15 ms·

Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for compute

Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.

Barrin92 5y ago
nope but we also demand some due diligence from private entities. When you leave the garage, the windows and the front door open with a "here's the money" sign pointing at your safe you might have a problem if someone steals your customers stuff. Company private security and protection against these attacks is more than abysmal. Just take the pipeline hack as an example. There should be no way at all that infrastructure critical to the nations security is getting shut down because of a corporate hack. If the private sector wants to earn profit from these things they need to show they're competent enough to handle it.
- tracerbulletx 5y ago
  That's fair. I'm sure there is a happy middle that can be found.
- jliptzin 5y ago
  I don’t think that’s a fair comparison. I think a fair comparison would be 80,000 companies buy the same vault door from supplier X. But suddenly one criminal group has found a universal key to the vault that no one else knows about, and can now access all 80,000 vaults nearly simultaneously and clandestinely even though they still look closed and secure from outside observers.
  - Sebb767 5y ago
    ... but this was 5 years ago and everyone and their dog knows it by now, the company just didn't bother to change that door. Also, the criminal group doesn't hit doors with cameras, but nobody bothered to install one. --- What you described is a zero day, which is very rarely used - most ransomware simply uses the absolutely low hanging fruit of companies lagging behind years in security updates combined with highly insufficient backups.
    - beermonster 5y ago
      Companies generally do not have a sufficient tested backup strategy and plan (though backups have only one part to play). Those same companies have probably never suffered any major consequences as a result - which might explain why it’s so usual for this to be a common gap. Sloppy/incomplete backups can probably wing/firefight the more common ‘single server dies’ ‘single directory needs recovering from accidental deletion on file server’ ‘need to restore database following botched upgrade’ type scenarios creating a false sense of security. In the same way companies do not have sufficient HA for their critical systems or processes. HA means being actively resistant to events impacting availability by having (typically automated) redundancy to remove SPoFs. It doesn’t mean HA owing to luck the server hasn’t died in 10 years owing to lack of/poor maintenance. But both with HA and backups companies can dodge bullets (until a real emergency) and maybe never even have a major incident. Ransomware kind of exploits this lack of organisation level sufficient backing up of all critical information assets. It really is as you say, low hanging fruit.
      - blablabla123 5y ago
        The backup thing is really weird, I think only very small non-startup companies care about them a lot because they just cannot afford not having them. In all other places when I bring up the topic everybody seems to be lightly surprised and the sense of urgency just isn't there. Personally I find this just puzzling, in my home folder I loose files at least once a year and I also lost whole partitions. So having no backup at all is no option for me at home. I cannot understand how no or unmaintained backups can be an option at companies.
  - 542354234235 5y ago
    80,000 planes use the same bolts to secure the engine pylons to the wing. It is found that the bolt can sheer in cold weather due to a casting defect. This does not cause a catastrophic failure because the aircraft are designed in such a way that an individual compromise will not bring down the entire system. Bank vault doors don’t open to the street for a reason. If your entire system is relying on the security of that one vault door, you have already failed. If you are storing sensitive data on millions of users in plaintext, you have already failed.
    - salawat 5y ago
      Even plaintext can be secure with the right other measures. Air gapped in a physically secured, access controlled location, with all egress/exit points covered by sufficiently rigorous security measures? You're fine. Encryption introduces it's own SPOF's. If you'very never had a power failure in the middle of a key rotation, you've never been bitten back by your attempt at securing everything with cryptography. Or worse, corrupted by sketchy hardware. Defense in depth, and proper threat modeling is key. There is also the very real question of "Do you really need that Internet connected anyway?"
- mlac 5y ago
  The market doesn’t incentivize security until it is too late. A pipeline operator that passes security costs onto consumers will lose to one with lower security and lower costs. Serious, significant attacks might occur at year 5, when the company becomes a big enough target to make it worthwhile to attack. By this time, the company who did not invest as heavily in security has captured the market while the one that invested in security does not have strong market share or may have gone out of business. Or they invested, but not in the right areas, or there was a new attack through a zero day. They can be extremely competent in managing oil and gas (and the physical and operational safety that comes with it), but not be competent in Cybersecurity. It’s real, hard costs today for something that may or may not happen and paying for controls that might prevent an attack. In the best case, as a customer, nothing happens. Whether improving the likelihood that nothing happen is worth a $1 or $3 per barrel premium (or if that $2 is justified) is a hazy mess and hard to make a decision around.
  - panny 5y ago
    >The market doesn’t incentivize security until it is too late. That's why you have government and law to require it. The free market solving everything is a myth, and the USA is lucky that all the pipeline hackers wanted was money. Imagine if that was a nation state trying to immobilize the military in preparation for an invasion. No ransoms, instead bombs start falling while you are paralyzed.
    - User23 5y ago
      If the goal was to disable the pipeline the attacker could just apply thermite somewhere along one of it's many unguarded miles. The reason that doesn't happen is because retribution for such an act would be striking to say the least. It's impossible to prevent all attacks, physical or cyber, so at some point one needs to either submit to an order where attackers act with impunity, or otherwise invest in retribution.
      - mschuster91 5y ago
        > If the goal was to disable the pipeline the attacker could just apply thermite somewhere along one of it's many unguarded miles. The reason that doesn't happen is because retribution for such an act would be striking to say the least. For what it's worth, a couple weeks ago someone (according to a manifesto, an anarchist group) did exactly that in Munich - they set about 50 10 kV electricity cables that were laid bare due to construction works ablaze to strike against a military supplier and cut off about 20.000 households for over 36 hours until the utility managed to restore service: https://www.br.de/nachrichten/bayern/stromausfall-in-muenchen-bekennerschreiben-aufgetaucht,SYKlDag https://www.br.de/nachrichten/bayern/stromausfall-in-muenche... Sabotage or plain old theft against utilities is pretty common, but it's hard to do something physical that truly disrupts service for longer than a day or two - the networks are designed with reliability against all kinds of issues in mind. An IT-based attack leaves no traces if done well and can have a week to month long impact, simply because back when these networks were designed, IT threats were not existing.
- Spooky23 5y ago
  The infrastructure wasn’t impacted. It was shut down because the billing system was. It’s also easy to assume that everyone is incompetent. That doesn’t make it true. Like any hostile situation, a defensive position can always be overcome, you have to have an active offense as well.
- lupire 5y ago
  If the pipeline could run without corporate, why would corporate exist?
andreilys 5y ago
If you leave your houses front door open and a giant sign that says "please come rob me" then yes you deserve some of the blame. That's the case with a lot of these companies who: a) Have pitiful/non-existent bug bounty programs (or even worst, prosecutes white hat hackers who raise issues) b) Prioritizing exec bonuses instead of investing in InfoSec
- nkozyra 5y ago
  > If you leave your houses front door open and a giant sign that says "please come rob me" Sure, but as much as we might roll our eyes at the state of corporate security, this is a disingenuous metaphor. It's neglect and incompetence. It's repeatedly forgetting to lock the door even after every neighbor has been robbed.
- ourmandave 5y ago
  I'll take Blaming the Victim for $200 Alex. (AKA: The "What was she wearing?" defense.)
hpoe 5y ago
You have a point, but I also can expect a minimum level of competance and caring about the data you have stewardship over. Sure, given enough time and motivation anyone can probably break into anything, but that isn't an excuse to let the password for the FTP server that pushes out updates be 'password123'. Here's the problem companies have absolutely no incentive to care about Security. Several years back some hackers stole a bunch of my information from Experian. You know what I got out of it, a free $10 subscription to their identity service, along with lifelong worry of wondering if someone has opened an account in my name and racked up a ton of debt that I'll be held responsible for. You know what Experian got, nothing, a slap on the wrist and now their stock is in the same place it was before. I am doing my Masters in Information Assurance and Cybersecurity right now, and the whole mindset of all of my classes is "you're going to be pwned eventually so figure out how to move the risk to some other poor sucker to take the blame when it happens." pisses me off so much. The entire industry basically uses this as an excuse to avoid responsibility and just make sure they aren't the ones held responsible when the manure hits the rotary oscillator, and that bugs me to no end. At the end of the day there are real people who are getting screwed and hurt by this, while the execs and security "consultants" spend their time trying to figure out how to make sure that when sh* hits the fan they can't be sued, and d** the customer and their well-being we've got to figure out how to make sure we keep the law away. EDIT: Clarity and formatting
- andreilys 5y ago
  The concept of Moral Hazard is important here, which basically states that there is a lack of incentive to guard against risk where one is protected from its consequences. In a lot of cases the execs of these companies will continue to collect a large bonus, despite the fact that they utterly failed their customers.
  - hellbannedguy 5y ago
    Tieing the CEO pay to attacks should be as common as Poison pills, Golden Parachutes, and Stock incentives. Backups, and strict security, might be important? Put security right up their as important as their rediculious salaries.
joe_the_user 5y ago
I'm a bit tired of the victim blaming with security. The victims of these breaches are the end users. Companies are the beneficiaries of not having to pay for and especially not having to inconvenience themselves with much more secure systems. That said, it's true you can't ask for 100% security. You can instead set standards. You can especially set standards of security for any enterprise that the public dependents on. Since, there are no coherent standards now, just liability isn't useful. And the standards should involve actual topology, what kinds of information is allowed in and out at all.
- xupybd 5y ago
  You have to enforce standards. Good security is expensive. If companies in competition don't have to pay for good security those that do have it will have higher costs and have trouble competing.
  - fsckboy 5y ago
    > "running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing" running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing
    - deleted 5y ago
      [deleted]
    - toomuchtodo 5y ago
      Texas? Winterization that wasn’t done and wasn’t required, and thereby those generators who didn’t had a more competitive edge? The similarities write themselves.
      - xupybd 5y ago
        Thanks, that explains it.
dylan604 5y ago
It's not any different than the war on drugs. The gov't can't really think in a different manner than just black and white. The world is made up of shades of gray, and it's just too difficult to create legislation to handle shades of gray.
- deleted 5y ago
  [deleted]
User23 5y ago
> It's physically impossible to build a house that can't be broken in to Obviously you're correct because impossible is a tall order, but it's possible to get close assuming the aspiring intruders don't have dynamite or artillery[1]. [1] https://en.wikipedia.org/wiki/Bastle_house https://en.wikipedia.org/wiki/Bastle_house
SilverRed 5y ago
> and even harder for computer systems Things are actually getting better in some ways. Modern OSs with automatic updates are more secure than OSs have ever been. The days where clicking a link on an email or plugging in a USB could infect your computer are almost gone outside of rare zerodays which get patched for everyone pretty quick. Things are getting even better with hypervisors, SELinux and secure languages rolling in. Significant portions of Android and in the future linux, will and are being rewritten in rust which wipes out entire classes of the worst bugs we are being faced with. The problem is that the attackers are also getting more sophisticated and the targets are becoming more valuable with more and more getting put online.
- jtsiskin 5y ago
  Yes, but then you read things like https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html https://googleprojectzero.blogspot.com/2021/01/introducing-i..., or look at the payments offered by https://zerodium.com/program.html… https://zerodium.com/program.html… the days of clicking a link -> persistence payload with escalated privileges are still here
  - SilverRed 5y ago
    From what I see on that page. It costs $500,000 to exploit chrome and your attack only lasts for a few days and then google pushes out a fix to all chrome users. This is so much better than the IE era where a teenager with some free time and skill could make something up and there would still be exploitable machines years later for the same bug.
    - beermonster 5y ago
      And yet have you seen how many zero day, patch now, actively explored in wild vulnerabilities there have been in Chrome just this year? It doesn’t feel like even Google are winning
harikb 5y ago
We have to think of this similar to how any other human or company behavior is monitored. Hold companies responsible and have a market sell ransomware insurance. (One exception to my solution is poor government and public institutions who run awful software. Not sure what we can do) If I have a habit of burning down my house by being sloppy with safety, my rates will go up. There should be something similar Let us take the case with Equifax mismanaging their servers, with running obsolete Java packages resulting in identity theft for millions of Americans. Credit score is controlled by 3 companies. Credit score determines mortgage rate and hence it literally controls if a US resident can afford to buy a house or get a job (in some states). Don’t the companies need to take some responsibility? Similarly dozens of companies leaving Elastic search installs and MySQL open to the internet. I mean.. how sloppy can one get? Fine, be sloppy, just pay $$$$$ to your insurance company. That $$ amount will indirectly decide whether we go to war with Russia or pay software engineers.
- wellthisisgreat 5y ago
  > That $$ amount will indirectly decide whether we go to war with Russia or pay software engineers. Not related to the subject, but wow I wonder how alarming it is that "war with Russia" meme is having a strong comeback, as it's being casually brought up in online discussions about software.
  - harikb 5y ago
    I was being sarcastic in this instance. Meant to say there is more to do within software before blaming “user”/“hacker”. Russia reference is only based on recent news/claims
  - rejectedandsad 5y ago
    If that's what it takes to defend our sovereignty, it's what it takes. They elected one of ours, we can unelect one of theirs.
hunter2_ 5y ago
Oddly enough though, the analogy tends to diverge when scaled: the more material you put into your house, the less vulnerable it is; the more lines of code you put into your software, the more vulnerable it is. Taken to an extreme, anyone can take down a house made of straw with their fist, but nobody can exploit hello world. I despise seeing simple apps with ridiculous dependency trees (package.json with line counts in the 5-6 figures, for example) and other complexity that can't possibly be fully understood by whoever's responsible for operating it. But I suppose things would be in even worse shape if we reinvented the wheel instead of using well-known libraries and so forth.
- mewpmewp2 5y ago
  Surely you mean lock files not package jsons?
  - hunter2_ 5y ago
    Oops, that's the big one. Maybe it's fine for that to be inhumanely large, as merely an artifact? Bad example then, but the point stands.
    - ehnto 5y ago
      Well the package.json only specifies the top level dependencies not all of the dependencies in the tree. So the .lock is probably a better representation of the actual dependency tree. It's not uncommon to include one library and get an extra 10, 20+ dependencies you don't even know about unless you care enough to check.
  - motoxpro 5y ago
    Haha I would hope so. A 5-6 figure package.json would be insane!
- tluyben2 5y ago
  If you do not audit and are not willing, in case of emergency, to take over support of your dependencies, you are creating a mine field. Most people do not understand what this even means though. Solid libraries are boring and done: old, stable and active bug fix support. Not new features weekly. Java or .net vs the js ecosystem. In our client contracts we have responsibility for our deliveries; in .net and Java we use well supported libs of over a decade old which we can support ourselves if the maintainers quit. With js this is an issue. Things are generally just not set up for decades of runtime and yet, there we are: we now have node js projects of almost 10 years old with many libs we have to audit and support ourselves and they are not very good quality. I think modern web is only just seeing the tip of the iceberg security wise. It will get much worse.
tw04 5y ago
> It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Which is exactly why you don’t store your savings in your sock drawer, you put it in the bank. Companies not taking appropriate backups is akin to keeping all of your money in a dish by the front door. Sure your house may never get broken into but nobody is going to have sympathy for you if it does.
- benjohnson 5y ago
  Backups are no longer sufficient - as the hackers now threaten to disclose stolen data to the public.
  - tw04 5y ago
    Which only works because they’re paying the ransom. The second the government introduces criminal penalties against the executives and boards for paying ransom, it will stop.
    - onion2k 5y ago
      Which only works because they’re paying the ransom. The second the government introduces criminal penalties against the executives and boards for paying ransom, it will stop. Making it a criminal offence to pay a ransom would eventually stop criminals ransoming the data they take to the company they took it from, but it wouldn't stop attacks and data breaches if there's some other way to profit. For example, attackers could sell the databases they steal. Or they could ransom individual's data directly to the individual. Or they short the stock of the company and then release the stolen database publicly to make the share price fall. It's important not to over-simplify the problem. There is no single, simple solution as long as there are many ways to profit from data thefts.
      - tw04 5y ago
        >Or they could ransom individual's data directly to the individual. Or they short the stock of the company and then release the stolen database publicly to make the share price fall. You're listing a bunch of things that are almost assuredly already happening. If a company was dumb enough to keep social security numbers unencrypted in a database or spreadsheet, that data is going onto the dark web whether they paid a ransom or not. It's a LOT harder to find a buyer of proprietary data that will likely put the buyer in prison for a long time, than it is to get a ransom from one individual trying to keep the whole thing quiet. Once you advertise "I have Apple's top secret next gen laptop details!!" - when someone releases a strikingly similar laptop, or "leaks" the details on an Apple focused fansite, the feds will be all over them.
kragen 5y ago
It's surprising and disappointing to see this point of view here, particularly with so little evident dissent. Of course you can "break into" a typical computer system by gaining physical access to it, for example by breaking into the house that it's in and unscrewing the computer's case; but that's only metaphorically connected to what's going on here, which is that criminals are sending data over the internet to the computer systems in question. The software the owners previously installed on those systems then responds to that data by giving the criminals complete control over the system, as long as they care to maintain it, or unless the system is destroyed. This is dumb. Writing software that does not behave in this fashion is not only physically possible; it's actually the majority of software. Even in typical software, there is only one deployed exploitable security hole per thousand lines of code or so, and, until only about 25 years ago, it was reliably possible to recover from such an invasion by reinstalling the OS.† The best software, like seL4 or qmail, has orders of magnitude less, though we can quibble about whether the actual number is 0 bugs or 1 bug.‡ The problem is that our systems are architected so that even one exploitable bug anywhere in hundreds of millions of lines of code enables total and irreversible subversion of the system; our system complexity is growing much faster than existing code is getting audited and fixed; much of the code is not even open to auditing; and the people with the power to fix it have no incentive to do so, instead spreading pernicious misinformation claiming that usability and security are unavoidably in conflict (a concept obviously absurd to anyone who has had to use an OS without memory protection) and bulletproof security is impossible anyway. So, at any given time, there are somewhere between thousands and hundreds of thousands of exploitable vulnerabilities in our systems, any one of which is sufficient to enable the implantation of a persistent backdoor that cannot be reliably detected or removed. The solution to this has been known since the 01970s. At the systems design level, minimize the complexity of the trusted computing base (the hardware and software whose integrity every program in the system relies on) in complexity, audit it rigorously, and freeze it. At the hardware level, provide an easy incorruptible way to restore a known safe state. At the social level, ensure that the people who rely on the integrity of the computer system have the authority to audit it and fix any problems they find, and the technical competence either to do this themselves or to delegate these tasks to people who are competent to do it, rather than to charlatans. At the user-interface design level, ensure that users can understand the information they need to assess the risks they are taking in relying on any given piece of information, and decouple the system to eliminate their incentives to take risks, for example with memory protection and petnames. We know a lot more about how to achieve these things than we did 45 years ago, and in some ways we have enormously more resources. We have seL4, Bitcoin, ssh, Monte, elliptic-curve cryptography, BLAKE3, NaCl, LUKS, decades of SOUPS proceedings, RISC-V, yosys, and 16-MIPS microcontrollers§ that cost 3¢. But that future is not merely "not widely distributed"—it has become inaccessible except in isolated cases like Trezor, as economic incentives have driven our hardware and software down a path of boundlessly ballooning complexity and diminishing alternatives, while proprietary software licensing eliminates any possibility of assessing and controlling the risks. Meanwhile, the shallow pop culture of computing reduced users from creators to mere customers, and then "eyeballs", while conflating hacking—the only way out of this mess—with computer invasion. So, I fully expect that if I live long enough to need a pacemaker, I won't be allowed to secure it against ransomware, which will be rampant at that point. It doesn't have to be this way. This can all be made better. Ready? Begin. ______ † In fact, shortly before that, on most PCs you could recover from any kind of system corruption just by taking the floppy disk out, resetting the system, and inserting a new, uncorrupted floppy disk. Better hope that one's not stoned too... ‡ You might argue that the possibility that there's an undetected security bug in seL4 means that complete computer security, even against carefully crafted data sent over the internet rather than some dude running off with your cellphone while it's unlocked, is still impossible. But in fact I think there's a very real difference in kind between the possibility that I might currently have presymptomatic covid, and the certainty that I have a small amount of covid. Systems like qmail are analogous to the first case, because they might be secure or might contain an undiagnosed flaw; systems like Linux and Chrome are analogous to the second case, because they are certain to contain a small but fatal fraction of flaws, which are inexorably multiplying. § Unfortunately the whole line of Padauk microcontrollers is out of stock this week at LCSC.
colechristensen 5y ago
I have seen personally, heard first hand accounts, and read many a post-mortem for situations where the primary blame really should be on the "victim". There's another word for this: Negligence. Of course there are always 0days. There are always sophisticated attacks. There is always human error. Then there are people in leadership positions being given accurate information about basic security problems and possible outcomes over long periods of time flatly refusing to make security a priority or spend any time fixing dangerous situations. Many of these ransom situations aren't the result of targeted attacks, but "hey we have this exploit and ransom kit, let's scan the entire Internet and see if we get anything". Or the ever popular (ok maybe not so much any more) unsecured elasticsearch server on the public internet. I'm sorry but if you put your production data on a public IP on a standard port with zero security, it is positively your fault when your data gets stolen. (not much to do with ransom, but an example). There is a difference between being the victim of a sophisticated attack and being the victim of your own negligence (and a lot of grey area in between).
- BrandoElFollito 5y ago
  And a lot of cases where around the table you have those who say "here is the risk that must be addressed" and then the others who say "if we do that we break production". Both are truthful and full of good will.
  - tremon 5y ago
    "Ok, that means our current business practices are a liability. Gather the process owners to see what can be done". What you're describing isn't (shouldn't be) the end of discussion. The trick is to get management to explicitly acknowledge the liabilities.
  - ClumsyPilot 5y ago
    "Here is the risk that 737 max will crash because of mcas" And then others say: " if we do that, we will have to redesign too much of the airligher" i.em break production. Youve got to have your priorities straight
tluyben2 5y ago
Crime needs to be dealt with but a lot of companies I worked with in the past 30 years are simply negligent. If you do not blame the victim, what is the incentive for spending money on even basic security? Not morality surely, so...
im3w1l 5y ago
You have a lot of replies but as far as I can see no one made this point, so let me add yet another reply. Victim blaming is a framing that makes it sound like it's about moral and ethics. But it's about practicality. There is a causal chain leading to a bad outcome and we simply break the weakest link. Sometimes it's easier to lock up the treasure and sometimes it's easier to lock up all the thieves. Consider the case of computer security. Locking up all the thieves is super duper hard, because they are located in places like Russia and China that wont cooperate with law enforcement.
- bostik 5y ago
  > Locking up all the thieves is super duper hard, because they are located in places like Russia and China that wont cooperate with law enforcement. Oh, they do. With their local ones. Those thieves can operate with impunity as long as they don't hit their fellow countrymen.
WalterBright 5y ago
It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that from bringing it all down?" In other words, think in terms of redundancy and isolation between systems. And the largest piece of hubris and madness in critical systems is allowing over-the-internet updates.
- passwordqwe 5y ago
  But there is a big difference between airline safety and software safety. An airliner survives against the environment, it's PvE, a software system has to survive against hackers, it's PvP. If you shoot a rocket at an airliner, the airliner will fail, in that case we blame the person who shot the rocket.
  - jjk166 5y ago
    We design military aircraft to fly into warzones. They are very much PvP. We design them with various countermeasures to deal with rockets and ejector seats if those fail. Yeah, planes will be shot down and pilots may die despite these precautions, but skimping on the ejector seat because "hey they might die anyways" is totally unacceptable.
  - boc 5y ago
    This is a great way to frame the issue.
  - WalterBright 5y ago
    > But there is a big difference between airline safety and software safety I've worked professionally in both industries; they are not fundamentally different. Software practices can learn a lot from aviation practice, but they seem determined to spend decades rediscovering the methods the bitter, expensive way. For example, software is still stuck in the dark ages where the idea is better training / better programmers / more punishment will prevent these sorts of failures.
perryizgr8 5y ago
> It's physically impossible to build a house that can't be broken in to Specially if an entity with a nation's resources is trying to get in.
mschuster91 5y ago
> I'm a bit tired of the victim blaming with security. Why? Many of the companies who got hacked had massive IT issues of their own fault, the most common being: - full access for everything across the whole network, no subnetting with strict firewalls that limits the scope of an intrusion - outdated software/firmware stacks leading to avenues for compromise - no/ineffective/outdated virus scanners - no meaningful backup infrastructure and regular testing if said infrastructure is already working - lack of 2FA on administrative credentials - lack of monitoring on central file servers to detect if a compromised machine is encrypting the file server's contents piece by piece > It's physically impossible to build a house that can't be broken in to Indeed, but a burglary insurance will likely refuse service or jack up rates if you don't lock your door or not have an alarm system installed.
blueblisters 5y ago
Crime is a social problem but the US government is especially bad at fixing crime that originates from other countries. See war on drugs, terrorism, call center scams etc. On the other hand, a good team of security experts is very good at preventing computer systems from getting hacked into.
- clarkevans 5y ago
  The problem with drug cartels does not originate from other countries. It is domestic demand, paying in dollars. Those dollars overwhelm local economies and police forces abroad.
mcguire 5y ago
On the other hand, we have known since the 1970s roughly how to make computer systems significantly more secure and resilient. However, we, as a society, have decided that it's costly and difficult and that we would prefer not to do anything about it. It's "move fast and break things" at the social level. I really, really hate reasoning by metaphor, but you do lock your doors, right?

Barrin92 5y ago

nope but we also demand some due diligence from private entities. When you leave the garage, the windows and the front door open with a "here's the money" sign pointing at your safe you might have a problem if someone steals your customers stuff. Company private security and protection against these attacks is more than abysmal. Just take the pipeline hack as an example. There should be no way at all that infrastructure critical to the nations security is getting shut down because of a corporate hack. If the private sector wants to earn profit from these things they need to show they're competent enough to handle it.

tracerbulletx 5y ago
That's fair. I'm sure there is a happy middle that can be found.
jliptzin 5y ago
I don’t think that’s a fair comparison. I think a fair comparison would be 80,000 companies buy the same vault door from supplier X. But suddenly one criminal group has found a universal key to the vault that no one else knows about, and can now access all 80,000 vaults nearly simultaneously and clandestinely even though they still look closed and secure from outside observers.
- Sebb767 5y ago
  ... but this was 5 years ago and everyone and their dog knows it by now, the company just didn't bother to change that door. Also, the criminal group doesn't hit doors with cameras, but nobody bothered to install one. --- What you described is a zero day, which is very rarely used - most ransomware simply uses the absolutely low hanging fruit of companies lagging behind years in security updates combined with highly insufficient backups.
  - beermonster 5y ago
    Companies generally do not have a sufficient tested backup strategy and plan (though backups have only one part to play). Those same companies have probably never suffered any major consequences as a result - which might explain why it’s so usual for this to be a common gap. Sloppy/incomplete backups can probably wing/firefight the more common ‘single server dies’ ‘single directory needs recovering from accidental deletion on file server’ ‘need to restore database following botched upgrade’ type scenarios creating a false sense of security. In the same way companies do not have sufficient HA for their critical systems or processes. HA means being actively resistant to events impacting availability by having (typically automated) redundancy to remove SPoFs. It doesn’t mean HA owing to luck the server hasn’t died in 10 years owing to lack of/poor maintenance. But both with HA and backups companies can dodge bullets (until a real emergency) and maybe never even have a major incident. Ransomware kind of exploits this lack of organisation level sufficient backing up of all critical information assets. It really is as you say, low hanging fruit.
    - blablabla123 5y ago
      The backup thing is really weird, I think only very small non-startup companies care about them a lot because they just cannot afford not having them. In all other places when I bring up the topic everybody seems to be lightly surprised and the sense of urgency just isn't there. Personally I find this just puzzling, in my home folder I loose files at least once a year and I also lost whole partitions. So having no backup at all is no option for me at home. I cannot understand how no or unmaintained backups can be an option at companies.
- 542354234235 5y ago
  80,000 planes use the same bolts to secure the engine pylons to the wing. It is found that the bolt can sheer in cold weather due to a casting defect. This does not cause a catastrophic failure because the aircraft are designed in such a way that an individual compromise will not bring down the entire system. Bank vault doors don’t open to the street for a reason. If your entire system is relying on the security of that one vault door, you have already failed. If you are storing sensitive data on millions of users in plaintext, you have already failed.
  - salawat 5y ago
    Even plaintext can be secure with the right other measures. Air gapped in a physically secured, access controlled location, with all egress/exit points covered by sufficiently rigorous security measures? You're fine. Encryption introduces it's own SPOF's. If you'very never had a power failure in the middle of a key rotation, you've never been bitten back by your attempt at securing everything with cryptography. Or worse, corrupted by sketchy hardware. Defense in depth, and proper threat modeling is key. There is also the very real question of "Do you really need that Internet connected anyway?"
mlac 5y ago
The market doesn’t incentivize security until it is too late. A pipeline operator that passes security costs onto consumers will lose to one with lower security and lower costs. Serious, significant attacks might occur at year 5, when the company becomes a big enough target to make it worthwhile to attack. By this time, the company who did not invest as heavily in security has captured the market while the one that invested in security does not have strong market share or may have gone out of business. Or they invested, but not in the right areas, or there was a new attack through a zero day. They can be extremely competent in managing oil and gas (and the physical and operational safety that comes with it), but not be competent in Cybersecurity. It’s real, hard costs today for something that may or may not happen and paying for controls that might prevent an attack. In the best case, as a customer, nothing happens. Whether improving the likelihood that nothing happen is worth a $1 or $3 per barrel premium (or if that $2 is justified) is a hazy mess and hard to make a decision around.
- panny 5y ago
  >The market doesn’t incentivize security until it is too late. That's why you have government and law to require it. The free market solving everything is a myth, and the USA is lucky that all the pipeline hackers wanted was money. Imagine if that was a nation state trying to immobilize the military in preparation for an invasion. No ransoms, instead bombs start falling while you are paralyzed.
  - User23 5y ago
    If the goal was to disable the pipeline the attacker could just apply thermite somewhere along one of it's many unguarded miles. The reason that doesn't happen is because retribution for such an act would be striking to say the least. It's impossible to prevent all attacks, physical or cyber, so at some point one needs to either submit to an order where attackers act with impunity, or otherwise invest in retribution.
    - mschuster91 5y ago
      > If the goal was to disable the pipeline the attacker could just apply thermite somewhere along one of it's many unguarded miles. The reason that doesn't happen is because retribution for such an act would be striking to say the least. For what it's worth, a couple weeks ago someone (according to a manifesto, an anarchist group) did exactly that in Munich - they set about 50 10 kV electricity cables that were laid bare due to construction works ablaze to strike against a military supplier and cut off about 20.000 households for over 36 hours until the utility managed to restore service: https://www.br.de/nachrichten/bayern/stromausfall-in-muenchen-bekennerschreiben-aufgetaucht,SYKlDag https://www.br.de/nachrichten/bayern/stromausfall-in-muenche... Sabotage or plain old theft against utilities is pretty common, but it's hard to do something physical that truly disrupts service for longer than a day or two - the networks are designed with reliability against all kinds of issues in mind. An IT-based attack leaves no traces if done well and can have a week to month long impact, simply because back when these networks were designed, IT threats were not existing.
Spooky23 5y ago
The infrastructure wasn’t impacted. It was shut down because the billing system was. It’s also easy to assume that everyone is incompetent. That doesn’t make it true. Like any hostile situation, a defensive position can always be overcome, you have to have an active offense as well.
lupire 5y ago
If the pipeline could run without corporate, why would corporate exist?

andreilys 5y ago

If you leave your houses front door open and a giant sign that says "please come rob me" then yes you deserve some of the blame. That's the case with a lot of these companies who: a) Have pitiful/non-existent bug bounty programs (or even worst, prosecutes white hat hackers who raise issues) b) Prioritizing exec bonuses instead of investing in InfoSec

nkozyra 5y ago
> If you leave your houses front door open and a giant sign that says "please come rob me" Sure, but as much as we might roll our eyes at the state of corporate security, this is a disingenuous metaphor. It's neglect and incompetence. It's repeatedly forgetting to lock the door even after every neighbor has been robbed.
ourmandave 5y ago
I'll take Blaming the Victim for $200 Alex. (AKA: The "What was she wearing?" defense.)

hpoe 5y ago

You have a point, but I also can expect a minimum level of competance and caring about the data you have stewardship over. Sure, given enough time and motivation anyone can probably break into anything, but that isn't an excuse to let the password for the FTP server that pushes out updates be 'password123'. Here's the problem companies have absolutely no incentive to care about Security. Several years back some hackers stole a bunch of my information from Experian. You know what I got out of it, a free $10 subscription to their identity service, along with lifelong worry of wondering if someone has opened an account in my name and racked up a ton of debt that I'll be held responsible for. You know what Experian got, nothing, a slap on the wrist and now their stock is in the same place it was before. I am doing my Masters in Information Assurance and Cybersecurity right now, and the whole mindset of all of my classes is "you're going to be pwned eventually so figure out how to move the risk to some other poor sucker to take the blame when it happens." pisses me off so much. The entire industry basically uses this as an excuse to avoid responsibility and just make sure they aren't the ones held responsible when the manure hits the rotary oscillator, and that bugs me to no end. At the end of the day there are real people who are getting screwed and hurt by this, while the execs and security "consultants" spend their time trying to figure out how to make sure that when sh* hits the fan they can't be sued, and d** the customer and their well-being we've got to figure out how to make sure we keep the law away. EDIT: Clarity and formatting

andreilys 5y ago
The concept of Moral Hazard is important here, which basically states that there is a lack of incentive to guard against risk where one is protected from its consequences. In a lot of cases the execs of these companies will continue to collect a large bonus, despite the fact that they utterly failed their customers.
- hellbannedguy 5y ago
  Tieing the CEO pay to attacks should be as common as Poison pills, Golden Parachutes, and Stock incentives. Backups, and strict security, might be important? Put security right up their as important as their rediculious salaries.

joe_the_user 5y ago

I'm a bit tired of the victim blaming with security. The victims of these breaches are the end users. Companies are the beneficiaries of not having to pay for and especially not having to inconvenience themselves with much more secure systems. That said, it's true you can't ask for 100% security. You can instead set standards. You can especially set standards of security for any enterprise that the public dependents on. Since, there are no coherent standards now, just liability isn't useful. And the standards should involve actual topology, what kinds of information is allowed in and out at all.

xupybd 5y ago
You have to enforce standards. Good security is expensive. If companies in competition don't have to pay for good security those that do have it will have higher costs and have trouble competing.
- fsckboy 5y ago
  > "running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing" running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing
  - deleted 5y ago
    [deleted]
  - toomuchtodo 5y ago
    Texas? Winterization that wasn’t done and wasn’t required, and thereby those generators who didn’t had a more competitive edge? The similarities write themselves.
    - xupybd 5y ago
      Thanks, that explains it.

dylan604 5y ago

It's not any different than the war on drugs. The gov't can't really think in a different manner than just black and white. The world is made up of shades of gray, and it's just too difficult to create legislation to handle shades of gray.

deleted 5y ago
[deleted]

User23 5y ago

> It's physically impossible to build a house that can't be broken in to Obviously you're correct because impossible is a tall order, but it's possible to get close assuming the aspiring intruders don't have dynamite or artillery[1]. [1] https://en.wikipedia.org/wiki/Bastle_house https://en.wikipedia.org/wiki/Bastle_house

SilverRed 5y ago

> and even harder for computer systems Things are actually getting better in some ways. Modern OSs with automatic updates are more secure than OSs have ever been. The days where clicking a link on an email or plugging in a USB could infect your computer are almost gone outside of rare zerodays which get patched for everyone pretty quick. Things are getting even better with hypervisors, SELinux and secure languages rolling in. Significant portions of Android and in the future linux, will and are being rewritten in rust which wipes out entire classes of the worst bugs we are being faced with. The problem is that the attackers are also getting more sophisticated and the targets are becoming more valuable with more and more getting put online.

jtsiskin 5y ago
Yes, but then you read things like https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html https://googleprojectzero.blogspot.com/2021/01/introducing-i..., or look at the payments offered by https://zerodium.com/program.html… https://zerodium.com/program.html… the days of clicking a link -> persistence payload with escalated privileges are still here
- SilverRed 5y ago
  From what I see on that page. It costs $500,000 to exploit chrome and your attack only lasts for a few days and then google pushes out a fix to all chrome users. This is so much better than the IE era where a teenager with some free time and skill could make something up and there would still be exploitable machines years later for the same bug.
  - beermonster 5y ago
    And yet have you seen how many zero day, patch now, actively explored in wild vulnerabilities there have been in Chrome just this year? It doesn’t feel like even Google are winning

harikb 5y ago

We have to think of this similar to how any other human or company behavior is monitored. Hold companies responsible and have a market sell ransomware insurance. (One exception to my solution is poor government and public institutions who run awful software. Not sure what we can do) If I have a habit of burning down my house by being sloppy with safety, my rates will go up. There should be something similar Let us take the case with Equifax mismanaging their servers, with running obsolete Java packages resulting in identity theft for millions of Americans. Credit score is controlled by 3 companies. Credit score determines mortgage rate and hence it literally controls if a US resident can afford to buy a house or get a job (in some states). Don’t the companies need to take some responsibility? Similarly dozens of companies leaving Elastic search installs and MySQL open to the internet. I mean.. how sloppy can one get? Fine, be sloppy, just pay $$$$$ to your insurance company. That $$ amount will indirectly decide whether we go to war with Russia or pay software engineers.

wellthisisgreat 5y ago
> That $$ amount will indirectly decide whether we go to war with Russia or pay software engineers. Not related to the subject, but wow I wonder how alarming it is that "war with Russia" meme is having a strong comeback, as it's being casually brought up in online discussions about software.
- harikb 5y ago
  I was being sarcastic in this instance. Meant to say there is more to do within software before blaming “user”/“hacker”. Russia reference is only based on recent news/claims
- rejectedandsad 5y ago
  If that's what it takes to defend our sovereignty, it's what it takes. They elected one of ours, we can unelect one of theirs.

hunter2_ 5y ago

Oddly enough though, the analogy tends to diverge when scaled: the more material you put into your house, the less vulnerable it is; the more lines of code you put into your software, the more vulnerable it is. Taken to an extreme, anyone can take down a house made of straw with their fist, but nobody can exploit hello world. I despise seeing simple apps with ridiculous dependency trees (package.json with line counts in the 5-6 figures, for example) and other complexity that can't possibly be fully understood by whoever's responsible for operating it. But I suppose things would be in even worse shape if we reinvented the wheel instead of using well-known libraries and so forth.

mewpmewp2 5y ago
Surely you mean lock files not package jsons?
- hunter2_ 5y ago
  Oops, that's the big one. Maybe it's fine for that to be inhumanely large, as merely an artifact? Bad example then, but the point stands.
  - ehnto 5y ago
    Well the package.json only specifies the top level dependencies not all of the dependencies in the tree. So the .lock is probably a better representation of the actual dependency tree. It's not uncommon to include one library and get an extra 10, 20+ dependencies you don't even know about unless you care enough to check.
- motoxpro 5y ago
  Haha I would hope so. A 5-6 figure package.json would be insane!
tluyben2 5y ago
If you do not audit and are not willing, in case of emergency, to take over support of your dependencies, you are creating a mine field. Most people do not understand what this even means though. Solid libraries are boring and done: old, stable and active bug fix support. Not new features weekly. Java or .net vs the js ecosystem. In our client contracts we have responsibility for our deliveries; in .net and Java we use well supported libs of over a decade old which we can support ourselves if the maintainers quit. With js this is an issue. Things are generally just not set up for decades of runtime and yet, there we are: we now have node js projects of almost 10 years old with many libs we have to audit and support ourselves and they are not very good quality. I think modern web is only just seeing the tip of the iceberg security wise. It will get much worse.

tw04 5y ago

> It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Which is exactly why you don’t store your savings in your sock drawer, you put it in the bank. Companies not taking appropriate backups is akin to keeping all of your money in a dish by the front door. Sure your house may never get broken into but nobody is going to have sympathy for you if it does.

benjohnson 5y ago
Backups are no longer sufficient - as the hackers now threaten to disclose stolen data to the public.
- tw04 5y ago
  Which only works because they’re paying the ransom. The second the government introduces criminal penalties against the executives and boards for paying ransom, it will stop.
  - onion2k 5y ago
    Which only works because they’re paying the ransom. The second the government introduces criminal penalties against the executives and boards for paying ransom, it will stop. Making it a criminal offence to pay a ransom would eventually stop criminals ransoming the data they take to the company they took it from, but it wouldn't stop attacks and data breaches if there's some other way to profit. For example, attackers could sell the databases they steal. Or they could ransom individual's data directly to the individual. Or they short the stock of the company and then release the stolen database publicly to make the share price fall. It's important not to over-simplify the problem. There is no single, simple solution as long as there are many ways to profit from data thefts.
    - tw04 5y ago
      >Or they could ransom individual's data directly to the individual. Or they short the stock of the company and then release the stolen database publicly to make the share price fall. You're listing a bunch of things that are almost assuredly already happening. If a company was dumb enough to keep social security numbers unencrypted in a database or spreadsheet, that data is going onto the dark web whether they paid a ransom or not. It's a LOT harder to find a buyer of proprietary data that will likely put the buyer in prison for a long time, than it is to get a ransom from one individual trying to keep the whole thing quiet. Once you advertise "I have Apple's top secret next gen laptop details!!" - when someone releases a strikingly similar laptop, or "leaks" the details on an Apple focused fansite, the feds will be all over them.

kragen 5y ago

It's surprising and disappointing to see this point of view here, particularly with so little evident dissent. Of course you can "break into" a typical computer system by gaining physical access to it, for example by breaking into the house that it's in and unscrewing the computer's case; but that's only metaphorically connected to what's going on here, which is that criminals are sending data over the internet to the computer systems in question. The software the owners previously installed on those systems then responds to that data by giving the criminals complete control over the system, as long as they care to maintain it, or unless the system is destroyed. This is dumb. Writing software that does not behave in this fashion is not only physically possible; it's actually the majority of software. Even in typical software, there is only one deployed exploitable security hole per thousand lines of code or so, and, until only about 25 years ago, it was reliably possible to recover from such an invasion by reinstalling the OS.† The best software, like seL4 or qmail, has orders of magnitude less, though we can quibble about whether the actual number is 0 bugs or 1 bug.‡ The problem is that our systems are architected so that even one exploitable bug anywhere in hundreds of millions of lines of code enables total and irreversible subversion of the system; our system complexity is growing much faster than existing code is getting audited and fixed; much of the code is not even open to auditing; and the people with the power to fix it have no incentive to do so, instead spreading pernicious misinformation claiming that usability and security are unavoidably in conflict (a concept obviously absurd to anyone who has had to use an OS without memory protection) and bulletproof security is impossible anyway. So, at any given time, there are somewhere between thousands and hundreds of thousands of exploitable vulnerabilities in our systems, any one of which is sufficient to enable the implantation of a persistent backdoor that cannot be reliably detected or removed. The solution to this has been known since the 01970s. At the systems design level, minimize the complexity of the trusted computing base (the hardware and software whose integrity every program in the system relies on) in complexity, audit it rigorously, and freeze it. At the hardware level, provide an easy incorruptible way to restore a known safe state. At the social level, ensure that the people who rely on the integrity of the computer system have the authority to audit it and fix any problems they find, and the technical competence either to do this themselves or to delegate these tasks to people who are competent to do it, rather than to charlatans. At the user-interface design level, ensure that users can understand the information they need to assess the risks they are taking in relying on any given piece of information, and decouple the system to eliminate their incentives to take risks, for example with memory protection and petnames. We know a lot more about how to achieve these things than we did 45 years ago, and in some ways we have enormously more resources. We have seL4, Bitcoin, ssh, Monte, elliptic-curve cryptography, BLAKE3, NaCl, LUKS, decades of SOUPS proceedings, RISC-V, yosys, and 16-MIPS microcontrollers§ that cost 3¢. But that future is not merely "not widely distributed"—it has become inaccessible except in isolated cases like Trezor, as economic incentives have driven our hardware and software down a path of boundlessly ballooning complexity and diminishing alternatives, while proprietary software licensing eliminates any possibility of assessing and controlling the risks. Meanwhile, the shallow pop culture of computing reduced users from creators to mere customers, and then "eyeballs", while conflating hacking—the only way out of this mess—with computer invasion. So, I fully expect that if I live long enough to need a pacemaker, I won't be allowed to secure it against ransomware, which will be rampant at that point. It doesn't have to be this way. This can all be made better. Ready? Begin. ______ † In fact, shortly before that, on most PCs you could recover from any kind of system corruption just by taking the floppy disk out, resetting the system, and inserting a new, uncorrupted floppy disk. Better hope that one's not stoned too... ‡ You might argue that the possibility that there's an undetected security bug in seL4 means that complete computer security, even against carefully crafted data sent over the internet rather than some dude running off with your cellphone while it's unlocked, is still impossible. But in fact I think there's a very real difference in kind between the possibility that I might currently have presymptomatic covid, and the certainty that I have a small amount of covid. Systems like qmail are analogous to the first case, because they might be secure or might contain an undiagnosed flaw; systems like Linux and Chrome are analogous to the second case, because they are certain to contain a small but fatal fraction of flaws, which are inexorably multiplying. § Unfortunately the whole line of Padauk microcontrollers is out of stock this week at LCSC.

colechristensen 5y ago

I have seen personally, heard first hand accounts, and read many a post-mortem for situations where the primary blame really should be on the "victim". There's another word for this: Negligence. Of course there are always 0days. There are always sophisticated attacks. There is always human error. Then there are people in leadership positions being given accurate information about basic security problems and possible outcomes over long periods of time flatly refusing to make security a priority or spend any time fixing dangerous situations. Many of these ransom situations aren't the result of targeted attacks, but "hey we have this exploit and ransom kit, let's scan the entire Internet and see if we get anything". Or the ever popular (ok maybe not so much any more) unsecured elasticsearch server on the public internet. I'm sorry but if you put your production data on a public IP on a standard port with zero security, it is positively your fault when your data gets stolen. (not much to do with ransom, but an example). There is a difference between being the victim of a sophisticated attack and being the victim of your own negligence (and a lot of grey area in between).

BrandoElFollito 5y ago
And a lot of cases where around the table you have those who say "here is the risk that must be addressed" and then the others who say "if we do that we break production". Both are truthful and full of good will.
- tremon 5y ago
  "Ok, that means our current business practices are a liability. Gather the process owners to see what can be done". What you're describing isn't (shouldn't be) the end of discussion. The trick is to get management to explicitly acknowledge the liabilities.
- ClumsyPilot 5y ago
  "Here is the risk that 737 max will crash because of mcas" And then others say: " if we do that, we will have to redesign too much of the airligher" i.em break production. Youve got to have your priorities straight

tluyben2 5y ago

Crime needs to be dealt with but a lot of companies I worked with in the past 30 years are simply negligent. If you do not blame the victim, what is the incentive for spending money on even basic security? Not morality surely, so...

im3w1l 5y ago

You have a lot of replies but as far as I can see no one made this point, so let me add yet another reply. Victim blaming is a framing that makes it sound like it's about moral and ethics. But it's about practicality. There is a causal chain leading to a bad outcome and we simply break the weakest link. Sometimes it's easier to lock up the treasure and sometimes it's easier to lock up all the thieves. Consider the case of computer security. Locking up all the thieves is super duper hard, because they are located in places like Russia and China that wont cooperate with law enforcement.

bostik 5y ago
> Locking up all the thieves is super duper hard, because they are located in places like Russia and China that wont cooperate with law enforcement. Oh, they do. With their local ones. Those thieves can operate with impunity as long as they don't hit their fellow countrymen.

WalterBright 5y ago

It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that from bringing it all down?" In other words, think in terms of redundancy and isolation between systems. And the largest piece of hubris and madness in critical systems is allowing over-the-internet updates.

passwordqwe 5y ago
But there is a big difference between airline safety and software safety. An airliner survives against the environment, it's PvE, a software system has to survive against hackers, it's PvP. If you shoot a rocket at an airliner, the airliner will fail, in that case we blame the person who shot the rocket.
- jjk166 5y ago
  We design military aircraft to fly into warzones. They are very much PvP. We design them with various countermeasures to deal with rockets and ejector seats if those fail. Yeah, planes will be shot down and pilots may die despite these precautions, but skimping on the ejector seat because "hey they might die anyways" is totally unacceptable.
- boc 5y ago
  This is a great way to frame the issue.
- WalterBright 5y ago
  > But there is a big difference between airline safety and software safety I've worked professionally in both industries; they are not fundamentally different. Software practices can learn a lot from aviation practice, but they seem determined to spend decades rediscovering the methods the bitter, expensive way. For example, software is still stuck in the dark ages where the idea is better training / better programmers / more punishment will prevent these sorts of failures.

perryizgr8 5y ago

> It's physically impossible to build a house that can't be broken in to Specially if an entity with a nation's resources is trying to get in.

mschuster91 5y ago

> I'm a bit tired of the victim blaming with security. Why? Many of the companies who got hacked had massive IT issues of their own fault, the most common being: - full access for everything across the whole network, no subnetting with strict firewalls that limits the scope of an intrusion - outdated software/firmware stacks leading to avenues for compromise - no/ineffective/outdated virus scanners - no meaningful backup infrastructure and regular testing if said infrastructure is already working - lack of 2FA on administrative credentials - lack of monitoring on central file servers to detect if a compromised machine is encrypting the file server's contents piece by piece > It's physically impossible to build a house that can't be broken in to Indeed, but a burglary insurance will likely refuse service or jack up rates if you don't lock your door or not have an alarm system installed.

blueblisters 5y ago

Crime is a social problem but the US government is especially bad at fixing crime that originates from other countries. See war on drugs, terrorism, call center scams etc. On the other hand, a good team of security experts is very good at preventing computer systems from getting hacked into.

clarkevans 5y ago
The problem with drug cartels does not originate from other countries. It is domestic demand, paying in dollars. Those dollars overwhelm local economies and police forces abroad.

mcguire 5y ago

On the other hand, we have known since the 1970s roughly how to make computer systems significantly more secure and resilient. However, we, as a society, have decided that it's costly and difficult and that we would prefer not to do anything about it. It's "move fast and break things" at the social level. I really, really hate reasoning by metaphor, but you do lock your doors, right?