4 ms·

>Maybe it's time to accept that this industry is greedy, arrogant and negligent in a way that's unmatched by almost anyone, except maybe hedgefunds. "This indu

>Maybe it's time to accept that this industry is greedy, arrogant and negligent in a way that's unmatched by almost anyone, except maybe hedgefunds. "This industry"? Which industry is that? I mean, it's a tempting narrative: a big greedy industry, etc. But, this is not isolated to any one industry or any one company. These are attacks by foreign actors on a variety of our companies, government agencies, infrastructure, etc. And they result in real harm to our economy, infrastructure, and people. >allow companies to sell vulnerable routers, IP cameras, internet enables printers and phones with knows vulnerabilities at the time of release, and leave it without updates Again, this sounds like a compelling narrative, and sure, there need to be improvements. But, the reality is that the attack surface is vast and includes zero-days in well-maintained software, social engineering, OSS, custom software, network configs, etc. In general, it seems like there's a lot of anger in your post, but none of it directed at the actual criminals (or their national sponsors) who are actually responsible for the attacks. That's really puzzling to the point where it almost reads like defending the criminals.

ClumsyPilot 5y ago
"These are attacks by foreign actors" We have plenty of our own hackers and ransomware, i am not seeing how foreign-angle adds anything to the debate "none of it directed at the actual criminals" There will always be criminals. If a bank was robbed by two kids armed with a banana, then the real fault lies with the bank's management for being negligent, and every court will recognise it. As it stands, most data leaks and hacks are not unpreventable zerodays, they are people being negligent and irreaponsible. Large organisations need to change, and ignorance of the issue needs to be adressed. This is not just "there need to be some minor improvements"
- unclebucknasty 5y ago
  >We have plenty of our own hackers and ransomware The overwhelming majority of the recent, most notable attacks have been traced near-exclusively to foreign actors, including the one that is the subject of the actual thread here. >i am not seeing how foreign-angle adds anything to the debate Of course, it has everything to do with the debate. Specifically, with how we respond/deter. >most data leaks and hacks are ... people being negligent and irreaponsible. The attack surface is vast. >If a bank was robbed by two kids armed with a banana We're literally veering into cartoon territory here. Not sure I understand why you're working so hard to exonerate the actual criminals.
  - ClumsyPilot 5y ago
    "most notable attacks have been traced near-exclusively to foreign actors" Most criminals are "foreign" because most of Earth's population is foreign. "The attack surface is vast." Because we made it vast. It could have been small. "We're literally veering into cartoon territory here" Yes we are, because spying on millions of people and then leaving that data unprotected is childishly irresponsible. Ordinary citizens are the injured party, not companies. They have given up privacy and control over their devices. Even the software that runs on voting machines is copyrighted and secret, and when inspected, it turned out even the basics of security have not been followed. Now that the chickens are coming home to roost, why are you so vehemently looking to absolve them of all responsebility? It's breathtakingly hypocritical.
    - unclebucknasty 5y ago
      Your last comment shed more light on the narrative you're attempting to establish. Here's the "foreign" part of the discussion from our "sub-thread" to make things clearer: Me: These are attacks by foreign actors on a variety of our companies, government agencies, infrastructure, etc. You: We have plenty of our own hackers and ransomware, i am not seeing how foreign-angle adds anything to the debate Me: The overwhelming majority of the recent, most notable attacks have been traced near-exclusively to foreign actors, including the one that is the subject of the actual thread here...It has everything to do with the debate. Specifically, with how we respond/deter. You: Most criminals are "foreign" because most of Earth's population is foreign. Some hardcore goalpost-moving there. You went from "it's domestic and doesn't matter" to "it's foreign, but only due to a statistical artifact". You're talking in circles in your effort to absolve the attackers. And, it's made clear here that you're not just trying to lay the blame on U.S. companies; you're actively working to absolve/divert focus from the foreign adversaries who are attacking us. Maybe you can explain why you find it so important that we blame only U.S. entities, whether they be companies or criminals. It's that criminal bit that gives up the game. This isn't just about a crusade against negligent companies. Your narrative seeks to lay blame with U.S. actors and absolve foreign actors. But, FWIW, a disproportionate number of these attacks come from one country with a population less than half the size of the U.S. It's a country that has been engaged in asymmetric warfare with us. So, you're wrong there too: the foreign nature of the attacks is not a statistical artifact. >Because we made it vast. It could have been small. No. It's vast because it's vast. Complexity + interconnectedness. Fallible humans are responsible for this and it's a problem that's grown over time. Probably every person who's written any significant amount of production code can be said to have contributed to the problem. And, of course, there's no degree of effort that can defend with 100% efficacy, which is why we also need a deterrent approach. >why are you so vehemently looking to absolve [companies] of all responsebility? I've specifically stated that companies need to do better. You, on the other hand, have not assigned an iota of culpability to the actual criminals who attack us. Instead, you've worked against all-logic to absolve them (or, failing that, to place the criminals in the U.S.). It's a simple thing to say "criminals are doing bad things and should be held accountable". Odd that you refuse to say it. Odder still that, to the extent that you even acknowledge criminals exist in this problem-scope, you find it necessary to relocate them to the U.S.

ClumsyPilot 5y ago

"These are attacks by foreign actors" We have plenty of our own hackers and ransomware, i am not seeing how foreign-angle adds anything to the debate "none of it directed at the actual criminals" There will always be criminals. If a bank was robbed by two kids armed with a banana, then the real fault lies with the bank's management for being negligent, and every court will recognise it. As it stands, most data leaks and hacks are not unpreventable zerodays, they are people being negligent and irreaponsible. Large organisations need to change, and ignorance of the issue needs to be adressed. This is not just "there need to be some minor improvements"

unclebucknasty 5y ago
>We have plenty of our own hackers and ransomware The overwhelming majority of the recent, most notable attacks have been traced near-exclusively to foreign actors, including the one that is the subject of the actual thread here. >i am not seeing how foreign-angle adds anything to the debate Of course, it has everything to do with the debate. Specifically, with how we respond/deter. >most data leaks and hacks are ... people being negligent and irreaponsible. The attack surface is vast. >If a bank was robbed by two kids armed with a banana We're literally veering into cartoon territory here. Not sure I understand why you're working so hard to exonerate the actual criminals.
- ClumsyPilot 5y ago
  "most notable attacks have been traced near-exclusively to foreign actors" Most criminals are "foreign" because most of Earth's population is foreign. "The attack surface is vast." Because we made it vast. It could have been small. "We're literally veering into cartoon territory here" Yes we are, because spying on millions of people and then leaving that data unprotected is childishly irresponsible. Ordinary citizens are the injured party, not companies. They have given up privacy and control over their devices. Even the software that runs on voting machines is copyrighted and secret, and when inspected, it turned out even the basics of security have not been followed. Now that the chickens are coming home to roost, why are you so vehemently looking to absolve them of all responsebility? It's breathtakingly hypocritical.
  - unclebucknasty 5y ago
    Your last comment shed more light on the narrative you're attempting to establish. Here's the "foreign" part of the discussion from our "sub-thread" to make things clearer: Me: These are attacks by foreign actors on a variety of our companies, government agencies, infrastructure, etc. You: We have plenty of our own hackers and ransomware, i am not seeing how foreign-angle adds anything to the debate Me: The overwhelming majority of the recent, most notable attacks have been traced near-exclusively to foreign actors, including the one that is the subject of the actual thread here...It has everything to do with the debate. Specifically, with how we respond/deter. You: Most criminals are "foreign" because most of Earth's population is foreign. Some hardcore goalpost-moving there. You went from "it's domestic and doesn't matter" to "it's foreign, but only due to a statistical artifact". You're talking in circles in your effort to absolve the attackers. And, it's made clear here that you're not just trying to lay the blame on U.S. companies; you're actively working to absolve/divert focus from the foreign adversaries who are attacking us. Maybe you can explain why you find it so important that we blame only U.S. entities, whether they be companies or criminals. It's that criminal bit that gives up the game. This isn't just about a crusade against negligent companies. Your narrative seeks to lay blame with U.S. actors and absolve foreign actors. But, FWIW, a disproportionate number of these attacks come from one country with a population less than half the size of the U.S. It's a country that has been engaged in asymmetric warfare with us. So, you're wrong there too: the foreign nature of the attacks is not a statistical artifact. >Because we made it vast. It could have been small. No. It's vast because it's vast. Complexity + interconnectedness. Fallible humans are responsible for this and it's a problem that's grown over time. Probably every person who's written any significant amount of production code can be said to have contributed to the problem. And, of course, there's no degree of effort that can defend with 100% efficacy, which is why we also need a deterrent approach. >why are you so vehemently looking to absolve [companies] of all responsebility? I've specifically stated that companies need to do better. You, on the other hand, have not assigned an iota of culpability to the actual criminals who attack us. Instead, you've worked against all-logic to absolve them (or, failing that, to place the criminals in the U.S.). It's a simple thing to say "criminals are doing bad things and should be held accountable". Odd that you refuse to say it. Odder still that, to the extent that you even acknowledge criminals exist in this problem-scope, you find it necessary to relocate them to the U.S.