3 ms·

How can anyone make any assertions about unknown unknowns? It's one thing to say "My car was stolen", and another to declare "I am unable to determine if it's

How can anyone make any assertions about unknown unknowns? It's one thing to say "My car was stolen", and another to declare "I am unable to determine if it's en route to the Taliban."

upsidesinclude 4y ago
That isn't a reasonable analogy in any way. The only thing that could happen with the data would be that it is exploited. The only thing that happens to stolen cars is not going to the taliban. These are not even similar in nature. They aren't saying "the data was stolen". They also aren't saying "the data was available for exploit we are unable to determine if that occured." What if they never looked for evidence of unauthorized access? They wouldn't have any! This is the same as modern science and medicine frequently using this academic phrase, no evidence, when what they mean is that there has been no investigation.
execveat 4y ago
You can make positive assertions though. E.g. attack might have been simple in which case it's possible to produce indicators that cover 100% of variants. Or it could have been complex and indicators either don't cover every possible attack or they produce large number of false positives. Another thing to mention would be how long in the past you were able to look. E.g. in this case they have found out that the bug was introduced in 2021, were they able to inspect logs covering all of that period or did they only had limited logs/other evidence so it's impossible to know whether anyone used this opportunity or not?
autoexec 4y ago
It's more like saying "I left my car in a shady neighborhood unattended for 72 hours with the doors open and the key left in the ignition but I haven't been keeping track of the millage or the fuel level so I'm not aware that anyone used it while I was away." Nothing would have stopped someone from using it. Probably best to assume that they have.
Lutger 4y ago
Its not an unknown unknown. If there's a vulnerability and you're a hot target, you know there's a decent chance of getting exploited.

How can anyone make any assertions about unknown unknowns? It's one thing to say "My car was stolen", and another to declare "I am unable to determine if it's en route to the Taliban."

upsidesinclude 4y ago

That isn't a reasonable analogy in any way. The only thing that could happen with the data would be that it is exploited. The only thing that happens to stolen cars is not going to the taliban. These are not even similar in nature. They aren't saying "the data was stolen". They also aren't saying "the data was available for exploit we are unable to determine if that occured." What if they never looked for evidence of unauthorized access? They wouldn't have any! This is the same as modern science and medicine frequently using this academic phrase, no evidence, when what they mean is that there has been no investigation.

execveat 4y ago

You can make positive assertions though. E.g. attack might have been simple in which case it's possible to produce indicators that cover 100% of variants. Or it could have been complex and indicators either don't cover every possible attack or they produce large number of false positives. Another thing to mention would be how long in the past you were able to look. E.g. in this case they have found out that the bug was introduced in 2021, were they able to inspect logs covering all of that period or did they only had limited logs/other evidence so it's impossible to know whether anyone used this opportunity or not?

autoexec 4y ago

It's more like saying "I left my car in a shady neighborhood unattended for 72 hours with the doors open and the key left in the ignition but I haven't been keeping track of the millage or the fuel level so I'm not aware that anyone used it while I was away." Nothing would have stopped someone from using it. Probably best to assume that they have.

Lutger 4y ago

Its not an unknown unknown. If there's a vulnerability and you're a hot target, you know there's a decent chance of getting exploited.