to change, and ignorance of the issue needs to be adressed. This is not just "there need to be some minor improvements"
  - unclebucknasty 5y ago
    >We have plenty of our own hackers and ransomware The overwhelming majority of the recent, most notable attacks have been traced near-exclusively to foreign actors, including the one that is the subject of the actual thread here. >i am not seeing how foreign-angle adds anything to the debate Of course, it has everything to do with the debate. Specifically, with how we respond/deter. >most data leaks and hacks are ... people being negligent and irreaponsible. The attack surface is vast. >If a bank was robbed by two kids armed with a banana We're literally veering into cartoon territory here. Not sure I understand why you're working so hard to exonerate the actual criminals.
    - ClumsyPilot 5y ago
      "most notable attacks have been traced near-exclusively to foreign actors" Most criminals are "foreign" because most of Earth's population is foreign. "The attack surface is vast." Because we made it vast. It could have been small. "We're literally veering into cartoon territory here" Yes we are, because spying on millions of people and then leaving that data unprotected is childishly irresponsible. Ordinary citizens are the injured party, not companies. They have given up privacy and control over their devices. Even the software that runs on voting machines is copyrighted and secret, and when inspected, it turned out even the basics of security have not been followed. Now that the chickens are coming home to roost, why are you so vehemently looking to absolve them of all responsebility? It's breathtakingly hypocritical.
      - unclebucknasty 5y ago
        Your last comment shed more light on the narrative you're attempting to establish. Here's the "foreign" part of the discussion from our "sub-thread" to make things clearer: Me: These are attacks by foreign actors on a variety of our companies, government agencies, infrastructure, etc. You: We have plenty of our own hackers and ransomware, i am not seeing how foreign-angle adds anything to the debate Me: The overwhelming majority of the recent, most notable attacks have been traced near-exclusively to foreign actors, including the one that is the subject of the actual thread here...It has everything to do with the debate. Specifically, with how we respond/deter. You: Most criminals are "foreign" because most of Earth's population is foreign. Some hardcore goalpost-moving there. You went from "it's domestic and doesn't matter" to "it's foreign, but only due to a statistical artifact". You're talking in circles in your effort to absolve the attackers. And, it's made clear here that you're not just trying to lay the blame on U.S. companies; you're actively working to absolve/divert focus from the foreign adversaries who are attacking us. Maybe you can explain why you find it so important that we blame only U.S. entities, whether they be companies or criminals. It's that criminal bit that gives up the game. This isn't just about a crusade against negligent companies. Your narrative seeks to lay blame with U.S. actors and absolve foreign actors. But, FWIW, a disproportionate number of these attacks come from one country with a population less than half the size of the U.S. It's a country that has been engaged in asymmetric warfare with us. So, you're wrong there too: the foreign nature of the attacks is not a statistical artifact. >Because we made it vast. It could have been small. No. It's vast because it's vast. Complexity + interconnectedness. Fallible humans are responsible for this and it's a problem that's grown over time. Probably every person who's written any significant amount of production code can be said to have contributed to the problem. And, of course, there's no degree of effort that can defend with 100% efficacy, which is why we also need a deterrent approach. >why are you so vehemently looking to absolve [companies] of all responsebility? I've specifically stated that companies need to do better. You, on the other hand, have not assigned an iota of culpability to the actual criminals who attack us. Instead, you've worked against all-logic to absolve them (or, failing that, to place the criminals in the U.S.). It's a simple thing to say "criminals are doing bad things and should be held accountable". Odd that you refuse to say it. Odder still that, to the extent that you even acknowledge criminals exist in this problem-scope, you find it necessary to relocate them to the U.S.

alexanderdmitri 5y ago

I think you're right unfortunately, maybe the Patriot Act will get expanded or maybe there'll be a sibling Good People Have Nothing to Hide Act. Speaking from my vantage in the United States, I can't believe how quickly the population has become knowingly accepting and complicit with a mass surveillance culture. I'm equally concerned with how quickly ownership of purchased goods has been undermined by the server-client model of the internet. These two things are linked and fundamentally disagree with the basic premises the US believes itself to be founded on ... It's hard to draw parallels historically in a way that gives hope. There is quite a lot of middle ground and reasonable solutions that just don't get mentioned in the political theater of today's corpocracy. I know all this has basically become a meme on HN, but every government not following the EU's example and iterating on things like GDPR is implicitly supporting authoritarianism (if not explicitly) and setting up an oppressive future that their children will be trodden down by.

canjobear 5y ago
The Patriot Act is no longer in force.
- alexanderdmitri 5y ago
  They suspended the vote to extend it, so currently expired yes, but I think if/when it goes to vote it will continue to live on. Also, I have not seen evidence that its effects have been nullified with its expiration, but I'm willing to learn.
  - sudosysgen 5y ago
    They will definitely retro-actively extend it if it is needed. Already has been done for AT&T
oceanplexian 5y ago
People haven’t accepted mass surveillance, they just don’t understand what it is and have been mislead by the media, government, and corporations into silently consenting to privacy intrusions. They think it won’t be used against them, until one day it does, and they are horrified when a divorce attorney is talking about the GPS movements from their “connected car” or their bank closes an account and locks out their funds because they attended a political protest. Unfortunately for them the realization comes way too late.
- flyinghamster 5y ago
  > They think it won’t be used against them, until one day it does, and they are horrified when a divorce attorney is talking about the GPS movements from their “connected car” or their bank closes an account and locks out their funds because they attended a political protest. Not to mention those horrified at finding out that even though they deleted their tweets and videos, the feds have shown up at their doorstep because they were in a rampaging mob in the Capitol, searching for elected officials to murder. I wish there was a nice, easy answer on where to draw the line with surveillance. I'm actually glad that the insurrectionists left a zillion-mile wide electronic trail, but I'm all too acutely aware that these capabilities can be turned against anyone, and I'm dead-set against backdooring encryption. At least (US-specific here) there are nominally limits on what the government can do, but those limits are often ignored, and private corporations have much freer rein on what they can do with your data.
  - throwaway3699 5y ago
    Most people are still not sold on January being an insurrection, FWIW. People thought they were going to a political rally, not to murder senators. Things just got out of hand because lunatics decided to storm the building. Why else would they bring smartphones?
    - flyinghamster 5y ago
      Zip-Tie Guy™ wasn't there to protest, and neither was anyone else who entered the Capitol.
      - salawat 5y ago
        Funny how the 1% that take it too far always seem to be just the excuse most otherwise seemingly reasonable need to justify supporting the revocation or curtailing of civil rights. Part of liberty is cleaning up the mess when some people take it a bit far, and moving on.

ClumsyPilot 5y ago
"No. It's vast because it's vast. Complexity + interconnectedness." Firstly, thats not an argument, its a tautology. Secondly Attack surface is vast because we have shipped several billion locked down phones with known vulnerabilities and priprietary binary blob drivers, meaning they can't be updated. We could fix the problem overnight by voiding copyright protection on all software where vendor has abandoned uodates for a year or more. It's not american companies, its the entire shithead industry. "You, on the other hand, have not assigned an iota of culpability to the actual criminals" Mate, they are criminals, they are culpable by definition, its in the Oxford dictionary. They have always existed and always will. Whats the point of banging on about them like a broken record? Even if Russia and China magically dissapear tomorrow, the problem will remain: if you have vulnerable systems someone will hack them. Ita like if someone is always stealing stuff from your house, and I tell you maybe you should try locking the door.
- unclebucknasty 5y ago
  >Firstly, thats not an argument, its a tautology. No, it's a correction. You suggested that "we made the attack surface vast". The point is that you're wrong. It's vast due to actual complexity and interconnectedness. It's vast by definition. >Secondly Attack surface is vast because we have shipped several billion locked down phones... This again illustrates that you don't understand what the attack surface is, thus you believe fallacies such as "we made it vast". It's not a phone or single entry point. It's every bit of software that a system touches or is comprised of, including custom, commercial, and OSS. It's firmware and hardware and networks and configs. It's social. And, to some extent, it's those same vulnerabilities in systems that connect to a system. Again, it's vast by necessity b/c our modern world depends on software, technology and interconnectedness. >Mate, they are criminals, they are culpable by definition, its in the Oxford dictionary. They have always existed and always will. So, this is your grand rationale for focusing all ire on the targeted companies vs the actual criminals? Your overall position then is that we should have no deterrent (why have laws at all?) and just lock our doors/secure our systems. If the inevitable criminals get you, then it's your fault. >Whats the point of banging on about [criminals]? Pretty obvious: to acknowledge they exist, are the actual cause of the problem, and need to be deterred/punished as part of any comprehensive solution. >Even if Russia and China magically dissapear tomorrow, the problem will remain: Actually, the problem would be substantially reduced to relatively nil. Just removing Russia alone would have a massive impact. And, the solution-set becomes vastly different when fighting domestic criminals vs deterring state-sanctioned attacks from foreign adversaries. But, here you are working hard to absolve the U.S.'s foreign adversaries again, "mate". Very curious. >Ita like if someone is always stealing stuff from your house, and I tell you maybe you should try locking the door. Another straw man. I've acknowledged repeatedly that we should lock the door. That discussion is over. What we're discussing is your position that we should not attempt to deter criminals (especially if they are foreign). Instead, they should be able to try breaking your locks with impunity and, if they succeed, then it's your fault.