3 ms·

Would be nice, but there would quite a lot of analysis needed to be able to determine any of that. Which you can't start until the file is public.

by tyingq 3y ago

SahAssar 3y ago
Sure, but instead of saying "Boeing leaked 45GB" it would say "Boeing leaked files of undetermined severity". The disk size does not matter, and when the severity was actually determined it would show up in the headlines as "Boeing leak determined to be a level 3 leak" instead of just being "That boeing leak 5 months ago was kinda bad". Either way, listing the size says very little.
- xcv123 3y ago
  These are journalists publishing breaking news. They are not autistic IT professionals. Relevant quote from the article: "I haven’t gone over the whole data set but Boeing emails and a few others stand out as useful for those with malicious intent"
  - SahAssar 3y ago
    Journalists are almost never deep experts of the fields they report on (although I hope well versed), but given the tools to report the news in a way that is more understandable to the public I think they will use them. Both journalists and the public need a better way to understand how different breaches affect them.
    - xcv123 3y ago
      As someone wrote earlier, they won't know the severity until it is analyzed. That could take a long time. Days or weeks. This is just the breaking news. Also what incentive does anyone have to waste their free time analyzing the data and issuing a report to you after this headline that the general public will not give a shit about a few days later?
      - SahAssar 3y ago
        I'm not saying to delay the report. I'm saying to not headline the size of the leak unless it has some sort of significance. If the severity is later known report that as news. If anything this would create two stories where there now is one, so journalists would not have less or later to report.
        deleted 3y ago
        [deleted]
  - vinaypai 3y ago
    > They are not autistic IT professionals. What does autism have to do with having the professional integrity to understand what it is you're writing about before publishing sensational claims?
    - deleted 3y ago
      [deleted]
rebolek 3y ago
I believe that Boeing already did than analysis and determined it’s #6.
- tyingq 3y ago
  At this point, I think there's quite a lot of "breach fatigue" now where the general public doesn't care about these stories. It's just "oh, I guess I get another year of free identity theft services".
cvoss 3y ago
Well, first, I'd expect Boeing already had some idea of the scope of what was compromised simply by investigating their own systems. After all, they knew enough to declare there was no impact on flight safety. And second, even if a company has no idea of the scope, the hackers would somehow want to prove at least privately what the scope was, else their threat is not as manipulative as it could be. On the other hand, the hackers can't credibly bluff and inflate the scope too far beyond reality because the company can just say "prove it or I don't believe you and I won't pay." And the hackers want to get paid. It's a business deal after all. A really crappy one involving criminals. But at the end of the day, the company must have already assessed the value of the leak in order to reach a decision.
- tyingq 3y ago
  >I'd expect Boeing already had some idea of the scope of what was compromised I've seen companies say this sort of thing with high confidence. But that seems hard to me, assuming some level of administrative access was breached.

Would be nice, but there would quite a lot of analysis needed to be able to determine any of that. Which you can't start until the file is public.

by tyingq 3y ago

Would be nice, but there would quite a lot of analysis needed to be able to determine any of that. Which you can't start until the file is public.

SahAssar 3y ago

Sure, but instead of saying "Boeing leaked 45GB" it would say "Boeing leaked files of undetermined severity". The disk size does not matter, and when the severity was actually determined it would show up in the headlines as "Boeing leak determined to be a level 3 leak" instead of just being "That boeing leak 5 months ago was kinda bad". Either way, listing the size says very little.

xcv123 3y ago
These are journalists publishing breaking news. They are not autistic IT professionals. Relevant quote from the article: "I haven’t gone over the whole data set but Boeing emails and a few others stand out as useful for those with malicious intent"
- SahAssar 3y ago
  Journalists are almost never deep experts of the fields they report on (although I hope well versed), but given the tools to report the news in a way that is more understandable to the public I think they will use them. Both journalists and the public need a better way to understand how different breaches affect them.
  - xcv123 3y ago
    As someone wrote earlier, they won't know the severity until it is analyzed. That could take a long time. Days or weeks. This is just the breaking news. Also what incentive does anyone have to waste their free time analyzing the data and issuing a report to you after this headline that the general public will not give a shit about a few days later?
    - SahAssar 3y ago
      I'm not saying to delay the report. I'm saying to not headline the size of the leak unless it has some sort of significance. If the severity is later known report that as news. If anything this would create two stories where there now is one, so journalists would not have less or later to report.
      - deleted 3y ago
        [deleted]
- vinaypai 3y ago
  > They are not autistic IT professionals. What does autism have to do with having the professional integrity to understand what it is you're writing about before publishing sensational claims?
  - deleted 3y ago
    [deleted]

rebolek 3y ago

I believe that Boeing already did than analysis and determined it’s #6.

tyingq 3y ago
At this point, I think there's quite a lot of "breach fatigue" now where the general public doesn't care about these stories. It's just "oh, I guess I get another year of free identity theft services".

cvoss 3y ago

Well, first, I'd expect Boeing already had some idea of the scope of what was compromised simply by investigating their own systems. After all, they knew enough to declare there was no impact on flight safety. And second, even if a company has no idea of the scope, the hackers would somehow want to prove at least privately what the scope was, else their threat is not as manipulative as it could be. On the other hand, the hackers can't credibly bluff and inflate the scope too far beyond reality because the company can just say "prove it or I don't believe you and I won't pay." And the hackers want to get paid. It's a business deal after all. A really crappy one involving criminals. But at the end of the day, the company must have already assessed the value of the leak in order to reach a decision.

tyingq 3y ago
>I'd expect Boeing already had some idea of the scope of what was compromised I've seen companies say this sort of thing with high confidence. But that seems hard to me, assuming some level of administrative access was breached.