3 ms·
> These cyber attacks are all but literally one bored kid and a computer. Are you sure about that? A lot of this stuff is way more than just some bored kid. Fo
by spookthesunset 5y ago
> These cyber attacks are all but literally one bored kid and a computer.
Are you sure about that? A lot of this stuff is way more than just some bored kid. For the company I work for, there is almost certainly a group of well paid people who sit around every day trying to figure out new ways run scams using our site.
When there is financial motivation, people go through great efforts to get that $$$.
"Security" isn't some catch-all box you can check. It's a non stop game of whack-a-mole where your adversary spends each day getting around whatever you put into place.
- jeffbee 5y agoRight, security is definitely not a box you can check but American business have decided that if they run Qualys to get that PCI-DSS everything is good. Nobody is out there seriously talking about the fact that the Linux kernel is written in fucking C. Well it's 2% faster than if we wrote it in an actual language with, I don't know, bounds checking, and we'd rather use the 2% for dividends, thanks very much. We need some economic and regulatory incentives here so the public endpoints of your critical oil pipeline are running applications written in safer languages on seL4 platforms with hardware roots of trust, instead of god-damned DOS. The software industry should be ten times bigger than it is, but the economic incentive has been to make it cost less, rather than to make it safer.
- midev 5y ago> run Qualys to get that PCI-DSS I feel this deeply within my soul. I think it's actually harmful, because people that don't know any better thinks a Qualys scan means something.
- throwaway3699 5y agoHow many exploits are because of the Linux kernel, and not userspace software? No kernel will protect you running public ElasticSearch with "username" and "password01" as the credentials.