3 ms·

You are absolutely right about the footguns, legacy cruft, and the joke-not-a-joke-it's-so-stupid that is modern web software development. That all needs to be

by toss1 5y ago

You are absolutely right about the footguns, legacy cruft, and the joke-not-a-joke-it's-so-stupid that is modern web software development. That all needs to be fixed, and here at home However, it is also not merely about the Whoppers running out - this is just this morning's example. When even major "security" vendors can be turned into serious NatSec attack vectors, and much more critical infrastructure can also be attacked with ease, and they are doing it, it becomes a bona-fide NatSec issue. Like any other NatSec issue, this requires both serious hardening actions at home, and serious threats against bad actors abroad. Whether that involves, some kind of diplomacy, economic sanctions, targeted software attacks, targeted covert actions, or overt drone strikes, is up to the experts in those domains, but we do need to treat this as a serious NatSec issue that it is.

s1artibartfast 5y ago
On a planet with seven and a half billion people becoming more connected and tech-savy everyday, security by intimidation simply isn't a viable solution, or a meaningful component of a larger solution.
- unclebucknasty 5y ago
  >On a planet with seven and a half billion people becoming more connected and tech-savy everyday, security by intimidation simply isn't a viable solution, or a meaningful component of a larger solution. It absolutely is and must be a viable component. Those increasingly connected people are also increasingly vulnerable in real-world ways that go well beyond tech. And, it is near impossible to completely secure networks/systems with their near limitless attack surfaces. Treating it as a game of cat and mouse in which you know the mouse will invariably lose with some regularity, then consigning yourself to ever playing the mouse is disastrous policy.
- toss1 5y ago
  It is both. How many hackers from Russian & fmr Soviet countries attack within those countries? Very few. So few that they literally encode checks for RUS language / keyboard installs and skip that machine, and doing such install is at least for now a legit security measure [1]. This isn't just from RUS legal structure and no extradition treaties, but their very intimidating response to anyone acting up internally (I've read of at least one instance where a hacker was found dead at his keyboard with missing hands). RUS security doesn't eff around, and we shouldn't either. Many people will not play at the pointy end of the NatSec game because you are risking your life, and some do because of that. It is definitely a useful measure, among others, to make it known that trespassing with such intent on western computer systems is also getting you into that risk category. [1] https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

by toss1 5y ago

s1artibartfast 5y ago

On a planet with seven and a half billion people becoming more connected and tech-savy everyday, security by intimidation simply isn't a viable solution, or a meaningful component of a larger solution.

unclebucknasty 5y ago
>On a planet with seven and a half billion people becoming more connected and tech-savy everyday, security by intimidation simply isn't a viable solution, or a meaningful component of a larger solution. It absolutely is and must be a viable component. Those increasingly connected people are also increasingly vulnerable in real-world ways that go well beyond tech. And, it is near impossible to completely secure networks/systems with their near limitless attack surfaces. Treating it as a game of cat and mouse in which you know the mouse will invariably lose with some regularity, then consigning yourself to ever playing the mouse is disastrous policy.
toss1 5y ago
It is both. How many hackers from Russian & fmr Soviet countries attack within those countries? Very few. So few that they literally encode checks for RUS language / keyboard installs and skip that machine, and doing such install is at least for now a legit security measure [1]. This isn't just from RUS legal structure and no extradition treaties, but their very intimidating response to anyone acting up internally (I've read of at least one instance where a hacker was found dead at his keyboard with missing hands). RUS security doesn't eff around, and we shouldn't either. Many people will not play at the pointy end of the NatSec game because you are risking your life, and some do because of that. It is definitely a useful measure, among others, to make it known that trespassing with such intent on western computer systems is also getting you into that risk category. [1] https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...