4 ms·

I don’t think a Cold War is a good description of what’s happening; it’s not as if there’s some arms race going on as it is just a very public exposure of how b

I don’t think a Cold War is a good description of what’s happening; it’s not as if there’s some arms race going on as it is just a very public exposure of how bad our overall tech / security infrastructure is. The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected.

joemazerino 5y ago
The arms race is in exploits and software development. The country with the largest stockpile of the former and the best talent in the latter will emerge the victor.
- PeterisP 5y ago
  A large stockpile of exploits can only harm someone else's economy, and it does not protect your economy. So perhaps your neighbour will suffer more than you do, but none of you will be winners in any sense.
  - munificent 5y ago
    The threat of retalition is historically one of the best defenses.
    - PeterisP 5y ago
      With big limitations that don't apply here. Things like mutually assured destruction work if/because an attack is quickly detectable, reasonably clearly attributable, and a symmetric tit-for-tat retaliation is plausible. That's not the case for cyberattacks. Solarwinds was attacked many months before it was detected, Stuxnet was hidden for years. We have attributed some attacks but not most and attribution often succeeds only years after detection. And the attackers aren't as vulnerable to cyberattacks simply because their economy is "less connected" - for example, North Korea is at the extreme end of that scale and they really don't care much about what exploits you have; you have a digital economy that's wealthy but vulnerable to attacks by those who don't have it.
yaw12 5y ago
> The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected. Considering downthread there are honest suggestions to send special forces after the ransomware gangs, I’m gonna go with “probably not”. That type of denial is pervasive. The F500 and companies like JBS just need to move essentially dataframes around from automation to automation, but somehow the software ecosystem is still building that with the same tools used to write Google. The next answer is usually “they don’t invest in a security team, clearly,” and I’m waiting for that subthread to kick off, too, to continue the denial. Software complexity is the enemy, not the malicious actors exploiting it. Fix one, fix the other.
- Dylan16807 5y ago
  I'm confused, why isn't a security team a good way to make and enforce things like smaller attack surfaces and network isolation?
  - viraptor 5y ago
    It is, but it's never going to be perfect. Nobody has achieved that so far. Or at least not in an environment where you have international distribution and thousands of endpoints touching different areas of the system.
- throwaway3699 5y ago
  Software complexity is hard to tackle because it's really the underlying business complexity that's being modelled, which is usually beurocratic, Byzantine-like. See the recent post on why the Uber app is so large: https://news.ycombinator.com/item?id=25376346 https://news.ycombinator.com/item?id=25376346

joemazerino 5y ago

The arms race is in exploits and software development. The country with the largest stockpile of the former and the best talent in the latter will emerge the victor.

PeterisP 5y ago
A large stockpile of exploits can only harm someone else's economy, and it does not protect your economy. So perhaps your neighbour will suffer more than you do, but none of you will be winners in any sense.
- munificent 5y ago
  The threat of retalition is historically one of the best defenses.
  - PeterisP 5y ago
    With big limitations that don't apply here. Things like mutually assured destruction work if/because an attack is quickly detectable, reasonably clearly attributable, and a symmetric tit-for-tat retaliation is plausible. That's not the case for cyberattacks. Solarwinds was attacked many months before it was detected, Stuxnet was hidden for years. We have attributed some attacks but not most and attribution often succeeds only years after detection. And the attackers aren't as vulnerable to cyberattacks simply because their economy is "less connected" - for example, North Korea is at the extreme end of that scale and they really don't care much about what exploits you have; you have a digital economy that's wealthy but vulnerable to attacks by those who don't have it.

yaw12 5y ago

> The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected. Considering downthread there are honest suggestions to send special forces after the ransomware gangs, I’m gonna go with “probably not”. That type of denial is pervasive. The F500 and companies like JBS just need to move essentially dataframes around from automation to automation, but somehow the software ecosystem is still building that with the same tools used to write Google. The next answer is usually “they don’t invest in a security team, clearly,” and I’m waiting for that subthread to kick off, too, to continue the denial. Software complexity is the enemy, not the malicious actors exploiting it. Fix one, fix the other.

Dylan16807 5y ago
I'm confused, why isn't a security team a good way to make and enforce things like smaller attack surfaces and network isolation?
- viraptor 5y ago
  It is, but it's never going to be perfect. Nobody has achieved that so far. Or at least not in an environment where you have international distribution and thousands of endpoints touching different areas of the system.
throwaway3699 5y ago
Software complexity is hard to tackle because it's really the underlying business complexity that's being modelled, which is usually beurocratic, Byzantine-like. See the recent post on why the Uber app is so large: https://news.ycombinator.com/item?id=25376346 https://news.ycombinator.com/item?id=25376346