3 ms·
Yes, but centralization is a symptom of something deeper: incumbent business interests with top-down power structures actively disincentivize the holistic, cre
by javajosh 5y ago
Yes, but centralization is a symptom of something deeper: incumbent business interests with top-down power structures actively disincentivize the holistic, creative, critical thinking required to mount a meaningful distributed cyber-defense, and incentivize CYA approaches which leads to weaker centralized solutions. "Well, we spent $10M on defense - put some appliances in a NOC, paid contractors, gave our CTO a bonus - what more could we do?" Ultimately the legal system will accept this as a valid excuse. Whereas, if you take more holistic steps, embrace distributed responsibility and action, incentivize awareness of threats and threat-modeling, and get sued as liable, a judge could very well say, "But you didn't spend a significant chunk of your revenue to build [out the same kind of solutions I'm used to seeing in cases like this]? Negligence!"
When ignorance becomes so widespread that it is enforced by law, and wise action is actively punished, and one cannot really blame rational actors for taking the CYA approach. One can hope that some of them take a principled stand and the risk of punishment to do more; alternatively, we can expect to collapse and be replaced by a smarter, if more brutal regime. One way or another, the bleeding always stops.
- kaibee 5y ago> "But you didn't spend a significant chunk of your revenue to build [out the same kind of solutions I'm used to seeing in cases like this]? Negligence!" Is there any evidence that this happens? I feel like there's a lot of these kind of spooky 21st century "folk-wisdom"(s) out there and if you actually trace it back its like the McDonald's hot coffee case or whatever.
- javajosh 5y agoIt's a good question. I'm basing this mostly on my impression of recent PR releases, post-intrusion, that make the argument "We spent money on it! It's not our fault it didn't work!" I've noticed that PR releases tend to echo the eventual legal argument. There's at least some evidence it's not a McDonalds hot coffee lawsuit thing (although I really hope I'm wrong).
- deleted 5y ago[deleted]
- cartoonworld 5y agoI agree fully. This is totally unacceptable and legitimately dangerous. Dialysis machines are hooked up to this trash right now! We require enforcement, jail, fines, and civil liability for this gross, aggravated negligence.
- closeparen 5y agoI think bigger problem is that you need "holistic, creative, critical thinking" to run an absolutely mundane, workaday Windows domain. Because there are hundreds of thousands, if not millions of those. Why don't we get the holistic, creative, critical thinkers to work at Microsoft (and the vendors people generally use in concert with Microsoft) to stop shipping this vulnerability-riddled crap.
- javajosh 5y agoWell, yes, system administration is, in general, quite broken. It is ironic to me that all those selfish weaknesses that vendors (hardware and software) include to give some sort of asymmetric advantage to them are always the cause of weakness. It's almost as if, I don't know, simple, symmetrical, fair computing systems are actually more secure by some law of nature. But yeah. Software needs to get fewer, simpler, easier to understand, verify and build. Hardware needs to be simpler and easier to understand - and possible to verify. And there needs to be awareness this isn't some hippy-dippy sentiment of strange neckbeards, but rather its the only way to get the security we all need. "Every exploit can be turned against it's owner" needs to be drilled into engineers, executives and lawmakers at every level until they hear it in their sleep, and recoil in horror when anyone even suggests knowingly shipping an exploit.
- closeparen 5y agoIt could perhaps be reasonable for IT departments to ship Windows desktops without all these surveillance and control mechanisms, if normal web browsing and email activities such as clicking links and opening attachments were not so likely to get the enterprise owned.
- joe_the_user 5y agoYou need to be creative because the standards are broken. If there were strong, holistic standards, you wouldn't need to be creative.