3 ms·

I'm divided on this one. On one hand, I can see a lot of good in this, because, well, I'm on HN. On the other hand, I think people would find it weird that any

I'm divided on this one. On one hand, I can see a lot of good in this, because, well, I'm on HN. On the other hand, I think people would find it weird that anybody would be allowed to do that IRL with physical building, so why allow it on the internet? Given that the consequences of probing a website are less than cracking on an office, and the surface of attack bigger on a website, with potentially a larger cascade, I think I can find more arguments for than against. But it's not so easy to answer.

risyachka 3y ago
Like with physical business, if you can't guarantee proper security - you should not be in this business. Companies cut costs on cyber security whenever they can. And if you try to expose it you can get sued. It's about time this ends. Hopefully everywhere soon.
- BiteCode_dev 3y ago
  There are millions of small businesses that have an online presence and no way to protect themselves against a physical building penetration. Heck, most administrations can't. A small town city council cannot be expected to have the budget or expertise to deal with someone trying to break in.
- karaterobot 3y ago
  > Like with physical business, if you can't guarantee proper security - you should not be in this business. What's an example of a business that can guarantee proper physical or computer security? I can't think of any. All I know about managing security is that you first acknowledge that you can't ever be completely safe. I'll assume you mean they guarantee that they have done due diligence to reduce their threat profile — which isn't really saying much either.
mindslight 3y ago
The physical world and the Internet are completely different environments, and analogies don't transfer. In the physical world attackers are resource constrained, create evidence that allows for attribution, post-facto enforcement is mostly successful, attacks are mostly destructive, and security can only ever be "good enough" bar. Meanwhile in the electronic word, many attacks can be easily scaled/automated so they're always happening, attribution is very hard, there's little post-facto enforcement especially across borders, most attacks don't do much damage in and of themselves, and most security problems are logic bugs which are yes/no affairs. It's not particularly interesting if a "white hat" physical attacker demonstrated they could get into a safe with a drill over the course of a week. And one probably can walk down a street testing businesses' doors after hours without too many repercussions if you're dressed nice and don't fit the cops' stereotype of "criminal". Also there's a huge tendency in the digital security world for system owners to play up damages from minor break ins or even mostly innocuous actions (eg port scans), to distract from the humiliation of themselves having failed. And if we did want to make punishment more in line with real world analogs, then the penalty for most unauthorized accesses should be akin to misdemeanor trespassing.
- BiteCode_dev 3y ago
  Your last point makes a lot of sense actually, although pretty hard to convey to the general population.
lucb1e 3y ago
> so why allow it on the internet? I find this weird also. The explanation I've been able to come up with is that there isn't prosecution on the internet the way that there is IRL. You're just screwed if you got hacked by someone whose VPN provider didn't already have a tap order in place on this customer. Without deterrence, the only remaining thing you can do is make it impossible to perform in the first place.

risyachka 3y ago

Like with physical business, if you can't guarantee proper security - you should not be in this business. Companies cut costs on cyber security whenever they can. And if you try to expose it you can get sued. It's about time this ends. Hopefully everywhere soon.

BiteCode_dev 3y ago
There are millions of small businesses that have an online presence and no way to protect themselves against a physical building penetration. Heck, most administrations can't. A small town city council cannot be expected to have the budget or expertise to deal with someone trying to break in.
karaterobot 3y ago
> Like with physical business, if you can't guarantee proper security - you should not be in this business. What's an example of a business that can guarantee proper physical or computer security? I can't think of any. All I know about managing security is that you first acknowledge that you can't ever be completely safe. I'll assume you mean they guarantee that they have done due diligence to reduce their threat profile — which isn't really saying much either.

mindslight 3y ago

The physical world and the Internet are completely different environments, and analogies don't transfer. In the physical world attackers are resource constrained, create evidence that allows for attribution, post-facto enforcement is mostly successful, attacks are mostly destructive, and security can only ever be "good enough" bar. Meanwhile in the electronic word, many attacks can be easily scaled/automated so they're always happening, attribution is very hard, there's little post-facto enforcement especially across borders, most attacks don't do much damage in and of themselves, and most security problems are logic bugs which are yes/no affairs. It's not particularly interesting if a "white hat" physical attacker demonstrated they could get into a safe with a drill over the course of a week. And one probably can walk down a street testing businesses' doors after hours without too many repercussions if you're dressed nice and don't fit the cops' stereotype of "criminal". Also there's a huge tendency in the digital security world for system owners to play up damages from minor break ins or even mostly innocuous actions (eg port scans), to distract from the humiliation of themselves having failed. And if we did want to make punishment more in line with real world analogs, then the penalty for most unauthorized accesses should be akin to misdemeanor trespassing.

BiteCode_dev 3y ago
Your last point makes a lot of sense actually, although pretty hard to convey to the general population.

lucb1e 3y ago

> so why allow it on the internet? I find this weird also. The explanation I've been able to come up with is that there isn't prosecution on the internet the way that there is IRL. You're just screwed if you got hacked by someone whose VPN provider didn't already have a tap order in place on this customer. Without deterrence, the only remaining thing you can do is make it impossible to perform in the first place.