4 ms·
My favored analogy is piracy and privateering in the 17th, 18th centuries. Sure, the spoils of one attack enable the next. An end to privateering comes with po
by aksss 5y ago
My favored analogy is piracy and privateering in the 17th, 18th centuries. Sure, the spoils of one attack enable the next.
An end to privateering comes with powerful institutional enforcement via the suppression of movement and committed retribution (an eventual monopoly on the exercise of force). I can only imagine what the analogy looks like - it's arguably more difficult than traditional privateers operating on the open seas if the actors in this case are safe on sovereign soil.
Perhaps the analogy to the open seas is the Internet itself. If the solution to privateering was denying bad actors the freedom to operate, the same applied solution on the Internet would be dramatic restriction of who can communicate on it.
Problem is, the supply chain attacks in this analogy are more akin to sailing under false colors. In this case sailing under false certificates. What do you do when a pirate captures a ship of your fleet, has your flag, your signal flags, and has your latest challenge/response codes? In the age of sail, it would probably mean accepting the loss of the incident, then ruthlessly hunting down the perpetrator directly with the goal of eliminating all actors capable of such sophisticated engagements - basically reducing the talent pool to near zero. If you aren't allowed in this day and age to address the actor directly, you probably have to deny the host nation itself the freedom of movement until they commit to delivering heads on plates. What does that mean? Cutting Russia off the Internet? Is that even doable these days? You could embargo the Internet for your own country like China tries to do - sad that we're having to consider that. I struggle to imagine other half-way realistic options. Kinetic war and assassination seem imprudent/impractical, to say the least.
I certainly don't think the answer is to "eliminate crypto", the equivalent to thinking "banish gold coins" in the age of sail would stop piracy. I also don't think the answer is to demand all companies "do better at security". While everyone needs to do security better, it will always be insufficient. A merchant ship in the age of sail was never expected to have the armaments of a national navy. Their solution was to convoy up and if lucky have state actors protect those convoys - a herd defense at worst. The equivalent to "convoying up" in this age would be some sort of massive crowd validation process before updates are released, slowing everything down to an impractical rate. So I struggle to see what's left other than a good offense, as much as I hate to think of what that means for the dream of the open Internet.
The merchants demanded their host nation deliver a safe operating environment, at a pretty steep collective cost.
- mullingitover 5y ago> I certainly don't think the answer is to "eliminate crypto", the equivalent to thinking "banish gold coins" in the age of sail would stop piracy. You don't need to eliminate crypto, just heavily scrutinize/regulate/license exchanges like any other bank. Generally treat anonymous crypto the same way you'd treat someone who pulls up to a regular bank with a U-Haul full of cash and tries to make a deposit. If a wallet has ever interacted with a mixer (and generally treat mixers the same way you'd treat money launderers), blacklist the wallet. Blacklist any wallet that is linked in any way to a mixer or to wallets involved in extortion. Revoke the license of any bank that accepts funds linked to an unregulated crypto exchange.
- aksss 5y agoA ransom payment, while a HUGE incentive, is not the only incentive for these attacks. Like any piracy, there are gains to be had from captured assets and an owner's ransom is only one avenue to monetize those assets. So you apply a Thor's hammer solution limited to cooperative countries. Who is going to disproportionately pay that penalty? And what does "just heavily regulate" a decentralized currency even imply when applied globally? Will Russia be cooperative/respectful of this regulation? I'm not sure this would be as effective as you think, but certainly comes with some downsides to gen pop if we imagine how regulating crypto would be done effectively across friendly nations. I must say that I also think having anonymous currency (cash, crypto, etc) is fundamentally healthy for society on the balance. So am biased against solutions that would further it's knee-capping. It seems more structurally sound/scalable/proportionate to punish the agents rather than the mechanisms, to the degree possible. In a gray-filled and nuanced way, I'm happy that ransomware attacks are still possible (encryption works, anonymous payments work), but disapprove of their application in this way and believe a penalty should be paid by the actors for what they choose to do with tools that also have legitimate purposes.
- mullingitover 5y ago> Will Russia be cooperative/respectful of this regulation? I'd be fine with Russia and any other rogue financial state actors being cut out of the global financial system entirely if they're going to value relatively small-time money laundering over legitimate business. No loss there. > I must say that I also think having anonymous currency (cash, crypto, etc) is fundamentally healthy for society on the balance. So am biased against solutions that would further it's knee-capping. I'm honestly not seeing it. Crypto has been around for long enough to take an clear-eyed appraisal of its utility, and what I've seen has been primarily speculation (a worthless drag on society), with a smaller but hugely significant factor in enabling highly scalable criminal activity (more drag on society), and various other negatives. It has enabled a plethora of scams, shielded bad actors, and to the average person it has created pretty much zero utility. There could be some good uses! I look at crypto like roads - yeah, it'd be great if we could all just drive anything we like, anywhere we like, at any speed, without regard for anyone else. However, to make roads a safe place for everyone and minimize negative externalities, we have traffic controls, licensing, emissions controls, and safety standards. Right now the crypto world is the equivalent of a small number of people driving around in tanks, occasionally running over a crowd of people, with no highway patrols able to do anything about it.