4 ms·

From an IT security perspective this sounds detached from reality to me. If one kid can do this to your organization, someone isnt doing their job. Given econom

From an IT security perspective this sounds detached from reality to me. If one kid can do this to your organization, someone isnt doing their job. Given economic competitors, hostile nation state actors and the possible stock market impacts, this isnt a matter of people having had better things to do. They had this to do and they didnt. The resulting extra cost is how you get your company to fix these things. Yes its hard, no it doesnt mean you get to ignore it because police will handle it. Not a moral argument but a very practical one. If somebody like that manages to find a hole in your process big enough to exploit yet dumb enough to get caught you should feel really lucky that nothing worse happened (that you know of) with the hole you just got notified you had all along.

dghlsakjg 3y ago
It wasn’t one kid. It was an international group of at least three people (known so far), and likely more. Yeah. If you keep your gold in a glass box, don’t be surprised when someone with a hammer steals it. But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.
- cf1241290841 3y ago
  >It was an international group of at least three people (known so far), and likely more. I dont think this is changing the argument in terms of competence and dedication of the attacker to a meaningful degree. We are still talking about a small group of people without a sensible monetization angle involving somebody who couldnt keep his mouth shut long enough to not get put into a mental ward indefinitely. Its very much the bottom of the barrel in terms of attackers. >But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society. I would also reiterate that you are making a moral argument about how society ought to be on a human level. Whether or not this is appropriate for human interaction, its really detrimental to running companies. I am making a practical argument on an economical level, companies need the negative incentive to run efficiently. Without they are unable to allocate resources to keep running, they fundamentally lack foresight without incentives. Management needs such cases to justify investment into security they need against determined competent attackers that are otherwise hard to visualize. And you cant get rid of attackers through law enforcement for the geopolitical reasons alone. You just make the risk invisible and companies more vunerable. While his behavior might be antisocial if it had happened on a human level, it was beneficial and of vital importance to the company (and economic sector) he attacked. Its just that asscovering by the people responsible made it hard to acknowledge that. Not saying he is a great guy, his personal behavior towards his fellow humans seems to have quite a bit of room for improvement. But dealing with him above that seems to be petty, counter productive asscovering.

dghlsakjg 3y ago

It wasn’t one kid. It was an international group of at least three people (known so far), and likely more. Yeah. If you keep your gold in a glass box, don’t be surprised when someone with a hammer steals it. But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.

cf1241290841 3y ago
>It was an international group of at least three people (known so far), and likely more. I dont think this is changing the argument in terms of competence and dedication of the attacker to a meaningful degree. We are still talking about a small group of people without a sensible monetization angle involving somebody who couldnt keep his mouth shut long enough to not get put into a mental ward indefinitely. Its very much the bottom of the barrel in terms of attackers. >But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society. I would also reiterate that you are making a moral argument about how society ought to be on a human level. Whether or not this is appropriate for human interaction, its really detrimental to running companies. I am making a practical argument on an economical level, companies need the negative incentive to run efficiently. Without they are unable to allocate resources to keep running, they fundamentally lack foresight without incentives. Management needs such cases to justify investment into security they need against determined competent attackers that are otherwise hard to visualize. And you cant get rid of attackers through law enforcement for the geopolitical reasons alone. You just make the risk invisible and companies more vunerable. While his behavior might be antisocial if it had happened on a human level, it was beneficial and of vital importance to the company (and economic sector) he attacked. Its just that asscovering by the people responsible made it hard to acknowledge that. Not saying he is a great guy, his personal behavior towards his fellow humans seems to have quite a bit of room for improvement. But dealing with him above that seems to be petty, counter productive asscovering.