26 ms·

Cyber Security: A pre-war reality check

593 points by edent 2y ago

sans_souse 2y ago
At times it's a bit difficult to read, as it seems to be a telescript of a speech. But the overall gist and main topic are one that needs much more attention sooner rather than later/never.
- nonrandomstring 2y ago
  My colleagues and I submitted a similar talk/paper for a different NCSC conference (but weren't accepted). I see that this talk by Bert Hubert covers mostly the ground. so I am pleased, but worried about what this take misses out. Hubert is addressing much of the ground that lies between security and resilience. Our emphasis is on how mitigation lies in education and autonomous systems over regulation. Not that regulation is wrong, just that it doesn't work as a stick without a carrot. We also looked at timescales and how so much is already too late because of the lag-time from drafting to efficacy. And what I know from hanging out here on HN is that technologists appear hostile to regulation, but giant companies love it so long as they get to write the rules that give them more monopoly power. Where we went wrong I think is lack of political tact. Hubert stops himself from even finishing off the remark about the quality of Microsoft products. But I don't think the real problem can be ignored for much longer. Instead, we went all-in and emphasised (as previously here [0]) that "Big Tech is the cybersecurity problem" (as Bruce Schniere recently echoed) because it pushes (in addition to highly centralised single points of failure) an irresilient "insecurity industry" that is based on protection not security. Hubert's talk doesn't get to the key issue; Security and protection are not the same thing. Protection leads to dependency that ultimately erodes real security. However "protection" is easy and profitable to sell. Real security is not. That is ths succinct way in which it must be put. If the intel appraisal is accurate and we are entering a serious war footing than we can have no more patience for the profitable but dangerous "insecurity industry" that gives an appearance and simulation of security, without the reality. [0] https://techrights.org/o/2021/11/29/teaching-cybersecurity/ https://techrights.org/o/2021/11/29/teaching-cybersecurity/
  - m3047 2y ago
    "Security" is not the same thing itself, it cleaves meaning: 1) Hypervigilance; which is unsustainable. 2) Carefree ease; which is what the champion Red Bull athlete achieves from constant practice and repetition. I thank Kelly Shortridge (https://kellyshortridge.com/blog/posts/ https://kellyshortridge.com/blog/posts/) for pointing out the cleavage.
    - nonrandomstring 2y ago
      These are interesting distinctions. I'm working on distinguishing a whole cluster of things that frequently get collaopsed into the same mushy confusion; security, safety, reliability, resilience, protection, sustainability... And there's also inner and outer security, which I think your remark addresses. Thanks for the link which I wasn't aware of.
  - m3047 2y ago
    @nonramdonstring: The email address hr@... in your profile is broken. You're welcome to try the one in my profile.
    - nonrandomstring 2y ago
      Thankyou for telling me. I may have missed other coms, my apologies.
    - m3047 2y ago
      In spite of my typo in the parent, I really did send to hn@. I just checked the bounce to be sure.
ahubert 2y ago
Author here - if you have any questions, please do let me know!
- wyldberry 2y ago
  No questions, but as a security person, I found this to be aligned with the view of many of the people i consider to have a good pulse on the warfare side of security. You're certainly not alone in these thoughts and efforts to fix.
- nonrandomstring 2y ago
  Very good. Well said and most enjoyable.
- skybrian 2y ago
  This is off topic, but I’m idly curious about the history of shipbuilding regulatory changes after the Titanic. Where did Brenno de Winter learn about them?
- auct 2y ago
  What were the vulnerabilities in your 1600 lines imgur alternative?
  - ahubert 2y ago
    https://github.com/berthubert/trifecta/blob/main/README.md#known-problems https://github.com/berthubert/trifecta/blob/main/README.md#k... has a list. The most painful one for me is that I did not know .svg files can contain javascript that gets executed in the site context if you can get someone to click on a link to your .svg file!
    - softsound 2y ago
      That's one of the reasons SVG is often a third party plug-in with WordPress it's because of all the security involved.
    - yread 2y ago
ThomasBb 2y ago
Bert is a national treasure. We need more Bert in our lives!
- ahubert 2y ago
  blush :-)
- zelag 2y ago
  Not to be confused with Bert Kreischer, the unfunny comedian.
simmerup 2y ago
It does feel mad that we outsource so much of our national infrastructure maintenance to China. When/if they invade Taiwan, how are we going to do anything when they have that sort of leverage over us? It was bad enough with Russias gas
- gds44 2y ago
  Well US is not dependent on anyone for her Energy needs. Unlike China. Its quite vulnerable on that front if a few pipelines blow up ala nord stream. This is also why the US has such a large presence in the middle east.
  - croes 2y ago
    But you can pretty easily bring down their power grid
    - vundercind 2y ago
      Good point. Factories ain’t shit without power. If we can’t get stuff from China, that hurts, a lot. If China can’t get stuff from China, they’re dead.
  - Dalewyn 2y ago
    >Well US is not dependent on anyone for her Energy needs. China's strength is they have the means of production (and maintenance) of everyone today, including the US. All the energy in the world means jack squat when all the means of using that energy rely on China. Could the west regain our own means of production? Certainly, but it's going to take far too long at the point China starts pursuing Bigger Gun Diplomacy. We're talking multiple decades to reachieve what we've surrendered, perhaps even the better part of a century because we simply don't have the ambition and political will to do so. I think China has been very shrewd with how they conducted themselves in the past half century or so. They've already won most wars they might be involved in before they start by seizing the economies of their supposed enemies.
    - 2y ago
crocal 2y ago
I cannot agree more with the author’s point of view. As an illustration, many people want to use GPS for the safe positioning of trains in the European Train Control Systems. This makes the space sector happy because it justifies the expenditures incurred for putting things like Galileo in orbit. However, in a pre-war check exercise, one immediately come to the conclusion that all European trains would crawl to a stop in case the GPS is jammed or interfered with. We were not very listened to… until Ukraine. Critical infrastructures should not depend from things that are located in space or on the other side of the planet. These are one of those things were market logic should be anticipated with regulations (we can’t wait for the next Titanic). Another point touched by the article.
- killjoywashere 2y ago
  Not sure I entirely agree? #1 > Or disable a hospital. The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February. Maybe it's more like the pandemic: seems like nothing, unless it affects you. https://en.wikipedia.org/wiki/Ascension_(healthcare_system) https://en.wikipedia.org/wiki/Ascension_(healthcare_system) https://www.wired.com/story/change-healthcare-admits-it-paid-ransomware-hackers/ https://www.wired.com/story/change-healthcare-admits-it-paid... #2 > Does your stuff need computers working 5,000 kilometers away? [implying that's bad] What if you live on the Gulf Coast, exposed to hurricanes? You want compute resources warm and ready far away from that region. After Katrina, the Tulane medical school was able to re-form quickly because the noteservice was running a bulletin board forum on a VM in Romania. Everything else was underwater. #3 > This is the sound-powered phone Have you used a sound-powered phone? I managed damage control in a ship. Sound powered phones barely works. And the coordination system to actually fight that fire requires radios and making overhead announcements that definitely depend on electrical power. #4 > They tried to sort of renew this emergency telephone network When the entire San Diego region lost power during rush hour for 4 hours in 2011, the cell phone system still worked. I was able to email documents to Tokyo from a car despite no traffic lights. #5 > Because if the cable to the US is down Sure, but there are a lot of disasters where the cables are fine. Graceful degradation is all about having widely distributed options. Lots of people have What. Signal is even better for people with more serious responsibilities, IMHO. And, friends, if you think IP networks are vulnerable, get yourself a starlink terminal and a HAM radio license. https://en.wikipedia.org/wiki/SpaceX_Starshield https://en.wikipedia.org/wiki/SpaceX_Starshield
rightbyte 2y ago
Who cares? In the case of some sort of big war why would you care about "cyber security" when the day to day problem is not dying from starvation, being drafted, radiation posioning or what ever the problem is. These kind of "we need to prepare" are silly since they implicitly downplay the severity of war and bring us closer to it.
- alephnerd 2y ago
  Everything is computerized now. And most adjacent power wars will most likely be non-nuclear in nature until it crosses a red line.
  - rightbyte 2y ago
    Everything being computerized is a major peace time concern too. Ideally systems should not be as centralized as they are now and have offline fallbacks. I believe there is a great deal of over automization too. You can notice how war mongerers have turned to "cyber threats" to instigate on unfalsifiable information. I feel it might be better to pull the plug on the whole internet if that actually is such a concern.
    - constantcrying 2y ago
      It is incredibly hard to maintain an unused system. The Internet is the default mode of communications because it outperforms all other options on most metrics. Any backup would go nearly totally unused and therefore couldn't be effectively used during an outage.
- croes 2y ago
  The day to day problem will mainly exist because our computer systems are down.
- constantcrying 2y ago
  The underlying assumption of e.g. food distribution are that a certain part of infrastructure remains intact. This assumption comes into greater question the more individual parts are dependant on large software installations. E.g. some countries have an entire redundant telecommunications network for government functions precisely so that it can actually withstand such a scenario. The more enmeshed that infrastructure is into other systems the more likely it is that it too will fail.
gostsamo 2y ago
Is there an enemy factor measure which reflects how many countries have to sanction/attack you directly before you are enable to maintain the economy and social services? It would be interesting to have an index of geostratigic resilience.
- nonrandomstring 2y ago
  Yes. Front analysis [0] and also critical path analysis are useful. Real graphs look like social networks, with some clusters and nodes with very high relational degree, and some with almost none. But for security they are more like dependency graphs rather than just attack paths as in Blotto. An adversary blockades/sabotages them or blocks those on which they depend etc. The more resilient graph is the best connected by alternative paths. Go back and look at some DARPA papers on route security in the formative "Internet". What we have today are very insecure graphs with millions of logical dependency links going in/out of single centres of functionality, and not much peer connectivity. Hit a few critical nodes and the whole lot goes down. [0] https://en.wikipedia.org/wiki/Blotto_game https://en.wikipedia.org/wiki/Blotto_game
- kjkjadksj 2y ago
  Cuba would be the most resilient nation on earth I’d guess
  - baobun 2y ago
    Why?
    - ragebol 2y ago
      They're boycotted out of a lot of stuff, yet still make due.
nickpeterson 2y ago
As an outsider on most IT security so take the rest of this with a grain of salt, but I think reliability is a good way to view this topic. Complexity is the enemy of reliability and security. Most organizations seem to operate under the delusion that you can brute force your way to security through audits and policy. They're trying to 'test the quality in' so to speak. Think of the legion of security admins who diligently tweak windows group policies, firewall settings, and systems like 2FA/MFA. Nobody can stomach the truth that most of these things have grown in complexity beyond their ability to be truly reliable. They're basically the IT equivalent of locks on a few doors of mansion with 80 windows, they prevent some crimes of opportunity but won't stop an attacker motivated by something else. This also doesn't tend to bother security people. It's interesting, it quickly shifts to, "Well we don't run a nuclear reactor..." or "We're not a cloud provider or a bank", so they think they're not critical infrastructure and crimes of opportunity are really their main threat (ransomware, disgruntled ex-employees, etc). Also, their job usually depends on tweaking the knobs in this complex pachinko machine, so to have some outsider tell them to throw it all away is basically like saying you think they should lose their job as well. I don't know where this rant should end, but I think if I was tasked with making infrastructure decisions, It would be really hard for me to not use things like OpenBSD and SQLite for a lot of it. I'm sure someone here will say actually those are bad for various reasons, but they at least seem to capture the ethos of, "We're going to just say no to things and try to control the complexity of this thing." They also don't seem very motivated by making money which tends to be the root of most compromising decisions.
- rustcleaner 2y ago
  Knowing how frail software out there really can be, I made moves to Qubes OS and GrapheneOS as my primary operating system distributions over a year ago. Haven't looked back since the first month! PC users should be using some kind of segregation like VMs these days; you most likely don't have a MAC policy protecting your files from your porn site bunker-busted browser, so your data is likely going up the pipe to North Korea (but you did make sure to be a user so at least it can't install the printer driver wrapped rootkit).
  - 2y ago
mikewarot 2y ago
When I recently asked some air traffic controllers what would happen if GPS became unavailable, it was grumpy sounds all around. I understand a scramble to vector everything to land everything would result in a very busy day for them, because suddenly most planes would be unable to safely navigate, and thus effectively grounded. Cutting the budget for ground based navaids is nuts, in my opinion.
- Rygian 2y ago
  I was under the impression that GPS was a non-critical asset for aviation, ie. any plane can safely stop using it at any given time and keep flying with VOR and other navigational aids. This article [1] introduces some of the scenarios where pilots rely on GPS only: * GPS-based waypoints to optimize routing based on favorable winds and more direct routes even in the absence of VORs. * RNAV departures and arrivals that rely "solely on GPS rather than radio-based [...] aids" with more precise spacing and hence higher capacity. * GPS used as a substitute of ILS for some approaches e.g. in mountainous areas. [1] https://simpleflying.com/gps-in-aviation-pilots-guide/ https://simpleflying.com/gps-in-aviation-pilots-guide/
  - xavxav 2y ago
    I would assume its not 'safety critical' but 'business critical', disabling GPS would mean slowing down departures / arrivals which means the airport losing money. I recall there being a similar issue with Lufthansa and SFO causing planes to get rerouted to oakland.
    - m3047 2y ago
      There's a meme driver with safety vs business critical and software types seem to think they're special (a different meme) but I'm starting to understand it's everywhere, which is why nobody notices the software issue creeping into their physical systems thinking. A "business critical" issue is defined by the appetite for risk. Most businesses aren't planning for total economic collapse: losing their accounts receivable is what that would look like. What they are concerned about is losing business to competitors or liability for not fulfilling contracts. Software seems to solve the latter problem with shrinkwrap agreements "not responsible for failure of software". That solves their liability problem; everybody else they'll sue. On the other hand "safety critical" concerns the loss of life or property: the things insurers are traditionally concerned with. So if the plane can land, engine out or GPS out what's the difference? Businesses absolutely care about safety, that's why they buy insurance! Safety programs reduce the need and cost for such insurance. Businesses aren't lying when they say they care about safety. However people swim in the ocean of systems without necessarily being systems thinkers: plugging a leak is plugging a leak. But a leaky roof is not the same as a leaky hull. All the people in cybersecurity warning of the dire consequences of breaches are proven wrong time and again by the market: look at the stock prices of Equifax, Solarwinds, United Health Care. It's not simply marketing, a lot of these people really Want To Believe (tm). In the end business is never safe, it's taking risks all the time. Mostly it doesn't see a need to share those risks with customers (or competitors).
roenxi 2y ago
> I know it sounds devastating, but you have to get used to the fact that a new era has begun. The pre-war era. It is madness that we're in a position where this can be baldly stated by a PM and there has been no "huh?" moment when people stop and assess how badly the broader West's military, economic and diplomatic efforts have failed over the last 30 odd years. Possibly longer. I wasn't expecting to see land wars in Europe even before the cold war ended. Humanity has unprecedented destructive power at our command and the systems that sustain 8 billion people are delicate. We can't afford to be in a "pre-war era" and act like this is just going to be something to deal with when we get to it plus a little prep in specialist domains.
- fabian2k 2y ago
  What kind of diplomacy would have prevented Russia from invading its neighbours?
  - roenxi 2y ago
    Picking on Ukraine, the US not having a policy of signing new people up to the anti-Russia military alliance every few years [0] seems like low hanging fruit. Or not working to integrate their intelligence with the CIA [1] for the last decade. I don't speak German but apparently Merkle said that we weren't negotiating in good faith to keep the peace either [2]. These are the sort of thing I suspect Russia would see as escalatory. I certainly do. A better diplomatic policy would have been to encourage neutrality. The western powers weren't going out of their way to make sure that the situation stayed peaceful. We could have treated this as the Russian equivalent of the US invasion of Afghanistan or Iraq and let it go away. [0] https://en.wikipedia.org/wiki/Enlargement_of_NATO https://en.wikipedia.org/wiki/Enlargement_of_NATO [1] https://www.washingtonpost.com/world/2023/10/23/ukraine-cia-shadow-war-russia/ https://www.washingtonpost.com/world/2023/10/23/ukraine-cia-... [2] https://politics.stackexchange.com/questions/77139/what-position-exactly-did-merkel-express-about-the-minsk-agreements-in-this-dece https://politics.stackexchange.com/questions/77139/what-posi...
    - kibwen 2y ago
croes 2y ago
At the same time MS & Co. try to force everyone in to the cloud. So if MS Azure AD goes down everyone goes down too.
jeffrallen 2y ago
It is too bad he didn't follow up on "we give control to foreign clouds" with "we need European data sovereignty, our governments need to choose local cloud providers". Because they exist. I work for one. The cloud is just someone else's computer. But if that someone else is your neighbor, they may be motivated by the same things as you, and can contribute helpfully to your goals.
- ahubert 2y ago
  (author here) You might be interested in my writing on this very subject -> https://berthub.eu/articles/posts/cloud-naive-europe-and-the-megascaler/ https://berthub.eu/articles/posts/cloud-naive-europe-and-the...
gz5 2y ago
>Why did it happen? Non-technical people have made choices and have optimized for stuff being cheap. Yes and amplified by: + Cybersecurity 'bad actors' are decentralized and distributed. They innovate at speed, with no barriers, and share their innovation. Cybersecurity 'good actors' are centralized, proprietary and bounded. + Software and service providers traditionally couldn't build secure networking into their products - they had to delegate it to the consumer of the software or service for the consumer to implement as a day two bolt on. Dangerous when networking is often the largest and most vulnerable surface area.
- stalfosknight 2y ago
  Non-technical people should be stopped.
- jjav 2y ago
  > Cybersecurity 'good actors' are centralized, proprietary and bounded. IME the main problem is that, with rare exceptions, building secure products is seen as a distraction that is best pawned off to the cybersecurity team. And that cybersecurity team is more often than not fairly light on actual product development engineering talent. So they do what they can, which is mostly buy yet another tool from the thousands of vendors hawking The Answer, the final service you need to buy and then you'll be secure. Which to anyone who has built secure products, should obviously sound like nonsense. Because it is nonsense. Most of these tools are mildly useful (some useless) but not that great. They're certainly not The Answer. To build secure products you need to actually make it a tier one requirement and design it in from day one. It's as simple, and as difficult, as that.
javajosh 2y ago
He mentions the threat of remotely taking over autonomous vehicles, but really its any vehicle who's a) network connected and b) drive-by-wire. Which is why I won't buy one, and why the problem is even worse than it appears. The other problem that he doesn't address is the centralization of critical (and semi-critical, like logistics) software in large shared data-centers. If you wanted to disable large chunks of the American software economy for an extended period, you only have to kill ~100 buildings. In a way I think the ransomware people are doing us all a huge favor by putting the fear of God into executives around cybersecurity. Unfortunately, as other commenters have mentioned, the real problem is hard to address, because it's the complexity inherent in the "worse is better" philosophy. Current systems have grown in a lovely, nice environment that is generally reliable. When that environment changes quickly (which is one way to characterize a cyber attack) these systems will fail, and there will be no time or tools to repair them. This includes software and infrastructure hardware. Somewhat ironically, this is precisely the kind of non-extinction-level threat that "having a bunker" and a large store of food would actually get you through - something only executives can afford. Perhaps we might consider outlawing such bunkers to properly motivate the monied elite to address these issues.
constantcrying 2y ago
Very interesting article. I think the author makes a compelling point about the vulnerability of infrastructure. To be honest I wouldn't be surprised that in an actual unlimited war, between two major developed nations nothing will actually continue to function. None of the systems have ever been actually tested and still make assumptions about the rest of the infrastructure. I also don't believe that simplicity can fix this, everything already has deep built-in assumptions about everything else, which makes any replacement a daunting task.
- waveBidder 2y ago
  Well, every major city being eliminated by a nuke would also hamper these systems in a total war between developed countries.
cwillu 2y ago
I regret that I have but one upvote to give.
- vaylian 2y ago
  This is definitely one of the best submissions I've seen on HN. I don't think it helps with the ranking, but you can still favorite the thread.
  - ahubert 2y ago
    Thank you both :-) (author here)
tetha 2y ago
> So you can have a whole board full of people that studied history and art and French, and they sit there making our cloud decisions. And they simply don’t know. > And if there had been more nerds in that room, some of these things would not have happened. And that is also a call to maybe us nerds, although you don’t really look that nerdy, but do join those meetings. > Because quite often, we as technical people, we’re like, “Ah, these meetings are an interruption of my work, and I’m not joining that meeting.” And while you were not there, the company decided to outsource everything to India. Oof. This is hitting me hard on two levels. As I'm racking up years in the operational business, the best impact I can have isn't that I can understand log files twice as fast as the guy next to me. Many people can learn that. The bigger impact is to be able to connect the effects of technical decisions onto the overall business and vice-versa to higher management. Like, sure, I can rattle down a lot of technical requirements we need to self-host a highly available infrastructure, and I can rattle down a lot of the advantages of the cloud /in a small company situation/ and such. But that is largely useless to the CEO of a small and medium business. The more interesting statement is: Self-hosting requires a larger upfront and a larger continuous investment over time at a certain range of scale. You need to buy servers, firewall, switches, rent bandwidth and DC space and to hire people to take care of all of these. However, we can achieve a higher level of security and data protection on these systems and in the long run, we can become cheaper than the big cloud providers, because the current product-visions are already decently big. The cloud can be more flexible and innovate faster, but we will have more security discussions with our customers and the control over our systems will be lower, for better or worse. Put this way, we're setting up a pretty good self-hosted plan, which primarily uses the cloud as a way out if we or our DC hosters fuck up. This plan cost the company more money than the existing cloud infra would have for a year or two, but now it is starting to pay off and in a year or two, hardware extensions will be a welcome expense. But that is bringing me to a second point, deeper point: This only works because the board here is fine planning for benefits 3-5 years down the line. "In 2-3 years we'll be even", we said, and "in 3-5 years we'll be cheaper, a lot". We're even now 2 years after. If they were just maximizing next quarters profits, we probably would have migrated everything to AWS and just started shoveling more money across the Atlantic, making us highly dependent on cross-atlantic and US infrastructure. It would've been cheaper for a year or so. And this profit-maximizing mindset looming over good decisions and great tech is frustrating me. Generative AI is similar there to me. Generative AI should be something I should be excited about. For example, Runegate Studios cooperated ethically with Unleash the Archers and Bo Bradshaw to create a music video[1] in Bo's style we just wouldn't have without generative AI and it would never be created without. And like, sure, it's not Disney quality, but you're looking at ~10 people cooperating here. For that headcount, that video is amazing. But I know it will be used to slash jobs, prevent juniors from learning because AI is cheaper, ruin careers "because the AI can do 80% for less costs" and such. Short-term perspectives. And then in 10 years there will be a crisis of "Why can't we find good writers/cartoonists/musicians/... anymore?" Sorry for the TED-talk. I'm currently torn between a very excited and a very frustrated person. 1: https://www.youtube.com/watch?v=eLPMBD7i0IU https://www.youtube.com/watch?v=eLPMBD7i0IU
CJefferson 2y ago
I wonder if we, in secret, have “mutually assured destruction” of cyber-warfare. It seems like a reasonable assumption to me that major world powers probably have enough 0-days at any one time that they could use them together to format a significant proportion of the world’s computers and phones. It would be not be that hard to make these worms intelligently use IP to target particular countries. It’s hard for me to imagine how much damage it would do if I could wipe even say 25% of all work and home computers, maybe every phone not updated in the last 6 months, and a decent chunk of online servers.
- hollerith 2y ago
  >It seems like a reasonable assumption to me that major world powers probably have enough 0-days at any one time that they could use them together to format a significant proportion of the world’s computers and phones. If that is true, then how come we have not heard much about erasure of data on phones and computers in Ukraine by Russian hackers? Please don't say that the Kremlin is holding its 0-days in reserve for a more serious conflict! the Kremlin sees the Ukraine situation as extremely serious for Russian national security. It uses large numbers of missiles costing over a million dollars each to degrade Ukraine's electrical grid. It has attempted to assassinate the president of Ukraine many times. Why wouldn't it be all-out trying to do as much damage as possible to Ukraine through cyberattacks?
  - r2_pilot 2y ago
    In point of fact, Ukraine has been hacked, multiple times during this conflict, and they were hardly damaging. This is in large part due to the fact that this particular conflict(hacking in particular) has been going on longer than just the start of the official war, so Ukraine has been hardening its systems significantly for many years. It goes to show that with dedication, even nation-state actors can be stymied with defense-in-depth.
  - kjkjadksj 2y ago
    Probably for the same reason why they aren’t using their nuclear weaponry.
throwaway22032 2y ago
Tough times create tough men comes to mind. Leadership in the UK is absolutely pitiful. Yes, you can work on multiple problems at once, but in reality both the public and private discourse is focused on utterly trivial and stupid stuff. The top level goals of a government are to ensure that the state exists and can protect its' citizens. We enacted income taxes on that basis in the first place for wars. Now we have people arguing the toss over whether cars should emit a particular thing because it reduces life expectancy by a few months or landlords should put triple glazing in because tenants would pay slightly less on their bill or men can pretend to be women or whatever else. Fiddling over 0.1% issues whilst ignoring the elephant in the room. I fear that there's going to have to be a big shock and we'll wake up from this collective delusion much like in the early days of Covid when everything just... stopped.
hyping9 2y ago
[flagged]
deleted 2y ago
[deleted]
openasocket 2y ago
I agree with the overall thesis, but I do need to quibble about Stuxnet. Yes, Stuxnet was very interesting, and it did disrupt Irans nuclear program. However, its impact is often overblown. It likely delayed Irans nuclear program by only a few weeks. Cyber attacks can absolutely cause a lot of damage and harm, but Stuxnet is not the best example of that.
- hyperman1 2y ago
  Stuxnet was a very graphical demonstration of the possibilities. Even if the results weren't that great, it demonstrates to nontechies the expensive real-world consequences of 1 usb stick with malware. I understood the hole in the ozon layer was similar. Even if the actual danger of it was probably overrated, it made people imagine how we broke earths radiation shield and would be hit by all kinds of nasty space radiation. This resulted in real world policy changes.
- jjice 2y ago
  The reason I personally think Stuxnet is so interesting is because of it's reach. The goal was so specific and it accomplished it while infecting lord knows how many machines (but I bet Wikipedia knows). Impact wasn't massive by any means, but the scope of the project will always impress me.
FL410 2y ago
This is one of my favorite reads on HN to date. I hope more people see it. It's funny how, even as a "nerd," I often think about if we are doing the wrong thing by taking the nerdy approach to problems that could be solved more simply. It feels like we often choose the most complex or nerdiest approach to prove to ourselves and others that we can and not whether we should - which isn't to say that we shouldn't ever - just that some problems deserve the simple solution.
- Terr_ 2y ago
  At least in my education, the Therac-25 incidents [0] featured pretty prominently as an example of software overconfidence. https://en.m.wikipedia.org/wiki/Therac-25 https://en.m.wikipedia.org/wiki/Therac-25
- pabs3 2y ago
  The author has been talking about the downsides of outsourcing for a very long time, their earlier posts are interesting too.
darkPotato 2y ago
Great piece!
- ahubert 2y ago
  Thanks!
baxtr 2y ago
This is a pretty scary article. And yet I have to say it’s weird to say we are pre-war. Ukraine certainly isn’t. So shouldn’t any scenario outlined in that article happen there already? The mobile network there seems to be operational.
- int_19h 2y ago
  TFA: > Ukraine was already at war for two years and battle-hardened. So anything that was simple to break was already broken by the Russians. Then after two years, the Russians managed to break Kyivstar, one of the biggest telecommunications companies of Ukraine, This was a very destructive attack. But the Ukrainians (in and outside Kyivstar) are good enough that in two days they were back up and running, because these people were prepared for chaos. They knew how to restore their systems from scratch. If we get an attack like this on VodafoneZiggo or on Odido, and they don’t get external help, they will be down for half a year, because they don’t know anything about their own systems.
  - baxtr 2y ago
    Thanks. I read TFA. That’s why I’m saying: the described doomsday scenarios don’t match with what we observe in reality.
xyst 2y ago
If COVID-19 didn’t move the needle on how dependent we are on foreign countries to do our scut work. I highly doubt the precipice of war will change anything. We are a species that will optimize for the shortest path. Cutting corners along the way. When it blows up on our faces and while sitting on a pile of ashes, will ponder “wtf did we do wrong”.
- jawiggins 2y ago
  > If COVID-19 didn’t move the needle on how dependent we are on foreign countries to do our scut work. I believe the search-term you are looking for is "Friendshoring". "Some companies and governments pursue friendshoring as a way to continue accessing international markets and supply chains while reducing certain geopolitical risks... Bonnie Glick first used the term "allied shoring" at the start of the Covid-19 pandemic, while serving as the deputy administrator of the United States Agency for International Development... The new U.S. Trade Policy, including USMCA and IPEF, complies with the Friendshoring arrangement." [1] [1]: https://en.wikipedia.org/wiki/Friendshoring https://en.wikipedia.org/wiki/Friendshoring
joquarky 2y ago
What's grating on my nerves is that I called out a lot of security concerns in courts & justice software and shortly after was constructively dismissed. I've been unemployed ever since. I'm getting antsy about income and getting no traction on my job search. How many other people are advanced in tech but having some difficulty finding work right now? How tempted will they be to switch to black hat for income? I can't be the only one thinking this way.
- bongodongobob 2y ago
  It's really bad right now. I've learned to not stir the pot over the years. Unless you're primary role is security it's best to go with the flow. I've seen some massive security holes at every company I've worked at. As long as the boxes are checked for insurance, they don't care.
- runlaszlorun 2y ago
  I’ve quit looking. I found myself dragging my butt out of bed and to a coffee shop to spend all day fabricating new versions of my resume in order to not get jobs that I didn’t want anyway. If you know any black hat tips, feel free to send them my way… lol
motohagiography 2y ago
Over a decade ago I wrote an article that included the prediction that the vulnerability of western infrastructure to cyber operations would prevent the US from intervening to support lesser allies. The rationale was the domestic costs of chaos caused by infrastructure attacks would cause hesitation to intervene in foreign wars, and this hesitation and vulnerability would embolden foreign antagonists like Russia and China to invade smaller countries. So far, it has been wrong. Even though there have been several infrastructure incidents in recent memory that looked like Russian deterrent operations that said, "back off or this is just what we're willing to reveal," but the US still seems fully invested in the conflict in Ukraine, and it appears to be providing cover for Israel against Iran- each with no real concern about both adversaries being able to launch a US power grid shutdown. China has been bold about Taiwan, but even they have been content to just manage it instead of full political annexation, and appear to take US support for Taiwan seriously, all while China could plausibly shut off anything in the US with a semiconductor in it. Maybe the new world order is that nation states don't need to expand sovereign territory so long as they can effectively manage the ones they need. With the exception of missile placements, why invade the cow when you can secure the milk without the headache of governing it- and this puts cyber into a more fluid dynamic than the assumptions of pre-space and network technology geopolitics.
- grob-gambit 2y ago
  I think what is missing from this analysis is the offensive capability of American cyber. The way it is completely downplayed I suspect is proportional to its strength. If there was all this chatter how we need to invest more in offensive cyber I would be worried. The way we pretend like it doesn't even exist is all you need to know.
  - ganoushoreilly 2y ago
    Exactly. It's capable and has been for decades, many many years ahead of some of our counterparts. While it doesn't mean we're fine, I would argue the depth and breadth of coverage has been strategically calculated and held to the point where there are still many contingencies foreign and domestic. I would also argue that the act of "cyber warfare" against us infrastructure would almost guarantee chaos for the attackers given the worlds reliance on us technology and assets, potentially self crippling their own capabilities. In some ways there's a Mutually Assured Destruction perspective with cyber operations. There are levels of acceptability and most Nation States wouldn't dare cross the line. Where the real risk lies is with rogue small groups. Groups that don't require a lot of money and or time, just a few well placed exploits. Having been in that world, at the higher echelons, I can attest that MONEY is being spent. Much more than many would know, to secure our foothold and capabilities. I would thus agree, if we had excess chatter about needing more money for offensive cyber capabilities, I would be much more concerned. Good thing about it is Cyber is less expensive than kinetic, and money can go much further.
rixed 2y ago
I'd like to voice an opinion that i couldn't find already in the comments. Security is a trade-off. At some point, security becomes so expensive and inconvenient that it's cheaper to address the root cause of insecurity than to pay for protection. For instance, there is a point where avoiding generalized war or limiting climate change becomes cheaper than to protect against them. A lot of people benefit from the war. To them, the costs of security is an externality. I do not believe it was naive from public transport regulators, for instance, to design with the assumption that gps network would stay reliable, when the alternative is so much more expensive for all parties that it can only happen in such a state of general corruption (aka misaligned incentives) that is not worth designing for. If we are now in this prewar state, we are in much bigger troubles I'm afraid. War is not a fatality, it's the result of some politics. Fixing political issues may be cheaper than making our highly technological society resilient.
fulafel 2y ago
Is this right? > the famous Stuxnet operation, where apparently the West was able to disable the ultracentrifuges used to create highly enriched uranium. > And not only did they disable it, like the factory is down now, it tore itself to shreds physically. Vs eg Wikipedia talks about the facility losing 10% of centrifuges slowing down the schedule of enrichments. (In https://en.wikipedia.org/wiki/Stuxnet#Natanz_nuclear_facilities https://en.wikipedia.org/wiki/Stuxnet#Natanz_nuclear_facilit...)
a0-prw 2y ago
Russia asked for discussions on a new security infrastructure for Europe. The West refused out of hand because it expected Russia to collapse in the (then) coming war. Russia did not collapse. It got stronger. All this talk of the danger of Russia is self-fulfilling prophecy.
metta2uall 2y ago
To get serious about cybersecurity governments need to start imposing hefty fines for failing security reviews, otherwise companies choose to maximise profit. This includes fining software vendors for 0-days, depending on their size and the severity of the 0-day. For example, a critical 0-day in a popular Microsoft/Google/Apple product should cost them e.g. $100 million. This will actually get them to allocate significant engineering time to preventing 0-days instead of working on the latest gimmicky features...
Havoc 2y ago
I’m far more concerned about the financial system. Sure infrastructure and IT maybe be shaky and full of holes, but the financial system rests on nothing more than confidence and pixie dust. Confidence failures cascade.
- TeaBrain 2y ago
  What is your opinion of the financial system based on?

593 points by edent 2y ago

At times it's a bit difficult to read, as it seems to be a telescript of a speech. But the overall gist and main topic are one that needs much more attention sooner rather than later/never.

nonrandomstring 2y ago
My colleagues and I submitted a similar talk/paper for a different NCSC conference (but weren't accepted). I see that this talk by Bert Hubert covers mostly the ground. so I am pleased, but worried about what this take misses out. Hubert is addressing much of the ground that lies between security and resilience. Our emphasis is on how mitigation lies in education and autonomous systems over regulation. Not that regulation is wrong, just that it doesn't work as a stick without a carrot. We also looked at timescales and how so much is already too late because of the lag-time from drafting to efficacy. And what I know from hanging out here on HN is that technologists appear hostile to regulation, but giant companies love it so long as they get to write the rules that give them more monopoly power. Where we went wrong I think is lack of political tact. Hubert stops himself from even finishing off the remark about the quality of Microsoft products. But I don't think the real problem can be ignored for much longer. Instead, we went all-in and emphasised (as previously here [0]) that "Big Tech is the cybersecurity problem" (as Bruce Schniere recently echoed) because it pushes (in addition to highly centralised single points of failure) an irresilient "insecurity industry" that is based on protection not security. Hubert's talk doesn't get to the key issue; Security and protection are not the same thing. Protection leads to dependency that ultimately erodes real security. However "protection" is easy and profitable to sell. Real security is not. That is ths succinct way in which it must be put. If the intel appraisal is accurate and we are entering a serious war footing than we can have no more patience for the profitable but dangerous "insecurity industry" that gives an appearance and simulation of security, without the reality. [0] https://techrights.org/o/2021/11/29/teaching-cybersecurity/ https://techrights.org/o/2021/11/29/teaching-cybersecurity/
- m3047 2y ago
  "Security" is not the same thing itself, it cleaves meaning: 1) Hypervigilance; which is unsustainable. 2) Carefree ease; which is what the champion Red Bull athlete achieves from constant practice and repetition. I thank Kelly Shortridge (https://kellyshortridge.com/blog/posts/ https://kellyshortridge.com/blog/posts/) for pointing out the cleavage.
  - nonrandomstring 2y ago
    These are interesting distinctions. I'm working on distinguishing a whole cluster of things that frequently get collaopsed into the same mushy confusion; security, safety, reliability, resilience, protection, sustainability... And there's also inner and outer security, which I think your remark addresses. Thanks for the link which I wasn't aware of.
- m3047 2y ago
  @nonramdonstring: The email address hr@... in your profile is broken. You're welcome to try the one in my profile.
  - nonrandomstring 2y ago
    Thankyou for telling me. I may have missed other coms, my apologies.
  - m3047 2y ago
    In spite of my typo in the parent, I really did send to hn@. I just checked the bounce to be sure.

ahubert 2y ago

Author here - if you have any questions, please do let me know!

wyldberry 2y ago
No questions, but as a security person, I found this to be aligned with the view of many of the people i consider to have a good pulse on the warfare side of security. You're certainly not alone in these thoughts and efforts to fix.
nonrandomstring 2y ago
Very good. Well said and most enjoyable.
skybrian 2y ago
This is off topic, but I’m idly curious about the history of shipbuilding regulatory changes after the Titanic. Where did Brenno de Winter learn about them?
auct 2y ago
What were the vulnerabilities in your 1600 lines imgur alternative?
- ahubert 2y ago
  https://github.com/berthubert/trifecta/blob/main/README.md#known-problems https://github.com/berthubert/trifecta/blob/main/README.md#k... has a list. The most painful one for me is that I did not know .svg files can contain javascript that gets executed in the site context if you can get someone to click on a link to your .svg file!
  - softsound 2y ago
    That's one of the reasons SVG is often a third party plug-in with WordPress it's because of all the security involved.
  - yread 2y ago

ThomasBb 2y ago

Bert is a national treasure. We need more Bert in our lives!

ahubert 2y ago
blush :-)
zelag 2y ago
Not to be confused with Bert Kreischer, the unfunny comedian.

simmerup 2y ago

It does feel mad that we outsource so much of our national infrastructure maintenance to China. When/if they invade Taiwan, how are we going to do anything when they have that sort of leverage over us? It was bad enough with Russias gas

gds44 2y ago
Well US is not dependent on anyone for her Energy needs. Unlike China. Its quite vulnerable on that front if a few pipelines blow up ala nord stream. This is also why the US has such a large presence in the middle east.
- croes 2y ago
  But you can pretty easily bring down their power grid
  - vundercind 2y ago
    Good point. Factories ain’t shit without power. If we can’t get stuff from China, that hurts, a lot. If China can’t get stuff from China, they’re dead.
- Dalewyn 2y ago
  >Well US is not dependent on anyone for her Energy needs. China's strength is they have the means of production (and maintenance) of everyone today, including the US. All the energy in the world means jack squat when all the means of using that energy rely on China. Could the west regain our own means of production? Certainly, but it's going to take far too long at the point China starts pursuing Bigger Gun Diplomacy. We're talking multiple decades to reachieve what we've surrendered, perhaps even the better part of a century because we simply don't have the ambition and political will to do so. I think China has been very shrewd with how they conducted themselves in the past half century or so. They've already won most wars they might be involved in before they start by seizing the economies of their supposed enemies.
  - 2y ago

crocal 2y ago

I cannot agree more with the author’s point of view. As an illustration, many people want to use GPS for the safe positioning of trains in the European Train Control Systems. This makes the space sector happy because it justifies the expenditures incurred for putting things like Galileo in orbit. However, in a pre-war check exercise, one immediately come to the conclusion that all European trains would crawl to a stop in case the GPS is jammed or interfered with. We were not very listened to… until Ukraine. Critical infrastructures should not depend from things that are located in space or on the other side of the planet. These are one of those things were market logic should be anticipated with regulations (we can’t wait for the next Titanic). Another point touched by the article.

killjoywashere 2y ago
Not sure I entirely agree? #1 > Or disable a hospital. The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February. Maybe it's more like the pandemic: seems like nothing, unless it affects you. https://en.wikipedia.org/wiki/Ascension_(healthcare_system) https://en.wikipedia.org/wiki/Ascension_(healthcare_system) https://www.wired.com/story/change-healthcare-admits-it-paid-ransomware-hackers/ https://www.wired.com/story/change-healthcare-admits-it-paid... #2 > Does your stuff need computers working 5,000 kilometers away? [implying that's bad] What if you live on the Gulf Coast, exposed to hurricanes? You want compute resources warm and ready far away from that region. After Katrina, the Tulane medical school was able to re-form quickly because the noteservice was running a bulletin board forum on a VM in Romania. Everything else was underwater. #3 > This is the sound-powered phone Have you used a sound-powered phone? I managed damage control in a ship. Sound powered phones barely works. And the coordination system to actually fight that fire requires radios and making overhead announcements that definitely depend on electrical power. #4 > They tried to sort of renew this emergency telephone network When the entire San Diego region lost power during rush hour for 4 hours in 2011, the cell phone system still worked. I was able to email documents to Tokyo from a car despite no traffic lights. #5 > Because if the cable to the US is down Sure, but there are a lot of disasters where the cables are fine. Graceful degradation is all about having widely distributed options. Lots of people have What. Signal is even better for people with more serious responsibilities, IMHO. And, friends, if you think IP networks are vulnerable, get yourself a starlink terminal and a HAM radio license. https://en.wikipedia.org/wiki/SpaceX_Starshield https://en.wikipedia.org/wiki/SpaceX_Starshield

rightbyte 2y ago

Who cares? In the case of some sort of big war why would you care about "cyber security" when the day to day problem is not dying from starvation, being drafted, radiation posioning or what ever the problem is. These kind of "we need to prepare" are silly since they implicitly downplay the severity of war and bring us closer to it.

alephnerd 2y ago
Everything is computerized now. And most adjacent power wars will most likely be non-nuclear in nature until it crosses a red line.
- rightbyte 2y ago
  Everything being computerized is a major peace time concern too. Ideally systems should not be as centralized as they are now and have offline fallbacks. I believe there is a great deal of over automization too. You can notice how war mongerers have turned to "cyber threats" to instigate on unfalsifiable information. I feel it might be better to pull the plug on the whole internet if that actually is such a concern.
  - constantcrying 2y ago
    It is incredibly hard to maintain an unused system. The Internet is the default mode of communications because it outperforms all other options on most metrics. Any backup would go nearly totally unused and therefore couldn't be effectively used during an outage.
croes 2y ago
The day to day problem will mainly exist because our computer systems are down.
constantcrying 2y ago
The underlying assumption of e.g. food distribution are that a certain part of infrastructure remains intact. This assumption comes into greater question the more individual parts are dependant on large software installations. E.g. some countries have an entire redundant telecommunications network for government functions precisely so that it can actually withstand such a scenario. The more enmeshed that infrastructure is into other systems the more likely it is that it too will fail.

gostsamo 2y ago

Is there an enemy factor measure which reflects how many countries have to sanction/attack you directly before you are enable to maintain the economy and social services? It would be interesting to have an index of geostratigic resilience.

nonrandomstring 2y ago
Yes. Front analysis [0] and also critical path analysis are useful. Real graphs look like social networks, with some clusters and nodes with very high relational degree, and some with almost none. But for security they are more like dependency graphs rather than just attack paths as in Blotto. An adversary blockades/sabotages them or blocks those on which they depend etc. The more resilient graph is the best connected by alternative paths. Go back and look at some DARPA papers on route security in the formative "Internet". What we have today are very insecure graphs with millions of logical dependency links going in/out of single centres of functionality, and not much peer connectivity. Hit a few critical nodes and the whole lot goes down. [0] https://en.wikipedia.org/wiki/Blotto_game https://en.wikipedia.org/wiki/Blotto_game
kjkjadksj 2y ago
Cuba would be the most resilient nation on earth I’d guess
- baobun 2y ago
  Why?
  - ragebol 2y ago
    They're boycotted out of a lot of stuff, yet still make due.

nickpeterson 2y ago

As an outsider on most IT security so take the rest of this with a grain of salt, but I think reliability is a good way to view this topic. Complexity is the enemy of reliability and security. Most organizations seem to operate under the delusion that you can brute force your way to security through audits and policy. They're trying to 'test the quality in' so to speak. Think of the legion of security admins who diligently tweak windows group policies, firewall settings, and systems like 2FA/MFA. Nobody can stomach the truth that most of these things have grown in complexity beyond their ability to be truly reliable. They're basically the IT equivalent of locks on a few doors of mansion with 80 windows, they prevent some crimes of opportunity but won't stop an attacker motivated by something else. This also doesn't tend to bother security people. It's interesting, it quickly shifts to, "Well we don't run a nuclear reactor..." or "We're not a cloud provider or a bank", so they think they're not critical infrastructure and crimes of opportunity are really their main threat (ransomware, disgruntled ex-employees, etc). Also, their job usually depends on tweaking the knobs in this complex pachinko machine, so to have some outsider tell them to throw it all away is basically like saying you think they should lose their job as well. I don't know where this rant should end, but I think if I was tasked with making infrastructure decisions, It would be really hard for me to not use things like OpenBSD and SQLite for a lot of it. I'm sure someone here will say actually those are bad for various reasons, but they at least seem to capture the ethos of, "We're going to just say no to things and try to control the complexity of this thing." They also don't seem very motivated by making money which tends to be the root of most compromising decisions.

rustcleaner 2y ago
Knowing how frail software out there really can be, I made moves to Qubes OS and GrapheneOS as my primary operating system distributions over a year ago. Haven't looked back since the first month! PC users should be using some kind of segregation like VMs these days; you most likely don't have a MAC policy protecting your files from your porn site bunker-busted browser, so your data is likely going up the pipe to North Korea (but you did make sure to be a user so at least it can't install the printer driver wrapped rootkit).
- 2y ago

mikewarot 2y ago

When I recently asked some air traffic controllers what would happen if GPS became unavailable, it was grumpy sounds all around. I understand a scramble to vector everything to land everything would result in a very busy day for them, because suddenly most planes would be unable to safely navigate, and thus effectively grounded. Cutting the budget for ground based navaids is nuts, in my opinion.

Rygian 2y ago
I was under the impression that GPS was a non-critical asset for aviation, ie. any plane can safely stop using it at any given time and keep flying with VOR and other navigational aids. This article [1] introduces some of the scenarios where pilots rely on GPS only: * GPS-based waypoints to optimize routing based on favorable winds and more direct routes even in the absence of VORs. * RNAV departures and arrivals that rely "solely on GPS rather than radio-based [...] aids" with more precise spacing and hence higher capacity. * GPS used as a substitute of ILS for some approaches e.g. in mountainous areas. [1] https://simpleflying.com/gps-in-aviation-pilots-guide/ https://simpleflying.com/gps-in-aviation-pilots-guide/
- xavxav 2y ago
  I would assume its not 'safety critical' but 'business critical', disabling GPS would mean slowing down departures / arrivals which means the airport losing money. I recall there being a similar issue with Lufthansa and SFO causing planes to get rerouted to oakland.
  - m3047 2y ago
    There's a meme driver with safety vs business critical and software types seem to think they're special (a different meme) but I'm starting to understand it's everywhere, which is why nobody notices the software issue creeping into their physical systems thinking. A "business critical" issue is defined by the appetite for risk. Most businesses aren't planning for total economic collapse: losing their accounts receivable is what that would look like. What they are concerned about is losing business to competitors or liability for not fulfilling contracts. Software seems to solve the latter problem with shrinkwrap agreements "not responsible for failure of software". That solves their liability problem; everybody else they'll sue. On the other hand "safety critical" concerns the loss of life or property: the things insurers are traditionally concerned with. So if the plane can land, engine out or GPS out what's the difference? Businesses absolutely care about safety, that's why they buy insurance! Safety programs reduce the need and cost for such insurance. Businesses aren't lying when they say they care about safety. However people swim in the ocean of systems without necessarily being systems thinkers: plugging a leak is plugging a leak. But a leaky roof is not the same as a leaky hull. All the people in cybersecurity warning of the dire consequences of breaches are proven wrong time and again by the market: look at the stock prices of Equifax, Solarwinds, United Health Care. It's not simply marketing, a lot of these people really Want To Believe (tm). In the end business is never safe, it's taking risks all the time. Mostly it doesn't see a need to share those risks with customers (or competitors).

roenxi 2y ago

> I know it sounds devastating, but you have to get used to the fact that a new era has begun. The pre-war era. It is madness that we're in a position where this can be baldly stated by a PM and there has been no "huh?" moment when people stop and assess how badly the broader West's military, economic and diplomatic efforts have failed over the last 30 odd years. Possibly longer. I wasn't expecting to see land wars in Europe even before the cold war ended. Humanity has unprecedented destructive power at our command and the systems that sustain 8 billion people are delicate. We can't afford to be in a "pre-war era" and act like this is just going to be something to deal with when we get to it plus a little prep in specialist domains.

fabian2k 2y ago
What kind of diplomacy would have prevented Russia from invading its neighbours?
- roenxi 2y ago
  Picking on Ukraine, the US not having a policy of signing new people up to the anti-Russia military alliance every few years [0] seems like low hanging fruit. Or not working to integrate their intelligence with the CIA [1] for the last decade. I don't speak German but apparently Merkle said that we weren't negotiating in good faith to keep the peace either [2]. These are the sort of thing I suspect Russia would see as escalatory. I certainly do. A better diplomatic policy would have been to encourage neutrality. The western powers weren't going out of their way to make sure that the situation stayed peaceful. We could have treated this as the Russian equivalent of the US invasion of Afghanistan or Iraq and let it go away. [0] https://en.wikipedia.org/wiki/Enlargement_of_NATO https://en.wikipedia.org/wiki/Enlargement_of_NATO [1] https://www.washingtonpost.com/world/2023/10/23/ukraine-cia-shadow-war-russia/ https://www.washingtonpost.com/world/2023/10/23/ukraine-cia-... [2] https://politics.stackexchange.com/questions/77139/what-position-exactly-did-merkel-express-about-the-minsk-agreements-in-this-dece https://politics.stackexchange.com/questions/77139/what-posi...
  - kibwen 2y ago

croes 2y ago

At the same time MS & Co. try to force everyone in to the cloud. So if MS Azure AD goes down everyone goes down too.

jeffrallen 2y ago

It is too bad he didn't follow up on "we give control to foreign clouds" with "we need European data sovereignty, our governments need to choose local cloud providers". Because they exist. I work for one. The cloud is just someone else's computer. But if that someone else is your neighbor, they may be motivated by the same things as you, and can contribute helpfully to your goals.

ahubert 2y ago
(author here) You might be interested in my writing on this very subject -> https://berthub.eu/articles/posts/cloud-naive-europe-and-the-megascaler/ https://berthub.eu/articles/posts/cloud-naive-europe-and-the...

gz5 2y ago

>Why did it happen? Non-technical people have made choices and have optimized for stuff being cheap. Yes and amplified by: + Cybersecurity 'bad actors' are decentralized and distributed. They innovate at speed, with no barriers, and share their innovation. Cybersecurity 'good actors' are centralized, proprietary and bounded. + Software and service providers traditionally couldn't build secure networking into their products - they had to delegate it to the consumer of the software or service for the consumer to implement as a day two bolt on. Dangerous when networking is often the largest and most vulnerable surface area.

stalfosknight 2y ago
Non-technical people should be stopped.
jjav 2y ago
> Cybersecurity 'good actors' are centralized, proprietary and bounded. IME the main problem is that, with rare exceptions, building secure products is seen as a distraction that is best pawned off to the cybersecurity team. And that cybersecurity team is more often than not fairly light on actual product development engineering talent. So they do what they can, which is mostly buy yet another tool from the thousands of vendors hawking The Answer, the final service you need to buy and then you'll be secure. Which to anyone who has built secure products, should obviously sound like nonsense. Because it is nonsense. Most of these tools are mildly useful (some useless) but not that great. They're certainly not The Answer. To build secure products you need to actually make it a tier one requirement and design it in from day one. It's as simple, and as difficult, as that.

javajosh 2y ago

He mentions the threat of remotely taking over autonomous vehicles, but really its any vehicle who's a) network connected and b) drive-by-wire. Which is why I won't buy one, and why the problem is even worse than it appears. The other problem that he doesn't address is the centralization of critical (and semi-critical, like logistics) software in large shared data-centers. If you wanted to disable large chunks of the American software economy for an extended period, you only have to kill ~100 buildings. In a way I think the ransomware people are doing us all a huge favor by putting the fear of God into executives around cybersecurity. Unfortunately, as other commenters have mentioned, the real problem is hard to address, because it's the complexity inherent in the "worse is better" philosophy. Current systems have grown in a lovely, nice environment that is generally reliable. When that environment changes quickly (which is one way to characterize a cyber attack) these systems will fail, and there will be no time or tools to repair them. This includes software and infrastructure hardware. Somewhat ironically, this is precisely the kind of non-extinction-level threat that "having a bunker" and a large store of food would actually get you through - something only executives can afford. Perhaps we might consider outlawing such bunkers to properly motivate the monied elite to address these issues.

constantcrying 2y ago

Very interesting article. I think the author makes a compelling point about the vulnerability of infrastructure. To be honest I wouldn't be surprised that in an actual unlimited war, between two major developed nations nothing will actually continue to function. None of the systems have ever been actually tested and still make assumptions about the rest of the infrastructure. I also don't believe that simplicity can fix this, everything already has deep built-in assumptions about everything else, which makes any replacement a daunting task.

waveBidder 2y ago
Well, every major city being eliminated by a nuke would also hamper these systems in a total war between developed countries.

cwillu 2y ago

I regret that I have but one upvote to give.

vaylian 2y ago
This is definitely one of the best submissions I've seen on HN. I don't think it helps with the ranking, but you can still favorite the thread.
- ahubert 2y ago
  Thank you both :-) (author here)

tetha 2y ago

> So you can have a whole board full of people that studied history and art and French, and they sit there making our cloud decisions. And they simply don’t know. > And if there had been more nerds in that room, some of these things would not have happened. And that is also a call to maybe us nerds, although you don’t really look that nerdy, but do join those meetings. > Because quite often, we as technical people, we’re like, “Ah, these meetings are an interruption of my work, and I’m not joining that meeting.” And while you were not there, the company decided to outsource everything to India. Oof. This is hitting me hard on two levels. As I'm racking up years in the operational business, the best impact I can have isn't that I can understand log files twice as fast as the guy next to me. Many people can learn that. The bigger impact is to be able to connect the effects of technical decisions onto the overall business and vice-versa to higher management. Like, sure, I can rattle down a lot of technical requirements we need to self-host a highly available infrastructure, and I can rattle down a lot of the advantages of the cloud /in a small company situation/ and such. But that is largely useless to the CEO of a small and medium business. The more interesting statement is: Self-hosting requires a larger upfront and a larger continuous investment over time at a certain range of scale. You need to buy servers, firewall, switches, rent bandwidth and DC space and to hire people to take care of all of these. However, we can achieve a higher level of security and data protection on these systems and in the long run, we can become cheaper than the big cloud providers, because the current product-visions are already decently big. The cloud can be more flexible and innovate faster, but we will have more security discussions with our customers and the control over our systems will be lower, for better or worse. Put this way, we're setting up a pretty good self-hosted plan, which primarily uses the cloud as a way out if we or our DC hosters fuck up. This plan cost the company more money than the existing cloud infra would have for a year or two, but now it is starting to pay off and in a year or two, hardware extensions will be a welcome expense. But that is bringing me to a second point, deeper point: This only works because the board here is fine planning for benefits 3-5 years down the line. "In 2-3 years we'll be even", we said, and "in 3-5 years we'll be cheaper, a lot". We're even now 2 years after. If they were just maximizing next quarters profits, we probably would have migrated everything to AWS and just started shoveling more money across the Atlantic, making us highly dependent on cross-atlantic and US infrastructure. It would've been cheaper for a year or so. And this profit-maximizing mindset looming over good decisions and great tech is frustrating me. Generative AI is similar there to me. Generative AI should be something I should be excited about. For example, Runegate Studios cooperated ethically with Unleash the Archers and Bo Bradshaw to create a music video[1] in Bo's style we just wouldn't have without generative AI and it would never be created without. And like, sure, it's not Disney quality, but you're looking at ~10 people cooperating here. For that headcount, that video is amazing. But I know it will be used to slash jobs, prevent juniors from learning because AI is cheaper, ruin careers "because the AI can do 80% for less costs" and such. Short-term perspectives. And then in 10 years there will be a crisis of "Why can't we find good writers/cartoonists/musicians/... anymore?" Sorry for the TED-talk. I'm currently torn between a very excited and a very frustrated person. 1: https://www.youtube.com/watch?v=eLPMBD7i0IU https://www.youtube.com/watch?v=eLPMBD7i0IU

CJefferson 2y ago

I wonder if we, in secret, have “mutually assured destruction” of cyber-warfare. It seems like a reasonable assumption to me that major world powers probably have enough 0-days at any one time that they could use them together to format a significant proportion of the world’s computers and phones. It would be not be that hard to make these worms intelligently use IP to target particular countries. It’s hard for me to imagine how much damage it would do if I could wipe even say 25% of all work and home computers, maybe every phone not updated in the last 6 months, and a decent chunk of online servers.

hollerith 2y ago
>It seems like a reasonable assumption to me that major world powers probably have enough 0-days at any one time that they could use them together to format a significant proportion of the world’s computers and phones. If that is true, then how come we have not heard much about erasure of data on phones and computers in Ukraine by Russian hackers? Please don't say that the Kremlin is holding its 0-days in reserve for a more serious conflict! the Kremlin sees the Ukraine situation as extremely serious for Russian national security. It uses large numbers of missiles costing over a million dollars each to degrade Ukraine's electrical grid. It has attempted to assassinate the president of Ukraine many times. Why wouldn't it be all-out trying to do as much damage as possible to Ukraine through cyberattacks?
- r2_pilot 2y ago
  In point of fact, Ukraine has been hacked, multiple times during this conflict, and they were hardly damaging. This is in large part due to the fact that this particular conflict(hacking in particular) has been going on longer than just the start of the official war, so Ukraine has been hardening its systems significantly for many years. It goes to show that with dedication, even nation-state actors can be stymied with defense-in-depth.
- kjkjadksj 2y ago
  Probably for the same reason why they aren’t using their nuclear weaponry.

throwaway22032 2y ago

Tough times create tough men comes to mind. Leadership in the UK is absolutely pitiful. Yes, you can work on multiple problems at once, but in reality both the public and private discourse is focused on utterly trivial and stupid stuff. The top level goals of a government are to ensure that the state exists and can protect its' citizens. We enacted income taxes on that basis in the first place for wars. Now we have people arguing the toss over whether cars should emit a particular thing because it reduces life expectancy by a few months or landlords should put triple glazing in because tenants would pay slightly less on their bill or men can pretend to be women or whatever else. Fiddling over 0.1% issues whilst ignoring the elephant in the room. I fear that there's going to have to be a big shock and we'll wake up from this collective delusion much like in the early days of Covid when everything just... stopped.

hyping9 2y ago

[flagged]

deleted 2y ago

[deleted]

openasocket 2y ago

I agree with the overall thesis, but I do need to quibble about Stuxnet. Yes, Stuxnet was very interesting, and it did disrupt Irans nuclear program. However, its impact is often overblown. It likely delayed Irans nuclear program by only a few weeks. Cyber attacks can absolutely cause a lot of damage and harm, but Stuxnet is not the best example of that.

hyperman1 2y ago
Stuxnet was a very graphical demonstration of the possibilities. Even if the results weren't that great, it demonstrates to nontechies the expensive real-world consequences of 1 usb stick with malware. I understood the hole in the ozon layer was similar. Even if the actual danger of it was probably overrated, it made people imagine how we broke earths radiation shield and would be hit by all kinds of nasty space radiation. This resulted in real world policy changes.
jjice 2y ago
The reason I personally think Stuxnet is so interesting is because of it's reach. The goal was so specific and it accomplished it while infecting lord knows how many machines (but I bet Wikipedia knows). Impact wasn't massive by any means, but the scope of the project will always impress me.

FL410 2y ago

This is one of my favorite reads on HN to date. I hope more people see it. It's funny how, even as a "nerd," I often think about if we are doing the wrong thing by taking the nerdy approach to problems that could be solved more simply. It feels like we often choose the most complex or nerdiest approach to prove to ourselves and others that we can and not whether we should - which isn't to say that we shouldn't ever - just that some problems deserve the simple solution.

Terr_ 2y ago
At least in my education, the Therac-25 incidents [0] featured pretty prominently as an example of software overconfidence. https://en.m.wikipedia.org/wiki/Therac-25 https://en.m.wikipedia.org/wiki/Therac-25
pabs3 2y ago
The author has been talking about the downsides of outsourcing for a very long time, their earlier posts are interesting too.

darkPotato 2y ago

Great piece!

ahubert 2y ago
Thanks!

baxtr 2y ago

This is a pretty scary article. And yet I have to say it’s weird to say we are pre-war. Ukraine certainly isn’t. So shouldn’t any scenario outlined in that article happen there already? The mobile network there seems to be operational.

int_19h 2y ago
TFA: > Ukraine was already at war for two years and battle-hardened. So anything that was simple to break was already broken by the Russians. Then after two years, the Russians managed to break Kyivstar, one of the biggest telecommunications companies of Ukraine, This was a very destructive attack. But the Ukrainians (in and outside Kyivstar) are good enough that in two days they were back up and running, because these people were prepared for chaos. They knew how to restore their systems from scratch. If we get an attack like this on VodafoneZiggo or on Odido, and they don’t get external help, they will be down for half a year, because they don’t know anything about their own systems.
- baxtr 2y ago
  Thanks. I read TFA. That’s why I’m saying: the described doomsday scenarios don’t match with what we observe in reality.

xyst 2y ago

If COVID-19 didn’t move the needle on how dependent we are on foreign countries to do our scut work. I highly doubt the precipice of war will change anything. We are a species that will optimize for the shortest path. Cutting corners along the way. When it blows up on our faces and while sitting on a pile of ashes, will ponder “wtf did we do wrong”.

jawiggins 2y ago
> If COVID-19 didn’t move the needle on how dependent we are on foreign countries to do our scut work. I believe the search-term you are looking for is "Friendshoring". "Some companies and governments pursue friendshoring as a way to continue accessing international markets and supply chains while reducing certain geopolitical risks... Bonnie Glick first used the term "allied shoring" at the start of the Covid-19 pandemic, while serving as the deputy administrator of the United States Agency for International Development... The new U.S. Trade Policy, including USMCA and IPEF, complies with the Friendshoring arrangement." [1] [1]: https://en.wikipedia.org/wiki/Friendshoring https://en.wikipedia.org/wiki/Friendshoring

joquarky 2y ago

What's grating on my nerves is that I called out a lot of security concerns in courts & justice software and shortly after was constructively dismissed. I've been unemployed ever since. I'm getting antsy about income and getting no traction on my job search. How many other people are advanced in tech but having some difficulty finding work right now? How tempted will they be to switch to black hat for income? I can't be the only one thinking this way.

bongodongobob 2y ago
It's really bad right now. I've learned to not stir the pot over the years. Unless you're primary role is security it's best to go with the flow. I've seen some massive security holes at every company I've worked at. As long as the boxes are checked for insurance, they don't care.
runlaszlorun 2y ago
I’ve quit looking. I found myself dragging my butt out of bed and to a coffee shop to spend all day fabricating new versions of my resume in order to not get jobs that I didn’t want anyway. If you know any black hat tips, feel free to send them my way… lol

motohagiography 2y ago

Over a decade ago I wrote an article that included the prediction that the vulnerability of western infrastructure to cyber operations would prevent the US from intervening to support lesser allies. The rationale was the domestic costs of chaos caused by infrastructure attacks would cause hesitation to intervene in foreign wars, and this hesitation and vulnerability would embolden foreign antagonists like Russia and China to invade smaller countries. So far, it has been wrong. Even though there have been several infrastructure incidents in recent memory that looked like Russian deterrent operations that said, "back off or this is just what we're willing to reveal," but the US still seems fully invested in the conflict in Ukraine, and it appears to be providing cover for Israel against Iran- each with no real concern about both adversaries being able to launch a US power grid shutdown. China has been bold about Taiwan, but even they have been content to just manage it instead of full political annexation, and appear to take US support for Taiwan seriously, all while China could plausibly shut off anything in the US with a semiconductor in it. Maybe the new world order is that nation states don't need to expand sovereign territory so long as they can effectively manage the ones they need. With the exception of missile placements, why invade the cow when you can secure the milk without the headache of governing it- and this puts cyber into a more fluid dynamic than the assumptions of pre-space and network technology geopolitics.

grob-gambit 2y ago
I think what is missing from this analysis is the offensive capability of American cyber. The way it is completely downplayed I suspect is proportional to its strength. If there was all this chatter how we need to invest more in offensive cyber I would be worried. The way we pretend like it doesn't even exist is all you need to know.
- ganoushoreilly 2y ago
  Exactly. It's capable and has been for decades, many many years ahead of some of our counterparts. While it doesn't mean we're fine, I would argue the depth and breadth of coverage has been strategically calculated and held to the point where there are still many contingencies foreign and domestic. I would also argue that the act of "cyber warfare" against us infrastructure would almost guarantee chaos for the attackers given the worlds reliance on us technology and assets, potentially self crippling their own capabilities. In some ways there's a Mutually Assured Destruction perspective with cyber operations. There are levels of acceptability and most Nation States wouldn't dare cross the line. Where the real risk lies is with rogue small groups. Groups that don't require a lot of money and or time, just a few well placed exploits. Having been in that world, at the higher echelons, I can attest that MONEY is being spent. Much more than many would know, to secure our foothold and capabilities. I would thus agree, if we had excess chatter about needing more money for offensive cyber capabilities, I would be much more concerned. Good thing about it is Cyber is less expensive than kinetic, and money can go much further.

rixed 2y ago

I'd like to voice an opinion that i couldn't find already in the comments. Security is a trade-off. At some point, security becomes so expensive and inconvenient that it's cheaper to address the root cause of insecurity than to pay for protection. For instance, there is a point where avoiding generalized war or limiting climate change becomes cheaper than to protect against them. A lot of people benefit from the war. To them, the costs of security is an externality. I do not believe it was naive from public transport regulators, for instance, to design with the assumption that gps network would stay reliable, when the alternative is so much more expensive for all parties that it can only happen in such a state of general corruption (aka misaligned incentives) that is not worth designing for. If we are now in this prewar state, we are in much bigger troubles I'm afraid. War is not a fatality, it's the result of some politics. Fixing political issues may be cheaper than making our highly technological society resilient.

fulafel 2y ago

Is this right? > the famous Stuxnet operation, where apparently the West was able to disable the ultracentrifuges used to create highly enriched uranium. > And not only did they disable it, like the factory is down now, it tore itself to shreds physically. Vs eg Wikipedia talks about the facility losing 10% of centrifuges slowing down the schedule of enrichments. (In https://en.wikipedia.org/wiki/Stuxnet#Natanz_nuclear_facilities https://en.wikipedia.org/wiki/Stuxnet#Natanz_nuclear_facilit...)

a0-prw 2y ago

Russia asked for discussions on a new security infrastructure for Europe. The West refused out of hand because it expected Russia to collapse in the (then) coming war. Russia did not collapse. It got stronger. All this talk of the danger of Russia is self-fulfilling prophecy.

metta2uall 2y ago

To get serious about cybersecurity governments need to start imposing hefty fines for failing security reviews, otherwise companies choose to maximise profit. This includes fining software vendors for 0-days, depending on their size and the severity of the 0-day. For example, a critical 0-day in a popular Microsoft/Google/Apple product should cost them e.g. $100 million. This will actually get them to allocate significant engineering time to preventing 0-days instead of working on the latest gimmicky features...

Havoc 2y ago

I’m far more concerned about the financial system. Sure infrastructure and IT maybe be shaky and full of holes, but the financial system rests on nothing more than confidence and pixie dust. Confidence failures cascade.

TeaBrain 2y ago
What is your opinion of the financial system based on?