6 ms·

Its interesting to me that the discussion around ransomware attacks on HN is full of victim blaming. When stores are forced to close in SF because of rampant t

Its interesting to me that the discussion around ransomware attacks on HN is full of victim blaming. When stores are forced to close in SF because of rampant theft, nobody suggests that Walgreens or Target should hire armed guards. If a mall were to be bombed, nobody would suggest that malls should just be built to resist bombing attacks. The entire point of a government is to provide security and protect the rights of citizens. It is the government's job to solve / prevent / deter crime. If we are willing to put the burden of security on the individual, then why would we organize into states at all? I think there could be "IT security codes" just as there are "building codes" to enforce security good practices. But "survive impact from a 747" is not part of our building codes, and similarly "be resilient to targeted, state sponsored cyberwarfare" should not the responsibility of the individual.

neolog 5y ago
> But "survive impact from a 747" is not part of our building codes It basically is for skyscrapers now. https://global.ctbuh.org/resources/papers/download/1017-evolution-of-building-code-requirements-in-a-post-911-world.pdf https://global.ctbuh.org/resources/papers/download/1017-evol...
theandrewbailey 5y ago
> Its interesting to me that the discussion around ransomware attacks on HN is full of victim blaming. This is HN. It's filled with people whose job is building secure systems, or at the very least are aware of best practices to prevent these attacks. Of course you're going to read that they should have done this or that. > When stores are forced to close in SF because of rampant theft, nobody suggests that Walgreens or Target should hire armed guards. If a mall were to be bombed, nobody would suggest that malls should just be built to resist bombing attacks. Have you tried asking that in different places?
tgv 5y ago
Trying to prevent crime in another country is typically not within a government's mandate. > victim blaming That's a frame that carries a negative connotation. Why? Shouldn't builders construct houses that are safe enough? Or are you telling me that the government should prosecute the people responsible for the hacked systems?
- Swizec 5y ago
  Yes the government should prosecute people responsible for building insecure systems. Just like an electrician is liable if your house burns down and their wiring wasn’t up to code [and caused the fire]. We need similar laws/codes for software. It’s time.
  - dahfizz 5y ago
    This is much more akin to a criminal breaking into your house, ripping into your walls, and shorting the wires to cause a fire.
  - sergimansilla 5y ago
    I think the problem here is with the definition of “secure system”. What is “secure enough”? Considering we’re talking about groups that have resources to buy 0-day exploits, if they want to get in, they’ll eventually will. Sticking with your analogy, we could probably define a set of standards for baseline IT security for all IT systems…but it probably wouldn’t be very useful. Systems vary so wildly in complexity and scale that coming up with the equivalent of a “code” that fits most systems like we have with electrical installations is impossible.
- dahfizz 5y ago
  > Shouldn't builders construct houses that are safe enough? Yes, which is why I mentioned building codes. I suppose "safe enough" is where the disagreement is. Should you be prosecuted if a thief smashes your window and steals something you borrowed from a friend? How incredibly irresponsible of you, to have a window in your home! When will we take security seriously? It is your fault that you were a victim of a crime and you should go to jail for it. /s
  - labawi 5y ago
    How much effort do you expect from the police if you gave keys to your house to everyone who ever visited. Or if you teach your butler to follow orders as long as they are prefaced with "dahfizz said ..." That is the current level of software security. That's why I have a joyful smile anytime I read of another hack, because maybe people will start caring about security.
runeks 5y ago
Thousands of companies have been hit by ransomware this year. If we were to accept your analogy that this is equivalent to thousands of mall bombings, I’d say making malls bomb safe would make a lot of sense.
sbuk 5y ago
Like https://www.nist.gov/cyberframework/ https://www.nist.gov/cyberframework/ or https://www.iso.org/isoiec-27001-information-security.html https://www.iso.org/isoiec-27001-information-security.html ?
nabla9 5y ago
"get doors with locks in them" is better metaphor for most cases. There is no reason to blame corporate victims if they show that they have locked things up properly and follow good practices. Governments should also be blamed, of course. Promoting infrastructure with backdoor's and weaknesses because "think of the children and terrorists" rhetoric is not helpful.
jerry1979 5y ago
People in society do ask businesses to secure their buildings appropriately. In small towns, that might mean a locked front door. In NYC, that means a metal gate that pulls down to block the storefront.
mdoms 5y ago
Unfortunately this website is lousy with libertarians who are... well... not the sharpest knives in the drawer.
RONROC 5y ago
100% with you. Generally posts like these induce the HN crowd blinders, since people who typically post here are sympathetic to software developers. The same software developers who are making money hand over fist. The same software developers who refuse to pay reasonable amounts of money for zero days. These hackers are fulfilling a market inefficiency whether users here would like to acknowledge that or not. It’s not the mean hackers or bitcoins fault. The blame should be squarely be placed at the doorstep of all the brilliant engineers who are responsible for the creation of the system architecture but for whatever reason are nowhere to be found when it’s starts to degrade. This is a major issue with software development that is simply not convenient to discuss because the incentives to frog hop from job to job massively outweigh the benefits of staying on board for the years the job actually requires. And yes, people will tell you, especially on here, that air tight code is a pipe dream. And maybe so, but the amount of severe deficiencies in code bases that millions of people rely on every day are simply unacceptable. When your earnings report is in the upwards of hundreds of millions, it’s really hard to play stupid.
- Karunamon 5y ago
  This sounds like you're laying the blame at the feet of developers. Unless we're talking about FOSS, most devs don't get to pick what to write; only how to do it, and then in a very limited way on artificially constrained (read: unreasonable) timescales. Start holding companies responsible for their shitty priorities and then things may change. Until then, this is doing the equivalent of yelling at retail workers for company policy. They are not the responsible party here. That responsibility starts at the C-suite and filters down.
  - labawi 5y ago
    Currently the blame should be on companies and people from the top, as the developers don't really have much choice (without unionizing or whatever). OTOH, it doesn't have to be this way. As an example, electricians are licensed here (I think) and it is against the law to pressure them work faster. Architects and building engineers are licensed (need proper education + practice), and they are required to uphold certain standards. They give a stamp of approval and at fault (insurance compulsory) and can lose their license if there are problems with their designs, regardless of any pressure from investors.
nitrogen 5y ago
If a bridge collapses, we don't get upset that the police weren't forming ranks by the bridge to keep the water away. Software is more like bridges than stores. It's supporting infrastructure that needs to be able to withstand reasonably anticipated forces of nature. We expect buildings to be able to resist termite damage by taking reasonable means to block them. We should also expect software to resist self-propagating worms and other attacks. If you build a building in a tough neighborhood (or a warzone), that building has to have security and stability features that match the demands placed on it by its environment. The Internet is basically a termite-infested warzone. We know that threats exist, we have things like OWASP and other sources of improving best practices to prevent common entrypoints for attacks. We have to expect software and networks to do better, just as we expect governments to find and stop the attackers.
- dahfizz 5y ago
  > It's supporting infrastructure that needs to be able to withstand reasonably anticipated forces of nature. Hackers are not a force of nature, they are criminals. This is absolutely no different than someone picking the lock to your front door and stealing all you own. Even if you forgot to lock your door, or failed to install steal bars over your windows, its still not your fault if your house is broken into.
  - dijit 5y ago
    If I hire you to secure my house and you remove my front door- you are liable. Kaseya is a security services company, they’re the ones securing the home, they removed the front door.
    - shuntress 5y ago
      Most people (at least, that I know) do not hire private security teams to police their homes. And the ones that do pay companies for security typically stop at surveillance (cameras, motion detectors, door detectors, etc). These only help to prevent intrusion with the threat of detection (the intruders recognizable face on camera). Most private buildings are not hardened fortresses capable of state-of-the-art attacks and I personally don't think it's reasonable to expect them to be.
joe_the_user 5y ago
I think there could be "IT security codes" just as there are "building codes" to enforce security good practices. But "survive impact from a 747" is not part of our building codes, and similarly "be resilient to targeted, state sponsored cyberwarfare" should not the responsibility of the individual. It's kind of quandary. "allow umpteen third parties to update their crap into your system" really is the current "security standard". And it's a standard that's gone along with the entirety of outsourcing as approach to cost-effectiveness. It's hard to be sympathetic to the organizations that have lived and died by this. On the other hand, you're right. One can't do this company by company, one needs standards. The question is whether the same companies that are now suffering would be complaining tomorrow if actual standards were imposed.
fouric 5y ago
> Its interesting to me that the discussion around ransomware attacks on HN is full of victim blaming. It is no longer interesting that there's a pattern of comments on HN that attacks some nebulous aspect of other comments on the site and/or article - such as this one. Neither is it interesting that these comments generally try to use emotionally manipulative language (like "victim blaming") and attempt to shame other HN users in place of (or occasionally in addition to) sound logic. > victim blaming There's more than one victim here - users, consumers, and other people who use the services of these organizations are also victims. These companies that were compromised had a responsibility to protect their users' data and continue to provide them services - that they failed to uphold due to their own lax IT infrastructure. > The entire point of a government is to provide security and protect the rights of citizens. Even given this model, the government still is not responsible for directly administering the IT systems of companies. They're responsible for that, and the government penalizes them when they fail. We're still not under that system (I'm still waiting for a law that penalizes companies for leaking, sharing, or losing user data), but my argument holds anyway.
eunos 5y ago
> there could be "IT security codes" just as there are "building codes" Problem is the threat model of IT and building is way too different. Imagine that major buildings are frequent target of arsons and the arsons can remotely set the fire. That mean buildings need to defend again all possible arsons, from random amateur folks to folks comparable to special forces.
- willcipriano 5y ago
  Virtually all of the "cyber-attacks" in the past few months have been the "someone forgot to update Exchange this decade" or "someone left the default username and password configured" and not the "newly discovered OS vulnerability results in a drive by attack" variety. That sort of raw incompetence has been addressed by the many already existing standards.
shuntress 5y ago
This is something I think about a lot when I glance over the constant daily penetration scans on my small self-hosted website's logs. We would obviously care and do something about people streaming (physically) through neighborhoods to test every door/window/mailbox on every building. For some reason, when it comes to the metaphorical "buildings" of our digital spaces, the general consensus seems to be a half-sarcastic: "If you can't install and maintain impenetrable state-of-the-art locks on all your stuff, you had better just give up and move into the Facebook highrise."
- markzzerella 5y ago
  Your neighborhood isn't globally accessible in milliseconds with near complete anonymity. To expect that there won't be attacks is fanciful. To be operating in the 7 figure revenue range without even looking up best practices is negligence.
  - shuntress 5y ago
    That is exactly my point. We have systems in place to deal with people going door-to-door trying to open the windows on each house down my street. The police are eager to fly through red lights and get here as fast as possible to fight crime. (Equity in policing is a different discussion but the point here is that the system exists) But for the electronic equivalent, we have no system.
- hpoe 5y ago
  The disconnect isn't that we require people to have state of the art impenetrable locks, we are requiring them merely to lock the door when they are out. These standards that are out there aren't difficult to implement or put in place. For example if we look at PCI-DSS standards some of them include 1 - Changing default passwords 2 - Having a firewall 3 - Encrypting PCI information at rest 4 - Using encrypted communication channels for PCI (https). This is just some of the standards and none of them are very hard, all of them are trivial to implement. So sure it's a bad thing if you get robbed while out on errands, but you're going to get a whole lot less sympathy if it turns out you left the front door open with a sign that said, "I'm not home right now." EDIT: To be clear I am not talking about SMB mom and pop shops necessarily in this comment, I am talking about the massive Fortune 1000 companies that are getting hit with this over and over again.
slickrick216 5y ago
Exactly and if the burden is to be on the individual or company which in my opinion it should be then they should be able to take actions to protect themselves
closeparen 5y ago
I don't see how effective government protection of the internet could coexist with arbitrary connections across hostile national borders with no extradition or law-enforcement cooperation. And a lot of people really appreciate the latter, that the internet is not organized into states, and would see it as a great loss if it were.
jokoon 5y ago
I've been saying this for a long time. I'm sure the computer security industry wouldn't like this.
nuker 5y ago
> It is the government's job to solve / prevent / deter crime. Network Border Protection Agency, NBPA. A nation level firewall, much like China’s. Plus KYC rules for renting compute inside the country.

neolog 5y ago

> But "survive impact from a 747" is not part of our building codes It basically is for skyscrapers now. https://global.ctbuh.org/resources/papers/download/1017-evolution-of-building-code-requirements-in-a-post-911-world.pdf https://global.ctbuh.org/resources/papers/download/1017-evol...

theandrewbailey 5y ago

> Its interesting to me that the discussion around ransomware attacks on HN is full of victim blaming. This is HN. It's filled with people whose job is building secure systems, or at the very least are aware of best practices to prevent these attacks. Of course you're going to read that they should have done this or that. > When stores are forced to close in SF because of rampant theft, nobody suggests that Walgreens or Target should hire armed guards. If a mall were to be bombed, nobody would suggest that malls should just be built to resist bombing attacks. Have you tried asking that in different places?

tgv 5y ago

Trying to prevent crime in another country is typically not within a government's mandate. > victim blaming That's a frame that carries a negative connotation. Why? Shouldn't builders construct houses that are safe enough? Or are you telling me that the government should prosecute the people responsible for the hacked systems?

Swizec 5y ago
Yes the government should prosecute people responsible for building insecure systems. Just like an electrician is liable if your house burns down and their wiring wasn’t up to code [and caused the fire]. We need similar laws/codes for software. It’s time.
- dahfizz 5y ago
  This is much more akin to a criminal breaking into your house, ripping into your walls, and shorting the wires to cause a fire.
- sergimansilla 5y ago
  I think the problem here is with the definition of “secure system”. What is “secure enough”? Considering we’re talking about groups that have resources to buy 0-day exploits, if they want to get in, they’ll eventually will. Sticking with your analogy, we could probably define a set of standards for baseline IT security for all IT systems…but it probably wouldn’t be very useful. Systems vary so wildly in complexity and scale that coming up with the equivalent of a “code” that fits most systems like we have with electrical installations is impossible.
dahfizz 5y ago
> Shouldn't builders construct houses that are safe enough? Yes, which is why I mentioned building codes. I suppose "safe enough" is where the disagreement is. Should you be prosecuted if a thief smashes your window and steals something you borrowed from a friend? How incredibly irresponsible of you, to have a window in your home! When will we take security seriously? It is your fault that you were a victim of a crime and you should go to jail for it. /s
- labawi 5y ago
  How much effort do you expect from the police if you gave keys to your house to everyone who ever visited. Or if you teach your butler to follow orders as long as they are prefaced with "dahfizz said ..." That is the current level of software security. That's why I have a joyful smile anytime I read of another hack, because maybe people will start caring about security.

runeks 5y ago

Thousands of companies have been hit by ransomware this year. If we were to accept your analogy that this is equivalent to thousands of mall bombings, I’d say making malls bomb safe would make a lot of sense.

sbuk 5y ago

Like https://www.nist.gov/cyberframework/ https://www.nist.gov/cyberframework/ or https://www.iso.org/isoiec-27001-information-security.html https://www.iso.org/isoiec-27001-information-security.html ?

nabla9 5y ago

"get doors with locks in them" is better metaphor for most cases. There is no reason to blame corporate victims if they show that they have locked things up properly and follow good practices. Governments should also be blamed, of course. Promoting infrastructure with backdoor's and weaknesses because "think of the children and terrorists" rhetoric is not helpful.

jerry1979 5y ago

People in society do ask businesses to secure their buildings appropriately. In small towns, that might mean a locked front door. In NYC, that means a metal gate that pulls down to block the storefront.

mdoms 5y ago

Unfortunately this website is lousy with libertarians who are... well... not the sharpest knives in the drawer.

RONROC 5y ago

100% with you. Generally posts like these induce the HN crowd blinders, since people who typically post here are sympathetic to software developers. The same software developers who are making money hand over fist. The same software developers who refuse to pay reasonable amounts of money for zero days. These hackers are fulfilling a market inefficiency whether users here would like to acknowledge that or not. It’s not the mean hackers or bitcoins fault. The blame should be squarely be placed at the doorstep of all the brilliant engineers who are responsible for the creation of the system architecture but for whatever reason are nowhere to be found when it’s starts to degrade. This is a major issue with software development that is simply not convenient to discuss because the incentives to frog hop from job to job massively outweigh the benefits of staying on board for the years the job actually requires. And yes, people will tell you, especially on here, that air tight code is a pipe dream. And maybe so, but the amount of severe deficiencies in code bases that millions of people rely on every day are simply unacceptable. When your earnings report is in the upwards of hundreds of millions, it’s really hard to play stupid.

Karunamon 5y ago
This sounds like you're laying the blame at the feet of developers. Unless we're talking about FOSS, most devs don't get to pick what to write; only how to do it, and then in a very limited way on artificially constrained (read: unreasonable) timescales. Start holding companies responsible for their shitty priorities and then things may change. Until then, this is doing the equivalent of yelling at retail workers for company policy. They are not the responsible party here. That responsibility starts at the C-suite and filters down.
- labawi 5y ago
  Currently the blame should be on companies and people from the top, as the developers don't really have much choice (without unionizing or whatever). OTOH, it doesn't have to be this way. As an example, electricians are licensed here (I think) and it is against the law to pressure them work faster. Architects and building engineers are licensed (need proper education + practice), and they are required to uphold certain standards. They give a stamp of approval and at fault (insurance compulsory) and can lose their license if there are problems with their designs, regardless of any pressure from investors.

nitrogen 5y ago

If a bridge collapses, we don't get upset that the police weren't forming ranks by the bridge to keep the water away. Software is more like bridges than stores. It's supporting infrastructure that needs to be able to withstand reasonably anticipated forces of nature. We expect buildings to be able to resist termite damage by taking reasonable means to block them. We should also expect software to resist self-propagating worms and other attacks. If you build a building in a tough neighborhood (or a warzone), that building has to have security and stability features that match the demands placed on it by its environment. The Internet is basically a termite-infested warzone. We know that threats exist, we have things like OWASP and other sources of improving best practices to prevent common entrypoints for attacks. We have to expect software and networks to do better, just as we expect governments to find and stop the attackers.

dahfizz 5y ago
> It's supporting infrastructure that needs to be able to withstand reasonably anticipated forces of nature. Hackers are not a force of nature, they are criminals. This is absolutely no different than someone picking the lock to your front door and stealing all you own. Even if you forgot to lock your door, or failed to install steal bars over your windows, its still not your fault if your house is broken into.
- dijit 5y ago
  If I hire you to secure my house and you remove my front door- you are liable. Kaseya is a security services company, they’re the ones securing the home, they removed the front door.
  - shuntress 5y ago
    Most people (at least, that I know) do not hire private security teams to police their homes. And the ones that do pay companies for security typically stop at surveillance (cameras, motion detectors, door detectors, etc). These only help to prevent intrusion with the threat of detection (the intruders recognizable face on camera). Most private buildings are not hardened fortresses capable of state-of-the-art attacks and I personally don't think it's reasonable to expect them to be.

joe_the_user 5y ago

I think there could be "IT security codes" just as there are "building codes" to enforce security good practices. But "survive impact from a 747" is not part of our building codes, and similarly "be resilient to targeted, state sponsored cyberwarfare" should not the responsibility of the individual. It's kind of quandary. "allow umpteen third parties to update their crap into your system" really is the current "security standard". And it's a standard that's gone along with the entirety of outsourcing as approach to cost-effectiveness. It's hard to be sympathetic to the organizations that have lived and died by this. On the other hand, you're right. One can't do this company by company, one needs standards. The question is whether the same companies that are now suffering would be complaining tomorrow if actual standards were imposed.

fouric 5y ago

> Its interesting to me that the discussion around ransomware attacks on HN is full of victim blaming. It is no longer interesting that there's a pattern of comments on HN that attacks some nebulous aspect of other comments on the site and/or article - such as this one. Neither is it interesting that these comments generally try to use emotionally manipulative language (like "victim blaming") and attempt to shame other HN users in place of (or occasionally in addition to) sound logic. > victim blaming There's more than one victim here - users, consumers, and other people who use the services of these organizations are also victims. These companies that were compromised had a responsibility to protect their users' data and continue to provide them services - that they failed to uphold due to their own lax IT infrastructure. > The entire point of a government is to provide security and protect the rights of citizens. Even given this model, the government still is not responsible for directly administering the IT systems of companies. They're responsible for that, and the government penalizes them when they fail. We're still not under that system (I'm still waiting for a law that penalizes companies for leaking, sharing, or losing user data), but my argument holds anyway.

eunos 5y ago

> there could be "IT security codes" just as there are "building codes" Problem is the threat model of IT and building is way too different. Imagine that major buildings are frequent target of arsons and the arsons can remotely set the fire. That mean buildings need to defend again all possible arsons, from random amateur folks to folks comparable to special forces.

willcipriano 5y ago
Virtually all of the "cyber-attacks" in the past few months have been the "someone forgot to update Exchange this decade" or "someone left the default username and password configured" and not the "newly discovered OS vulnerability results in a drive by attack" variety. That sort of raw incompetence has been addressed by the many already existing standards.

shuntress 5y ago

This is something I think about a lot when I glance over the constant daily penetration scans on my small self-hosted website's logs. We would obviously care and do something about people streaming (physically) through neighborhoods to test every door/window/mailbox on every building. For some reason, when it comes to the metaphorical "buildings" of our digital spaces, the general consensus seems to be a half-sarcastic: "If you can't install and maintain impenetrable state-of-the-art locks on all your stuff, you had better just give up and move into the Facebook highrise."

markzzerella 5y ago
Your neighborhood isn't globally accessible in milliseconds with near complete anonymity. To expect that there won't be attacks is fanciful. To be operating in the 7 figure revenue range without even looking up best practices is negligence.
- shuntress 5y ago
  That is exactly my point. We have systems in place to deal with people going door-to-door trying to open the windows on each house down my street. The police are eager to fly through red lights and get here as fast as possible to fight crime. (Equity in policing is a different discussion but the point here is that the system exists) But for the electronic equivalent, we have no system.
hpoe 5y ago
The disconnect isn't that we require people to have state of the art impenetrable locks, we are requiring them merely to lock the door when they are out. These standards that are out there aren't difficult to implement or put in place. For example if we look at PCI-DSS standards some of them include 1 - Changing default passwords 2 - Having a firewall 3 - Encrypting PCI information at rest 4 - Using encrypted communication channels for PCI (https). This is just some of the standards and none of them are very hard, all of them are trivial to implement. So sure it's a bad thing if you get robbed while out on errands, but you're going to get a whole lot less sympathy if it turns out you left the front door open with a sign that said, "I'm not home right now." EDIT: To be clear I am not talking about SMB mom and pop shops necessarily in this comment, I am talking about the massive Fortune 1000 companies that are getting hit with this over and over again.

slickrick216 5y ago

Exactly and if the burden is to be on the individual or company which in my opinion it should be then they should be able to take actions to protect themselves

closeparen 5y ago

I don't see how effective government protection of the internet could coexist with arbitrary connections across hostile national borders with no extradition or law-enforcement cooperation. And a lot of people really appreciate the latter, that the internet is not organized into states, and would see it as a great loss if it were.

jokoon 5y ago

I've been saying this for a long time. I'm sure the computer security industry wouldn't like this.

nuker 5y ago

> It is the government's job to solve / prevent / deter crime. Network Border Protection Agency, NBPA. A nation level firewall, much like China’s. Plus KYC rules for renting compute inside the country.