5 ms·

> What precautions and safety measures does the NCSC take when scanning? > The NCSC is committed to conducting scanning activities in a safe and responsible ma

> What precautions and safety measures does the NCSC take when scanning? > The NCSC is committed to conducting scanning activities in a safe and responsible manner. As such, all our probes are verified by a senior technical professional and tested in our own environment before use. We also limit how often we run scans to ensure we don’t risk disrupting the normal operation of systems. That is it? So... One gal looks at in and says, yep, fire up the guns! All is go!? Can I see the publish test? Can I see your "own environment"? What will they do if (when) this service gets whacked and delivers a DoS on a bunch of sites? Send the webmaster a free credit check? How does cloudflare, akamai, and similar feel about this? Personally, I would not trust my dog's toothbrush to any gouvernement. I would be happy to see this if it was opt in. In my opinion, they should have spent all the money on securing themselves, increase their own security education, increase security staff compensation to get higher caliber staff, and public education.

technion 4y ago
There's a reality that the second you put something on the Internet it starts being scanned by bots and bad actors. The problem with the various "checking your door is locked" analogies is that you'd have to picture a locksmith putting in a door with five bad actors lined up behind up waiting to check it immediately. The HN crowd is probably thinking about startups with in-house apps, but the canonical case for this argument is the Microsoft Exchange or Confluence servers that are consistently abused by ransomware actors - which then go on to cost that Government a lot of money as they get dragged into suppliers and contractors being held up for ransom, or investigatory resources being spent in response. It's very easy to tell who owns such a server, and being proactive helps address that. It's fine to "not trust", but if this service poses any more of a threat to an organisation than the dozens of services already running you've got other issues.
inferiorhuman 4y ago
Personally, I would not trust my dog's toothbrush to any gouvernement. From https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Eschew flamebait. Avoid generic tangents. Omit internet tropes. Please don't use Hacker News for political or ideological battle. It tramples curiosity. Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead.
nimbius 4y ago
more realistically id venture a guess this is a UK Gov agency trying desperately to justify its budget by getting overzealous with their Nessus scanning and then cowering behind the union jack when it comes time for public comment. curious to know how long until the scanning source IP's wind up in my pihole.
- autoexec 4y ago
  I wish every government would try "desperately to justify its budget" by actually providing useful services for the people that make the global internet a better place for everyone.
autoexec 4y ago
> I would be happy to see this if it was opt in. Opt in would miss exactly the sites they're targeting. People who don't bother to even think about security let alone do anything about security since as long as it works for them they don't care what happens to anyone else or their data. Opt in would also miss anyone who has been setting up their servers/sites maliciously or acting as safe havens for crime for profit. If these scans end up causing problems they should be on the hook for damages, but I'm glad they aren't waiting around for people to find them and reach out begging for scans. The responsible people keeping up with security issues and doing things proactively are rarely the problem and do their own scanning already.
tfsh 4y ago
This is no different to Crawlers used in web-indexing projects (google, duckduckgo, baidu, Apple Siri). You dislike this not because it could be defined as invasive (it's not), or because it could DoS websites (it won't). You dislike this because it's done by the government. The gov spending money on this endeavour hardly bleeds the coffers dry nor does it prevent investment in other sectors. This kind of radical, tech-first thinking is the kind of thing we should appluad the governments IT service for doing, because not too long ago there was virtually no innovation, anything tech related was offloaded to incompetent contractors such as Accenture and Deloitte. In fact you're contradicting yourself in multiple ways. > "[should have spent money on] public education.": this can be defined as public education. > "increase security staff compensation": as noted, not too long ago lots of this work was delegated to contractors. This is a step in the right direction and soon we can hope the compensation will increase. > "increase their own security education": have you got a source which states software engineers working for the gov aren't educating themselves? > "That is it? So... One gal looks at in and says, yep, fire up the guns!": What were you expecting, a full panel of industry experts scrutinising the code followed up with a parliamentary committee? This is called a peer code review, a rather simple process which you'll find at any tech firm.
YetAnotherNick 4y ago
I don't think their scans are more complicated than anyone could generate via metasploit, or worse a moderately good security engineer would likely run after pentesting your site for hours. If your site get whacked by non malicious intent payload, you should thank them that they prevented anyone fro directly starting with malicious intent.

technion 4y ago

There's a reality that the second you put something on the Internet it starts being scanned by bots and bad actors. The problem with the various "checking your door is locked" analogies is that you'd have to picture a locksmith putting in a door with five bad actors lined up behind up waiting to check it immediately. The HN crowd is probably thinking about startups with in-house apps, but the canonical case for this argument is the Microsoft Exchange or Confluence servers that are consistently abused by ransomware actors - which then go on to cost that Government a lot of money as they get dragged into suppliers and contractors being held up for ransom, or investigatory resources being spent in response. It's very easy to tell who owns such a server, and being proactive helps address that. It's fine to "not trust", but if this service poses any more of a threat to an organisation than the dozens of services already running you've got other issues.

inferiorhuman 4y ago

Personally, I would not trust my dog's toothbrush to any gouvernement. From https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Eschew flamebait. Avoid generic tangents. Omit internet tropes. Please don't use Hacker News for political or ideological battle. It tramples curiosity. Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead.

nimbius 4y ago

more realistically id venture a guess this is a UK Gov agency trying desperately to justify its budget by getting overzealous with their Nessus scanning and then cowering behind the union jack when it comes time for public comment. curious to know how long until the scanning source IP's wind up in my pihole.

autoexec 4y ago
I wish every government would try "desperately to justify its budget" by actually providing useful services for the people that make the global internet a better place for everyone.

autoexec 4y ago

> I would be happy to see this if it was opt in. Opt in would miss exactly the sites they're targeting. People who don't bother to even think about security let alone do anything about security since as long as it works for them they don't care what happens to anyone else or their data. Opt in would also miss anyone who has been setting up their servers/sites maliciously or acting as safe havens for crime for profit. If these scans end up causing problems they should be on the hook for damages, but I'm glad they aren't waiting around for people to find them and reach out begging for scans. The responsible people keeping up with security issues and doing things proactively are rarely the problem and do their own scanning already.

tfsh 4y ago

This is no different to Crawlers used in web-indexing projects (google, duckduckgo, baidu, Apple Siri). You dislike this not because it could be defined as invasive (it's not), or because it could DoS websites (it won't). You dislike this because it's done by the government. The gov spending money on this endeavour hardly bleeds the coffers dry nor does it prevent investment in other sectors. This kind of radical, tech-first thinking is the kind of thing we should appluad the governments IT service for doing, because not too long ago there was virtually no innovation, anything tech related was offloaded to incompetent contractors such as Accenture and Deloitte. In fact you're contradicting yourself in multiple ways. > "[should have spent money on] public education.": this can be defined as public education. > "increase security staff compensation": as noted, not too long ago lots of this work was delegated to contractors. This is a step in the right direction and soon we can hope the compensation will increase. > "increase their own security education": have you got a source which states software engineers working for the gov aren't educating themselves? > "That is it? So... One gal looks at in and says, yep, fire up the guns!": What were you expecting, a full panel of industry experts scrutinising the code followed up with a parliamentary committee? This is called a peer code review, a rather simple process which you'll find at any tech firm.

YetAnotherNick 4y ago

I don't think their scans are more complicated than anyone could generate via metasploit, or worse a moderately good security engineer would likely run after pentesting your site for hours. If your site get whacked by non malicious intent payload, you should thank them that they prevented anyone fro directly starting with malicious intent.