5 ms·

> In one way I'm amazed at how laxadasical the US and others are towards these threats and that they have not done more to harden the vulnerabilities. On the ot

> In one way I'm amazed at how laxadasical the US and others are towards these threats and that they have not done more to harden the vulnerabilities. On the other hand, it's obvious: cost is one factor but I reckon another bigger one is 'convenience'. Hardening systems against vulnerabilities means making them less convenient/easy to use and people instantly balk against that. "Show me the incentives, and I'll show you the outcomes." - Charlie Munger. We do not incentivize companies to operate secure, redundant, reliable computer systems. We incentivize companies to make the number at the bottom of the spreadsheet beat the expectations some analyst in Lower Manhattan set 90 days prior. And since companies handle the majority of societal work in the United States, that's how most critical systems are designed. Now, there's a chance that this will play out in court, and that Crowdstrike will have to be bought out to make up for the damages their customers suffered starting on July 19th. However, that will take years, and the outcome could very well be that the plaintiffs will receive symbolic or even no damages. By then, the market will have hedged, captured regulatory authorities, cut its losses, and just altogether moved on. The assets will be purchased in a firesale by people who see this as "creative destruction" and won't care that peoples' lives were put at risk because of this. And the cycle will continue.

hilbert42 2y ago
...And I can't agree more. The question is what can be done, if anything. But I've a solution in my wildest dreams as a dictator. :-)
- lenerdenator 2y ago
  You introduce consequences against the people who have created the system that we're in now.
  - dasil003 2y ago
    Even assuming you could narrow this down to a small enough set of people that can credibly be held responsible for creating the system we have now, and assuming you could impose consequences on them without violating their civil rights, and assuming they learnt their lesson and would actively take precautions to avoid their actions leading to such a systemic failure in the future, at best this would only influence those particular actors to avoid the previous failures. The next systemic failure would look quite different on the ground and come from different individuals pursuing different goals who would not have learnt any of the previous lessons. The only people who would see the connection would be more experienced people and/or intellectuals looking from a higher zoom level, but likely would not be empowered to really do anything to stop it given all the direct financial incentives motivating a much larger group of people to direct action. If our culture had more respect for elders and/or thinkers that could be a start, but even then it would still be an uphill battle in a capitalist society.
    - hilbert42 2y ago
      "…failure in the future, at best this would only influence those particular actors to avoid the pervious failures. " Not if laws were like the Monopoly square that has 'Go directly to jail' stamped in bold all over it. Just a few decent lockups would put the shivers down the backs of those so included. Trouble is governments have failed to implement the necessary laws. Unfortunately, as we've seen Big Tech is too big, too powerful, and too money-rich to be challenged effectively by governments.
      - dasil003 2y ago
        GP said "the system that we're in now", not the specific executive decisions and operational practices employed at Crowdstrike. I agree with you the latter could be addressed through accountability, but I struggle to see what kind of law would work the way you intend here. In general, regulation helps large corporations and because they have resources to maintain nominal compliance, as well as the layers/lawyers to maintain plausible deniability if things go sideways. Regulation tends to undermine competition which further cements their power and has many negative effects that span well beyond obvious failures due to poor engineering practices.
        hilbert42 2y ago
        OK, but I'd argue regulation kept large corporations nominally in check before the greed-is-good mantra along with the belief that the only responsibility a corp has is to its shareholders—ideas that took hold and became prominent in the 1980s (Friedman, Hayek, Chicago School, et al). Big Tech is now so big and powerful that it essentially does what it does with impunity, fines for breaching laws are just a part of doing business, they have negible effect on the bottom line. The way of fixing the problem is not only to hold companies who violate the laws responsible but also equally so its employees, external advisers, accountants, etc. Combine this with reqiring people responsible for certain corporate functions such as those who make policy decisions with respect to the way corporations police laws, check for breaches of the anti-trust/monopoly act etc. to be licensed similarly in the way electricians and plumbers are licensed. Take away their licenses and they'd not be able to carry out their Jobs. I reckon this will eventually come to pass but I'd venture it'll come to Europe long before the US.
HDThoreaun 2y ago
Baking in resiliency is expensive. Its not obvious to me that it would be better to deal with that than to deal with issues like this once in a blue moon. Why not let the markets decide? If this ends up costing a bunch of money it will be fixed, if it doesnt it wasnt that big of a deal.
- lenerdenator 2y ago
  Because there's stuff money can't buy back, and in a lot of cases, that's human life and health. (1) And do the markets really decide? Do you really think the C-suite of Crowdstrike is going to spend the rest of their lives destitute for the losses they caused? Of course not. We have laws on the books that limit liability of businesses in these situations, and the "let the market decide" crowd are the first people to tell you these laws are a good idea because you can't possibly expect George Kurtz to do business in an environment where his 3 billion dollar fortune could be completely wiped out as the result of a court case, no matter how much damage his company did. Meanwhile the people who were screwed by this whole thing will be lucky to get a few grand out of a class-action judgment or settlement in five years. Markets _never_ actually decide. Not in a way that makes peaceful human society possible. You have to introduce systems to give minor players a way to redress grievances, or they'll find their own, often through less-than-sporting means. (1)
  - warkdarrior 2y ago
    > (1) Citation needed
    - lenerdenator 2y ago
      Ope https://www.kiro7.com/news/local/siblings-miss-crucial-life-extending-treatment-seattle-childrens-because-crowdstrike-outage/Y5EMEXGGQJE7PHDEAEKCWG6U4M/ https://www.kiro7.com/news/local/siblings-miss-crucial-life-...
Animats 2y ago
> We do not incentivize companies to operate secure, redundant, reliable computer systems. Except in the gambling industry. As part of a long-standing tradition, companies in the gambling industry are usually contractually required to take financial responsibility for errors. GTECH's annual report, before they were acquired by an Italian company, says "We paid or incurred liquidated damages with respect to our contracts in an amount equal to 0.61%, 0.18%, 0.50%, 0.47% and 0.14% of our annual revenues in fiscal 2006, 2005, 2004, 2003 and 2002, respectively."[1] So, forcing a transaction process service to take full responsibility for errors cost, at worst, 0.61% of revenue. This is sufficient to force gambling companies to use unusually good security technologies. The Nevada Gambling Commission has technical rules.[2] * "On-line slot systems may only communicate with equipment or programs external to the system through a secure interface. This interface will specifically not allow any external connection to directly access the alterable data of the system." Which means no privileged "security" systems such as Crowdstrike. * "Gaming device application access to the system based game must be logged automatically on the system component of the game and on a computer or other logging device that resides outside the secure area and is not accessible to the individual(s) accessing the secure area." Which means the really important info must not only be logged, the logs have to be kept where the people who run the systems can't get at them. There are more logging requirements. Most things require two logs, one used for normal operation and a remote backup with tamper resistance and secure hashes. * "Conditions for changing active software on a conventional gaming device or client station that is part of a system supported or system based game: (a) Be in the idle mode with no errors or tilts, no play and no credits on the machine for at least two (2) minutes; (b) Not be participating in an in-house or inter-casino linked payoff schedule..." There's more, but the general idea is that to change anything, you have to take the component being changed down to the idle, fully backed up state. Only then can changes be applied. All of which are logged. The gaming industry has faced hostile actors for decades. They have reasonably strong defenses. Yet they're still very profitable. [1] https://www.sec.gov/Archives/edgar/data/857323/000095012306004899/y19841e10vk.htm#103 https://www.sec.gov/Archives/edgar/data/857323/0000950123060... [2] https://gaming.nv.gov/uploadedFiles/gamingnvgov/content/Home/Features/TechnicalStandard3.pdf https://gaming.nv.gov/uploadedFiles/gamingnvgov/content/Home...

hilbert42 2y ago

...And I can't agree more. The question is what can be done, if anything. But I've a solution in my wildest dreams as a dictator. :-)

lenerdenator 2y ago
You introduce consequences against the people who have created the system that we're in now.
- dasil003 2y ago
  Even assuming you could narrow this down to a small enough set of people that can credibly be held responsible for creating the system we have now, and assuming you could impose consequences on them without violating their civil rights, and assuming they learnt their lesson and would actively take precautions to avoid their actions leading to such a systemic failure in the future, at best this would only influence those particular actors to avoid the previous failures. The next systemic failure would look quite different on the ground and come from different individuals pursuing different goals who would not have learnt any of the previous lessons. The only people who would see the connection would be more experienced people and/or intellectuals looking from a higher zoom level, but likely would not be empowered to really do anything to stop it given all the direct financial incentives motivating a much larger group of people to direct action. If our culture had more respect for elders and/or thinkers that could be a start, but even then it would still be an uphill battle in a capitalist society.
  - hilbert42 2y ago
    "…failure in the future, at best this would only influence those particular actors to avoid the pervious failures. " Not if laws were like the Monopoly square that has 'Go directly to jail' stamped in bold all over it. Just a few decent lockups would put the shivers down the backs of those so included. Trouble is governments have failed to implement the necessary laws. Unfortunately, as we've seen Big Tech is too big, too powerful, and too money-rich to be challenged effectively by governments.
    - dasil003 2y ago
      GP said "the system that we're in now", not the specific executive decisions and operational practices employed at Crowdstrike. I agree with you the latter could be addressed through accountability, but I struggle to see what kind of law would work the way you intend here. In general, regulation helps large corporations and because they have resources to maintain nominal compliance, as well as the layers/lawyers to maintain plausible deniability if things go sideways. Regulation tends to undermine competition which further cements their power and has many negative effects that span well beyond obvious failures due to poor engineering practices.
      - hilbert42 2y ago
        OK, but I'd argue regulation kept large corporations nominally in check before the greed-is-good mantra along with the belief that the only responsibility a corp has is to its shareholders—ideas that took hold and became prominent in the 1980s (Friedman, Hayek, Chicago School, et al). Big Tech is now so big and powerful that it essentially does what it does with impunity, fines for breaching laws are just a part of doing business, they have negible effect on the bottom line. The way of fixing the problem is not only to hold companies who violate the laws responsible but also equally so its employees, external advisers, accountants, etc. Combine this with reqiring people responsible for certain corporate functions such as those who make policy decisions with respect to the way corporations police laws, check for breaches of the anti-trust/monopoly act etc. to be licensed similarly in the way electricians and plumbers are licensed. Take away their licenses and they'd not be able to carry out their Jobs. I reckon this will eventually come to pass but I'd venture it'll come to Europe long before the US.

HDThoreaun 2y ago

Baking in resiliency is expensive. Its not obvious to me that it would be better to deal with that than to deal with issues like this once in a blue moon. Why not let the markets decide? If this ends up costing a bunch of money it will be fixed, if it doesnt it wasnt that big of a deal.

lenerdenator 2y ago
Because there's stuff money can't buy back, and in a lot of cases, that's human life and health. (1) And do the markets really decide? Do you really think the C-suite of Crowdstrike is going to spend the rest of their lives destitute for the losses they caused? Of course not. We have laws on the books that limit liability of businesses in these situations, and the "let the market decide" crowd are the first people to tell you these laws are a good idea because you can't possibly expect George Kurtz to do business in an environment where his 3 billion dollar fortune could be completely wiped out as the result of a court case, no matter how much damage his company did. Meanwhile the people who were screwed by this whole thing will be lucky to get a few grand out of a class-action judgment or settlement in five years. Markets _never_ actually decide. Not in a way that makes peaceful human society possible. You have to introduce systems to give minor players a way to redress grievances, or they'll find their own, often through less-than-sporting means. (1)
- warkdarrior 2y ago
  > (1) Citation needed
  - lenerdenator 2y ago
    Ope https://www.kiro7.com/news/local/siblings-miss-crucial-life-extending-treatment-seattle-childrens-because-crowdstrike-outage/Y5EMEXGGQJE7PHDEAEKCWG6U4M/ https://www.kiro7.com/news/local/siblings-miss-crucial-life-...

Animats 2y ago

> We do not incentivize companies to operate secure, redundant, reliable computer systems. Except in the gambling industry. As part of a long-standing tradition, companies in the gambling industry are usually contractually required to take financial responsibility for errors. GTECH's annual report, before they were acquired by an Italian company, says "We paid or incurred liquidated damages with respect to our contracts in an amount equal to 0.61%, 0.18%, 0.50%, 0.47% and 0.14% of our annual revenues in fiscal 2006, 2005, 2004, 2003 and 2002, respectively."[1] So, forcing a transaction process service to take full responsibility for errors cost, at worst, 0.61% of revenue. This is sufficient to force gambling companies to use unusually good security technologies. The Nevada Gambling Commission has technical rules.[2] * "On-line slot systems may only communicate with equipment or programs external to the system through a secure interface. This interface will specifically not allow any external connection to directly access the alterable data of the system." Which means no privileged "security" systems such as Crowdstrike. * "Gaming device application access to the system based game must be logged automatically on the system component of the game and on a computer or other logging device that resides outside the secure area and is not accessible to the individual(s) accessing the secure area." Which means the really important info must not only be logged, the logs have to be kept where the people who run the systems can't get at them. There are more logging requirements. Most things require two logs, one used for normal operation and a remote backup with tamper resistance and secure hashes. * "Conditions for changing active software on a conventional gaming device or client station that is part of a system supported or system based game: (a) Be in the idle mode with no errors or tilts, no play and no credits on the machine for at least two (2) minutes; (b) Not be participating in an in-house or inter-casino linked payoff schedule..." There's more, but the general idea is that to change anything, you have to take the component being changed down to the idle, fully backed up state. Only then can changes be applied. All of which are logged. The gaming industry has faced hostile actors for decades. They have reasonably strong defenses. Yet they're still very profitable. [1] https://www.sec.gov/Archives/edgar/data/857323/000095012306004899/y19841e10vk.htm#103 https://www.sec.gov/Archives/edgar/data/857323/0000950123060... [2] https://gaming.nv.gov/uploadedFiles/gamingnvgov/content/Home/Features/TechnicalStandard3.pdf https://gaming.nv.gov/uploadedFiles/gamingnvgov/content/Home...