3 ms·

Right but your perception of who is the “bottom fish” is wrong. The worst tech company is not the bottom fish, schools and hospitals are. You can hold medical

Right but your perception of who is the “bottom fish” is wrong. The worst tech company is not the bottom fish, schools and hospitals are. You can hold medical records and pipelines hostage and get just as much money as holding Google info hostage. And I don’t think the “evitabile be hacked” approach is helpful. The harder you make something to hack, the more hackers may turn to other forms of income. Sure we will never be free of them, but the more resources they have to put in to be successful, the less there will be. Why is there less piracy in the Caribbean? Are there less able-bodied men? Certainly not. It’s harder to get away with robbery on the open seas. (At least off of US shores). Make it harder to hack, and less will hack.

Veserv 3y ago
You will inevitably be hacked if you use prevailing commercial IT solutions, period. The absolute "best" solutions they can muster can not make it hard enough to deter financially motivated attackers and the existing attackers already have enough resources to invest to exploit the opportunities that are beyond the limit of the "best" solutions. They can invest anything up to $1M to get $10M paydays like clockwork. If you could do that would you stop before exploiting the entire market? A rhetorical question because that is literally what is happening right now. All raising the cost of attacking every company to the "best practices" limit of $1M is kill all the new entrants and maybe slow the growth rate of the incumbents. Is there some value in doing that? Sure. But all you are doing is slowing the growth, not fixing the problem. At this point the only way to fix the problem now that there are mature incumbents is to make the upper-end attacks unprofitable or at least make them require more startup capital than they can invest in new exploitation opportunities. This requires making the systems secure against teams of highly skilled attackers with tens of millions of dollars to spend and years to design a successful attack. Literally nobody in the commercial IT sector believes that is even possible but they aggressively insinuate that they can solve your cybersecurity woes. It is all total bullshit. Literally every single one of them is peddling snake oil, but people believe it solves their problems so they do not need to look any further. The problem will only get solved when they realize they are totally screwed and nothing that the cyber(in)security vendors can sell them will fix it. Only if you understand that your computer systems are trivial to hack by motivated attackers will you do things very differently than if you do not know the truth. It might even lead you to try finding a real solution, but at the very least it will change your behavior to better account for the reality of your situation.

Veserv 3y ago

You will inevitably be hacked if you use prevailing commercial IT solutions, period. The absolute "best" solutions they can muster can not make it hard enough to deter financially motivated attackers and the existing attackers already have enough resources to invest to exploit the opportunities that are beyond the limit of the "best" solutions. They can invest anything up to $1M to get $10M paydays like clockwork. If you could do that would you stop before exploiting the entire market? A rhetorical question because that is literally what is happening right now. All raising the cost of attacking every company to the "best practices" limit of $1M is kill all the new entrants and maybe slow the growth rate of the incumbents. Is there some value in doing that? Sure. But all you are doing is slowing the growth, not fixing the problem. At this point the only way to fix the problem now that there are mature incumbents is to make the upper-end attacks unprofitable or at least make them require more startup capital than they can invest in new exploitation opportunities. This requires making the systems secure against teams of highly skilled attackers with tens of millions of dollars to spend and years to design a successful attack. Literally nobody in the commercial IT sector believes that is even possible but they aggressively insinuate that they can solve your cybersecurity woes. It is all total bullshit. Literally every single one of them is peddling snake oil, but people believe it solves their problems so they do not need to look any further. The problem will only get solved when they realize they are totally screwed and nothing that the cyber(in)security vendors can sell them will fix it. Only if you understand that your computer systems are trivial to hack by motivated attackers will you do things very differently than if you do not know the truth. It might even lead you to try finding a real solution, but at the very least it will change your behavior to better account for the reality of your situation.