6 ms·

That's like a gang attacking you on the street, and someone remarking you should've hired (more) bodyguards. No infrastructure is perfectly secure. This is why

by slver 5y ago

That's like a gang attacking you on the street, and someone remarking you should've hired (more) bodyguards. No infrastructure is perfectly secure. This is why it's illegal to attack infrastructure and blackmail the owners. However "illegal" doesn't mean anything to cryptocurrency, because it's beyond anyone's control. Before crypto, there was no direct way to pay the blackmailers, unless they were nearby, and willing to send someone to get cash in a briefcase. Which involves a lot of risk, obviously. With crypto anyone in the world can attack you, and get paid risk-free.

boringg 5y ago
And that someone happens to have a lot of bodyguards for sale / is a body guard
vmception 5y ago
But its more like the incentives to crowdsource security improvements can be improved with bug bounties more closely reflecting the value of the system or bounty
- slver 5y ago
  I can play your game. But I'll make it fair. I'll pay you to find bugs in my system. I'll pay you a lot. But if it gets hacked: 1. You return all money. 2. You're personally responsible for all negative financial and legal outcomes. 3. And I don't mean I get to take your Nintendo Wii and your half-eaten donut. I mean you need to prove you have a whole lot of money, like how much I stand to lose. And if I lose them due to a hack you failed to prevent, I take all your money. 4. Also you can't have contracts with other people, unless you have a separate pile of money for them when they get hacked. You game? Sign here, here and here.
  - vmception 5y ago
    orrrrr just use the existing bug bounty systems with higher payouts and less arbitrary nature of whether a payout will occur or not, as they already have sorted out liability exemptions and the limit of what the hacker will do.
    - slver 5y ago
      Bug bounty programs help when you want to gradually improve the quality of your system, but no single bug can be used to blackmail or halt your entire business. You see, your proposal's math doesn't work. Acme has a system worth 100 million. This means a blackmailer can ask for 100 million if they find one bug (let's keep things simple). Obviously Acme can't offer 100 million in a bug bounty program for every bug found. So let's say they offer 100k, they're very generous. This means after 1000 bugs found, they've transferred their entire worth to bug bounty hunters. So while Acme had to create a system worth 100 million, they own 0 of it now. They gave everything to bounty hunters. Is this fair? No. What happened is that instead of one blackmailer, there were 1000 blackmailers saying "we're the good guys, we help you find bugs in your system, OR ELSE". When a health industry keeps raising the prices on you, because they keep saying "we're the good guys, we help you not die of cancer, give us your house, OR ELSE" we love them right? But that's not the end of the story. Did the good guys who took all your money found all the bugs? Well a blackmailer still stands to gain 1000x more than anyone on the bug bounty program, if they can find a bug before the bug bounty hunters have leeched the host dry of their last drop of blood. So a malicious hacker is motivated to be faster, and financed to be better, with more people, better equipment, and so on. So the bug bounty program is absolutely inadequate solution to the problem. Paying more to match what a blackmailer would ask, turns the bug bounty hunters into blackmailers. Except they also can't guarantee shit. And they can't cover losses for shit if they miss something either. They just take your money and leave you almost as vulnerable as you were. So, no. Companies won't have bigger bug bounty programs. Instead they'll do something that might help. Like move off the internet, making things more inconvenient for everyone, and insure heavily anything they put online.
      - vmception 5y ago
        Great points My primary rebuttal is that enough hackers don't want 1000x more than anyone else in the bug bounty program, they don't want the liability associated with reintegrating that money back into society Somewhere in between bug bounties pricing and payouts now, and the incentive to cripple/steal everything for ransom, is the more accurate medium
swensel 5y ago
Blockchain forensics are already used for tracking transactions and these will get more advanced over time. I think saying "risk-free" is a big stretch. Yes, this is made possible with cryptocurrency, the transactions are irreversible and are not controlled by a central authority (generally). However, many blockchains are also public ledgers, and you have to also figure in fiat gateways if the attackers don't just want to keep the money in cryptocurrency.
- madcow2 5y ago
  So some poor soul gets stuck with the hot potato down the road(Ie their funds frozen for no apparent reason when the forensics flags them). The criminals know this and will cash out immediately as much as possible. How is that a good thing?
  - swensel 5y ago
    Analysis of the transactions could lead law enforcement to the attackers before they try to cash out. Centralized exchanges may also flag the attackers when they attempt to cash out. There is no guarantee they can cash out without getting caught first. It's not just that some poor new owner is left holding the bag. Addresses get blacklisted by law enforcement and the exchanges. I don't think those coins would continue to be transferred to new owners. Those potential new owners would also probably just go trade on an exchange. If there is some big discount from a local party trying to get rid of the coins, wouldn't that raise some red flag? The transactions for most cryptocurrency blockchains are viewable by all members of the public. With fiat, only the banks (or the governments) can see transactions. If I was to say there is some good thing, I would say that is a new innovation that hasn't been possible before. Cryptocurrency also does enable new illegal activities that weren't possible before, so there are definitely pros / cons, but I would say there are pros / cons to fiat as well.
    - slver 5y ago
      > With fiat, only the banks (or the governments) can see transactions. If I was to say there is some good thing, I would say that is a new innovation that hasn't been possible before. What do you mean it hasn't been possible. It's absolutely possible. We don't do it because no one wants to advertise how much money they have and who they give it to, unless compelled by a specific reason. > Cryptocurrency also does enable new illegal activities that weren't possible before, so there are definitely pros / cons, but I would say there are pros / cons to fiat as well. So the pros are things we could do (publish our private transactions), but we don't want to, and the cons are things we could do (blackmail each other), but we don't want to. Lol, great.
christophilus 5y ago
It’s more like you move to a high crime area and don’t lock your front door and then blame the break in on your wife’s diamond necklace.

by slver 5y ago

boringg 5y ago

And that someone happens to have a lot of bodyguards for sale / is a body guard

vmception 5y ago

But its more like the incentives to crowdsource security improvements can be improved with bug bounties more closely reflecting the value of the system or bounty

slver 5y ago
I can play your game. But I'll make it fair. I'll pay you to find bugs in my system. I'll pay you a lot. But if it gets hacked: 1. You return all money. 2. You're personally responsible for all negative financial and legal outcomes. 3. And I don't mean I get to take your Nintendo Wii and your half-eaten donut. I mean you need to prove you have a whole lot of money, like how much I stand to lose. And if I lose them due to a hack you failed to prevent, I take all your money. 4. Also you can't have contracts with other people, unless you have a separate pile of money for them when they get hacked. You game? Sign here, here and here.
- vmception 5y ago
  orrrrr just use the existing bug bounty systems with higher payouts and less arbitrary nature of whether a payout will occur or not, as they already have sorted out liability exemptions and the limit of what the hacker will do.
  - slver 5y ago
    Bug bounty programs help when you want to gradually improve the quality of your system, but no single bug can be used to blackmail or halt your entire business. You see, your proposal's math doesn't work. Acme has a system worth 100 million. This means a blackmailer can ask for 100 million if they find one bug (let's keep things simple). Obviously Acme can't offer 100 million in a bug bounty program for every bug found. So let's say they offer 100k, they're very generous. This means after 1000 bugs found, they've transferred their entire worth to bug bounty hunters. So while Acme had to create a system worth 100 million, they own 0 of it now. They gave everything to bounty hunters. Is this fair? No. What happened is that instead of one blackmailer, there were 1000 blackmailers saying "we're the good guys, we help you find bugs in your system, OR ELSE". When a health industry keeps raising the prices on you, because they keep saying "we're the good guys, we help you not die of cancer, give us your house, OR ELSE" we love them right? But that's not the end of the story. Did the good guys who took all your money found all the bugs? Well a blackmailer still stands to gain 1000x more than anyone on the bug bounty program, if they can find a bug before the bug bounty hunters have leeched the host dry of their last drop of blood. So a malicious hacker is motivated to be faster, and financed to be better, with more people, better equipment, and so on. So the bug bounty program is absolutely inadequate solution to the problem. Paying more to match what a blackmailer would ask, turns the bug bounty hunters into blackmailers. Except they also can't guarantee shit. And they can't cover losses for shit if they miss something either. They just take your money and leave you almost as vulnerable as you were. So, no. Companies won't have bigger bug bounty programs. Instead they'll do something that might help. Like move off the internet, making things more inconvenient for everyone, and insure heavily anything they put online.
    - vmception 5y ago
      Great points My primary rebuttal is that enough hackers don't want 1000x more than anyone else in the bug bounty program, they don't want the liability associated with reintegrating that money back into society Somewhere in between bug bounties pricing and payouts now, and the incentive to cripple/steal everything for ransom, is the more accurate medium

swensel 5y ago

Blockchain forensics are already used for tracking transactions and these will get more advanced over time. I think saying "risk-free" is a big stretch. Yes, this is made possible with cryptocurrency, the transactions are irreversible and are not controlled by a central authority (generally). However, many blockchains are also public ledgers, and you have to also figure in fiat gateways if the attackers don't just want to keep the money in cryptocurrency.

madcow2 5y ago
So some poor soul gets stuck with the hot potato down the road(Ie their funds frozen for no apparent reason when the forensics flags them). The criminals know this and will cash out immediately as much as possible. How is that a good thing?
- swensel 5y ago
  Analysis of the transactions could lead law enforcement to the attackers before they try to cash out. Centralized exchanges may also flag the attackers when they attempt to cash out. There is no guarantee they can cash out without getting caught first. It's not just that some poor new owner is left holding the bag. Addresses get blacklisted by law enforcement and the exchanges. I don't think those coins would continue to be transferred to new owners. Those potential new owners would also probably just go trade on an exchange. If there is some big discount from a local party trying to get rid of the coins, wouldn't that raise some red flag? The transactions for most cryptocurrency blockchains are viewable by all members of the public. With fiat, only the banks (or the governments) can see transactions. If I was to say there is some good thing, I would say that is a new innovation that hasn't been possible before. Cryptocurrency also does enable new illegal activities that weren't possible before, so there are definitely pros / cons, but I would say there are pros / cons to fiat as well.
  - slver 5y ago
    > With fiat, only the banks (or the governments) can see transactions. If I was to say there is some good thing, I would say that is a new innovation that hasn't been possible before. What do you mean it hasn't been possible. It's absolutely possible. We don't do it because no one wants to advertise how much money they have and who they give it to, unless compelled by a specific reason. > Cryptocurrency also does enable new illegal activities that weren't possible before, so there are definitely pros / cons, but I would say there are pros / cons to fiat as well. So the pros are things we could do (publish our private transactions), but we don't want to, and the cons are things we could do (blackmail each other), but we don't want to. Lol, great.

christophilus 5y ago

It’s more like you move to a high crime area and don’t lock your front door and then blame the break in on your wife’s diamond necklace.