4 ms·

I'm not a cryptocurrency advocate but as arberx points out in another comment this is avoiding the real problem. The problem isn't cryptocurrency or ransomware.

by Dah00n 5y ago

I'm not a cryptocurrency advocate but as arberx points out in another comment this is avoiding the real problem. The problem isn't cryptocurrency or ransomware. The root cause is what needs to be fixed: Software publishers and software owners are to blame for insecure systems. Software development is like the wild west with absolutely no accountability. This need to change.

meowface 5y ago
It's one cause, but in my opinion the root here is the fact that ransomers are frequently identified but brazenly don't skip a beat even if they get publicly doxed, because they know they'll face no repercussions. Their governments turn a blind eye as long as the victims aren't citizens of the country or closely allied countries.
tptacek 5y ago
There is no evidence at all that computer science and information technology actually knows how to solve the underlying security problems without forcing untenable compromises on the economy. We can produce secure software, but only at a level of expense and time that would preclude most commercial software development.
- Dah00n 5y ago
  That may be but that doesn't change that fact that the underlying problem isn't cryptocurrency. Lashing out at other technologies because of lack of accountability in software development won't solve anything. At best it will move it somewhere else but in the end the problem stil haven't been solved. Besides, software could absolutely be made much safer without destroying the economy. We all know that the systems that get hit are often a mess a twelve year old could "hack" by using specific search engines or kiddy scripts. Laws punishing those that run software with known vulnerabilities that end up causing society problems like these ransomware attacks do should have been made decades ago.
  - tptacek 5y ago
    The whole point of the article is that you could have said the same thing about Viagra spam, but financial system interventions did shut that down. There is, again, no evidence that we know how to make commercially deployed software meaningfully safer at the scale we need to do it at to stop ransomware attacks from disrupting society.
    - jude- 5y ago
      I kinda feel like this is something DARPA and the NSF should really be working on. Like, why can't we have an OS and programming environment where it's straightforward to prove basic end-to-end security properties before runtime, like "this data has a `sensitive` type, and thus cannot be written to any potentially-persistent I/O facility?". I'd love it if that was something that my command shell could statically verify for me before running a job, for example.
- quanticle 5y ago
  Then perhaps we shouldn't produce software. If the costs to mitigate the negative externalities of a certain product or service outweigh the net benefits of said product or service, the creation of that product or service is a net negative on society, and we should cease that activity. It's like arguing that a coal-fired power plant isn't profitable if it has to pay for all the carbon that it's producing.
  - tptacek 5y ago
    "We should stop producing software" is a take, and I support it! But I also recognize that the societal cost of ceasing all software development would be huge, and the cost of stopping all cryptocurrency is small and would be felt mostly by speculators. As the saying goes: first you couldn't use Bitcoin to buy a pizza, then you could use Bitcoin to buy a pizza, and now you can't use Bitcoin to buy a pizza. Coal power plants aren't profitable if they have to pay for their externalities, and should be shut down.
- JoeyBananas 5y ago
  This is just a terrible argument. Often times, systems are compromised through social engineering so it's not even remotely possible to solve this issue by software engineering alone. But more importantly, think about the morality of what you are saying. It is absolutely not ethical to rob someone just because they are an easy target. I despise this sort of "technological nihilism." Just because something can be done with technology doesn't mean that it should be done. The fact that bitcoin exists does not mean we should revert back to the stone age. Anarchy is obviously a very bad idea, but I guess some people are determined to learn this lesson the hard way.
  - tptacek 5y ago
    I think you're reading a lot of stuff out of my comment that isn't there. I've spent most of my career doing software security, if that helps with context.
    - deleted 5y ago
      [deleted]
    - JoeyBananas 5y ago
      Yeah I replied to the wrong post
madhadron 5y ago
You could just as easily point to Russia as the root cause, since they are providing a home for this.
akiselev 5y ago
Ransomware isn't the only illegal activity that's greatly enabled by bitcoin. For better or worse, it has enabled stable online marketplaces that allowed one to buy safer/purer drugs, heavy weaponry, assassins, and false passports with less exposure and risk. That used to be the stuff of spy movies - now it's available to anyone who understands how to navigate the web enough to figure out onion addresses or FreeNet. IIUC it has even enabled new methods for money laundering with unique advantages and allowed nations to evade global sanctions with near impunity instead of having to rely on foreign powers to help. I don't wish to speculate whether the effect on each of those niches is net positive or negative, but it's hard to argue that the real problem is cybersecurity when cryptocurrencies have had such significant effects on other fields for the same reasons that it's useful to ransomware operators. Yes, cybersecurity is a real problem, but that doesn't preclude cryptocurrencies from being a real problem either, nor does it preclude the former from sparking action against the latter - the world operates in parallel and we can tackle multiple problems (which means yes, cryptocurrencies will almost certainly be used as a distraction).
SigmundA 5y ago
To me this is like saying we shouldn't make it hard to make money off stolen goods or even police the streets, the problem is my houses security isn't good enough. We should just focus on making houses more secure otherwise its open game and your fault if someone steals from you. You know police in many states in the US get uploads of all pawn records and metal recycling to help track down and stop thieves from making money on stolen goods. There isn't one root cause, there is an environment made up of multiple factors that allows bad behavior, one contributing factor is how cryptocurrency has enabled large ransom payments to bad actors over seas. Software should be made more secure, but making it 100% secure is impossible. How much time and money should be spent on the software security side? My house isn't made like a fortress, its security is actually pretty minimal, it doesn't need to be better because laws are enforced and its not anarchy outside, its a low crime environment due to multiple levels of protection I don't even think about or manage directly all provided by the government. Part of those protections is making it more difficult for criminals to profit off crimes, though not impossible, it's just one aspect of a defense in depth.
- Dah00n 5y ago
  Well, first of all no one said it should be 100% secure but by far the most attacks are against systems so insecure and outdated that Windows 7 might be an upgrade. It takes minutes to find US water plants or the likes running Windows XP with internet access. That's not comparable to a house. That is a used plastic bag full of cash being blown down the street. Besides you house is secure exactly because your money isn't in you house but in a bank. Your argument should be "banks aren't fortresses because...." but that is what they are and so should important software.

by Dah00n 5y ago

meowface 5y ago

It's one cause, but in my opinion the root here is the fact that ransomers are frequently identified but brazenly don't skip a beat even if they get publicly doxed, because they know they'll face no repercussions. Their governments turn a blind eye as long as the victims aren't citizens of the country or closely allied countries.

tptacek 5y ago

There is no evidence at all that computer science and information technology actually knows how to solve the underlying security problems without forcing untenable compromises on the economy. We can produce secure software, but only at a level of expense and time that would preclude most commercial software development.

Dah00n 5y ago
That may be but that doesn't change that fact that the underlying problem isn't cryptocurrency. Lashing out at other technologies because of lack of accountability in software development won't solve anything. At best it will move it somewhere else but in the end the problem stil haven't been solved. Besides, software could absolutely be made much safer without destroying the economy. We all know that the systems that get hit are often a mess a twelve year old could "hack" by using specific search engines or kiddy scripts. Laws punishing those that run software with known vulnerabilities that end up causing society problems like these ransomware attacks do should have been made decades ago.
- tptacek 5y ago
  The whole point of the article is that you could have said the same thing about Viagra spam, but financial system interventions did shut that down. There is, again, no evidence that we know how to make commercially deployed software meaningfully safer at the scale we need to do it at to stop ransomware attacks from disrupting society.
  - jude- 5y ago
    I kinda feel like this is something DARPA and the NSF should really be working on. Like, why can't we have an OS and programming environment where it's straightforward to prove basic end-to-end security properties before runtime, like "this data has a `sensitive` type, and thus cannot be written to any potentially-persistent I/O facility?". I'd love it if that was something that my command shell could statically verify for me before running a job, for example.
quanticle 5y ago
Then perhaps we shouldn't produce software. If the costs to mitigate the negative externalities of a certain product or service outweigh the net benefits of said product or service, the creation of that product or service is a net negative on society, and we should cease that activity. It's like arguing that a coal-fired power plant isn't profitable if it has to pay for all the carbon that it's producing.
- tptacek 5y ago
  "We should stop producing software" is a take, and I support it! But I also recognize that the societal cost of ceasing all software development would be huge, and the cost of stopping all cryptocurrency is small and would be felt mostly by speculators. As the saying goes: first you couldn't use Bitcoin to buy a pizza, then you could use Bitcoin to buy a pizza, and now you can't use Bitcoin to buy a pizza. Coal power plants aren't profitable if they have to pay for their externalities, and should be shut down.
JoeyBananas 5y ago
This is just a terrible argument. Often times, systems are compromised through social engineering so it's not even remotely possible to solve this issue by software engineering alone. But more importantly, think about the morality of what you are saying. It is absolutely not ethical to rob someone just because they are an easy target. I despise this sort of "technological nihilism." Just because something can be done with technology doesn't mean that it should be done. The fact that bitcoin exists does not mean we should revert back to the stone age. Anarchy is obviously a very bad idea, but I guess some people are determined to learn this lesson the hard way.
- tptacek 5y ago
  I think you're reading a lot of stuff out of my comment that isn't there. I've spent most of my career doing software security, if that helps with context.
  - deleted 5y ago
    [deleted]
  - JoeyBananas 5y ago
    Yeah I replied to the wrong post

madhadron 5y ago

You could just as easily point to Russia as the root cause, since they are providing a home for this.

akiselev 5y ago

Ransomware isn't the only illegal activity that's greatly enabled by bitcoin. For better or worse, it has enabled stable online marketplaces that allowed one to buy safer/purer drugs, heavy weaponry, assassins, and false passports with less exposure and risk. That used to be the stuff of spy movies - now it's available to anyone who understands how to navigate the web enough to figure out onion addresses or FreeNet. IIUC it has even enabled new methods for money laundering with unique advantages and allowed nations to evade global sanctions with near impunity instead of having to rely on foreign powers to help. I don't wish to speculate whether the effect on each of those niches is net positive or negative, but it's hard to argue that the real problem is cybersecurity when cryptocurrencies have had such significant effects on other fields for the same reasons that it's useful to ransomware operators. Yes, cybersecurity is a real problem, but that doesn't preclude cryptocurrencies from being a real problem either, nor does it preclude the former from sparking action against the latter - the world operates in parallel and we can tackle multiple problems (which means yes, cryptocurrencies will almost certainly be used as a distraction).

SigmundA 5y ago

To me this is like saying we shouldn't make it hard to make money off stolen goods or even police the streets, the problem is my houses security isn't good enough. We should just focus on making houses more secure otherwise its open game and your fault if someone steals from you. You know police in many states in the US get uploads of all pawn records and metal recycling to help track down and stop thieves from making money on stolen goods. There isn't one root cause, there is an environment made up of multiple factors that allows bad behavior, one contributing factor is how cryptocurrency has enabled large ransom payments to bad actors over seas. Software should be made more secure, but making it 100% secure is impossible. How much time and money should be spent on the software security side? My house isn't made like a fortress, its security is actually pretty minimal, it doesn't need to be better because laws are enforced and its not anarchy outside, its a low crime environment due to multiple levels of protection I don't even think about or manage directly all provided by the government. Part of those protections is making it more difficult for criminals to profit off crimes, though not impossible, it's just one aspect of a defense in depth.

Dah00n 5y ago
Well, first of all no one said it should be 100% secure but by far the most attacks are against systems so insecure and outdated that Windows 7 might be an upgrade. It takes minutes to find US water plants or the likes running Windows XP with internet access. That's not comparable to a house. That is a used plastic bag full of cash being blown down the street. Besides you house is secure exactly because your money isn't in you house but in a bank. Your argument should be "banks aren't fortresses because...." but that is what they are and so should important software.