6 ms·

I feel like this goes too deep. Or maybe it hits on the right reason, but the wrong cause. The defender’s job isn’t defense. Cyber security isn’t a sportsball g

I feel like this goes too deep. Or maybe it hits on the right reason, but the wrong cause. The defender’s job isn’t defense. Cyber security isn’t a sportsball game where there are clear even goals and objectives with alternating positions. It’s a side show, and a distraction from the main business of whatever else the defenders are trying to do. By contrast, an attacker’s entire job is to attack the system. There is no other purpose they are serving, no secondary masters or considerations that need to be used to weaken their attacks. Attackers win for the same reason that Microsoft is better at publishing operating systems than Cisco, because ciscos operating systems are a means to an end. Microsoft’s are the end

yen223 2y ago
Cybersecurity being a sideshow to the main event is a brilliant way to frame the problem. It also explains why companies rarely get punished by the markets for data breaches.
- whiterknight 2y ago
  It’s firmly in the “cost” center.
  - hnaccount_rng 2y ago
    That’s a worse framing than above. It doesn’t matter if it’s a cost or a profit center. It’s part of a trade off. You could achieve a perfectly secure system, if and only if you make that system do exactly nothing. If you want to achieve any other outcome you will have to trade some measure of security for the ability to do anything. Or as Matt Levine so aptly put it: the optimal amount of fraud is non-zero
    - whiterknight 2y ago
      Indeed. But I’m pointing out if it’s not the goal, then it’s a cost to minimize to achieve the goal.
- TeMPOraL 2y ago
  Thing is, it's not a problem. A problem would be if cybersecurity was playing first fiddle. (When concerns of security become the main worry in an organization, the term we historically use to refer to it is "police state".)
  - djeastm 2y ago
    >police state Isn't a police state where a government is concerned with security above all else? To my mind, a place where private organizations are above all concerned with security is the exact opposite, anarchy, since there's no collective security framework in place to take the security burden off private organizations.
    - TeMPOraL 2y ago
      Police state on the inside, anarchy on the outside. This makes it even more similar to governments - sovereign nations are the highest organizational level; beyond them, there's no one to defer to. International affairs is anarchy - everyone's pogo dancing (to the tune set by nuclear powers).
notepad0x90 2y ago
I couldn't disagree more. Defenders and attackers are alike in many ways. I disagree with the post as well. Mature security teams for example use Bloodhound which uses neo4j to visualize attack paths in AD. Defenders (good ones) don't think in lists. > "The defender’s job isn’t defense." Yes, it is. Obviously! > "It’s a side show, and a distraction from the main business of whatever else the defenders are trying to do" I'm sorry, but what else are defenders trying to do that isn't defense? are all defenders completely incompetent then? > "By contrast, an attacker’s entire job is to attack the system." Yes, and there are people in mature security teams whose entire job is to search for and stop (not just react to alerts) attackers. > "Attackers win for the same reason that Microsoft is better at publishing operating systems than Cisco, because ciscos operating systems are a means to an end. Microsoft’s are the end" I think you have an incorrect perception of what security teams do. It is both a matter of strategy and resources. There are security teams whose budget is in the 100's of millions of dollars and who employ some of the brightest cybersecurity strategists and professionals. You rarely (if ever) hear their names in relation to a breach or compromise. There are also much less capable security teams who do well against most attackers, but will inevitably get pwned by an APT, except the good defenders catch the apt's before they cause significant damage. At well protected organizations, attackers lose 99.9% of the time (probably higher, I'm guessing here). Attackers simply need to win once to succeed, while defenders need to succeed 100% of the time.
- eropple 2y ago
  > I'm sorry, but what else are defenders trying to do that isn't defense? This is an uncharitably narrow reading of the post to which you're replying, isn't it? Defenders are trying to ship. To make money to make payroll. Create profit centers, not cost centers. You can say that security is a feature and a load-bearing one, and I'd agree with you, but not everyone who makes decisions will do the same.
  - notepad0x90 2y ago
    You're wrong, defenders are not profit centers. You don't expect the security guard for your office building to generate profit, why would you do so for your digital assets? defenders are like lawyers and hr, they are cost centers whose existence is justified because attackers also exist. > "You can say that security is a feature and a load-bearing one, and I'd agree with you, but not everyone who makes decisions will do the same." Maybe it is, but I wouldn't put it that way. Security teams exist because people with bad intent that want to harm you exist. Just like lawyers exist because people who sue you (including the government) exist. Imagine stating "lawyers don't exist to protect from lawsuits", that's how it sounds to me. If defenders aren't there to defend, then their existence isn't justified. > "Defenders are trying to ship" Defenders are there so that when other teams who "ship" attempt to do so, they don't get the application, system, company or wherever you have protected data doesn't get compromised. And this is before and after "shipping" or deployment. Security is a cost of business, whose RoI is measured by the fact that you are doing business without getting hacked, nothing more.
tsujamin 2y ago
> By contrast, an attacker’s entire job is to attack the system. If cyber defence is a sideshow to the actual businesses objectives, then surely the same holds of cyber attack and whatever the actual criminal/strategic goal?
- tpmoney 2y ago
  Not at all. The attack is directly inline with the goal of getting to whatever is at the other end of the attack. By contrast, nothing about SSL certificates, forward secrecy, encryption at rest or authentication and access controls is inline with the goals of say Facebook to deliver as many cat pictures and political memes to you as possible, and as many eyeballs to advertisers as possible. Or put another way, in a world with 0 cyber security attackers, there would be no money or time spent on cyber security defense. But in a world with 0 cyber security defenders, there would still be people attacking resources and taking things the owners would rather they not have.
- makeitdouble 2y ago
  Cyber attacks are in the same position as sales in most orgs: they can focus on getting other people's money and some failure rate is acceptable as they don't get paid much if they don't succeed. The org can invest as much as they bring in, they're a profit center, where defense is always a cost center that will be reduced to the minimum acceptable.
mcmcmc 2y ago
> By contrast, an attacker’s entire job is to attack the system. There is no other purpose they are serving, no secondary masters or considerations that need to be used to weaken their attacks. This seems like a serious misconception. Cyber attacks absolutely have purpose, whether that’s to steal data, disrupt services, whatever. Your viewpoint might apply to unsophisticated actors who just want to break things and cause chaos, but it’s completely ignorant when considering nation-state actors and financially motivated criminals.
- throwaway290 2y ago
  Attacker purpose is perfectly aligned but defense may not align with tons of things like user convenience or ease of development
- tpmoney 2y ago
  Yes, but that purpose is accomplished by way of attacking the system. By comparison, most cyber security defense gets in the way of the purpose of the defenders. We know this, and even joke about it openly. The ultimate secure system is a computer unplugged, sealed in a lead vault, encased in concrete and buried a mile beneath the surface. It might not be useful, but it is completely secure. Even less flippantly though, we inherently know this. How many things do we do every day that could be "more secure", but "more secure" gets in the way? Do you use memorize 256 character unique passwords for every site and system and refuse to record them even in a password manager? Do you use GPG encrypted emails and only E2E encrypted messaging services? Are all your home network devices independently fire walled, with strict in AND outbound rules ensuring they can only talk to the specific devices they should be able to talk to and only on specific well defined ports? Have you hardened your home network against data exfiltration via DNS queries? Is all network traffic fully encrypted with mutual client and server cert validations? If you've answered no to any of these questions, you have chosen to prioritize something else over better cyber security defense. And it's probably a good bet that at least some of that is because doing these things would actively get in the way of doing what you actually want to do with your electronic devices. You've knowingly chosen a weaker defensive stance to do something else instead. Attackers on the other hand have no need to choose weaker attacks on your defenses in order to do something else instead. The attack is the point of their usage of their devices (and yours). You might argue that the attacker might choose a lesser profile in order to remain hidden and beneath detection, but I would argue this still isn't the same choice. Given the option, no company would spend any time or money on resources for cyber defense. They would rather spend all that time and money on their actual business. But Attackers would spend time and money and resources on their attacks because those attacks directly serve their goals.
amelius 2y ago
I think the main problem is that most organizations put security at the end of the budget list.
- tpmoney 2y ago
  Even if they put it near the top, it's still going to be reduced in effectiveness by the actual needs and goals of the organization. Any company that has a VPN and remote employees is objectively and inherently weaker from a cyber security standpoint than an otherwise equally equipped company with no external access to the network. But they do that because remote employee access means they can do their actual business better. Any company that uses networked computers in objectively and inherently weaker from a cyber security standpoint than one which requires physically moving data from one machine to another by way of personal handoffs between employees at the same physical location, but they do that because it means they can do their actual business better. It does not matter if cyber security is at the top or the bottom of your budget list, if the choice is ever "better cyber security" or "do more business", cyber security is always going to lose that battle. You will never convince a company to use E2E encrypted email for all communications with all customers and vendors, no matter how high on the budget list cyber security is, because doing so would actively hinder the day to day operations of the business.
  - exe34 2y ago
    the safest computer is turned off, in a Faraday cage, in a vault under a mountain.
    - szundi 2y ago
      Or thrown out from the solar system, antenna facing an other galaxy
  - TheColorYellow 2y ago
    I don't think this is relevant. Even on-prem "air gapped" networks get breached. I would say it happens on as frequent a basis as any other network tbh. Microsoft hacks get headlines because Microsoft is a public company; there are lots of undisclosed breaches happening out there. Security vulnerabilities come from the same place they always have. Where IO happens, where transactions happen, and where an operating system does a lot of work. How attackers get to these points, what happens when they do, and then how the system reacts when a malicious event occurs are the factors that matter. In today's world of complex technologies, I have yet to meet a single organization that is invulnerable to these threats. I've seen a lot of organizations limit damage, patch vulnerabilities, and generally manage their risk profile effectively - but losses are a part of the business. IMO, the only thing that will really make a difference is when we have technologies that are sufficient enough to male the user more resilient. Only then can we have a truly safer web.
greenthrow 2y ago
This is exactly right. There's also the underlying asymmetry; defenders need to get everything right, attackers only need one vulnerability. (Which is usually human behavior based.)
edejong 2y ago
For cloud providers, security is their raison d’etre. On the cloud you can have confidentiality, integrity and availability that was unheard of two decades ago.
- tpmoney 2y ago
  No, it's not. Cloud provider's raison d'etre is selling access to compute resources. That confidentiality and integrity are resources they can also sell does mean that they might spend more on those things than would otherwise be expected but if their single and sole purpose was security, they would't be selling networked access to computer systems at all because that is objectively less secure than physical terminal access. But no cloud company that requires their customers to staff a physical presence at a terminal in the data center is going to be as successful as one that allows you to remote into your cloud from anywhere, even though tht is objectively less secure.
9991 2y ago
> Microsoft is better at publishing operating systems Is that a joke? Microsoft seems to be in the advertising business. Their OSes are also a means to an end.
bryanrasmussen 2y ago
> There is no other purpose they are serving, no secondary masters or considerations that need to be used to weaken their attacks. Nowadays their purpose has some sort of monetization component, therefore there is consideration as to which attack vectors seem to be the most likely to lead to the kind of a monetization scheme they are targeting on. For example does a group of attackers ransoming companies prefer the same attacks as phishing individuals? Are these the same companies / groups (I prefer companies at this point, they are organized crime, they are a company and have the same sort of problems in that any small company have in deciding where to put their resources - we don't have a phishing division here, we ransom data, we don't denial of service - nobody is paying us for that, we ransom data and that's it!)
- tpmoney 2y ago
  Sure, the final business goal is selling access to the resources gained by the attack, but ultimately the attacking IS aligned with/directly enables that goal. Defense in cyber security is almost always at odds with the goals of defender's business. Or put another way, if there were no Attackers, no one would spend any money on cyber security defense. But if there were no Defenders, someone would still be paying for cyber security attacks.
blueflow 2y ago
> It’s a side show, and a distraction from the main business I'm pissed this is accepted as normal for the IT sector, while in railroad engineering and aviation (where human lives are at stake) you'd get your licenses and certificates revoked. Therac-25 something.
- TeMPOraL 2y ago
  Security != safety. Safety in civil engineering and aviation is paramount. Security is an annoying, bolt-on side issue at best, nonexistent typically (e.g. railroads). Therac-25 was a safety event, not a cybersecurity event.
  - blueflow 2y ago
    IT security is a thing at all because software safety is near non-existent.
    - stavros 2y ago
      How are you going to retain safety in a compromised software system?
      - blueflow 2y ago
        You don't? Safety is not having that compromise in the first place. Like, if the code can handle all input correctly, then there is no exploit path. Regardless of whether the input comes from an attacker or not.
        stavros 2y ago
        You said "security is a thing because safety is nonexistent". This means that, if you had safety, you wouldn't need security. I'm asking you to explain how a perfectly safe system wouldn't need security, as someone who compromised it would be able to simply undo all the safety.
deleted 2y ago
[deleted]
vishnugupta 2y ago
This is well put. I think one way to drive home the point is defenders are cost centers and attackers are profit centers.
deleted 2y ago
[deleted]

yen223 2y ago

Cybersecurity being a sideshow to the main event is a brilliant way to frame the problem. It also explains why companies rarely get punished by the markets for data breaches.

whiterknight 2y ago
It’s firmly in the “cost” center.
- hnaccount_rng 2y ago
  That’s a worse framing than above. It doesn’t matter if it’s a cost or a profit center. It’s part of a trade off. You could achieve a perfectly secure system, if and only if you make that system do exactly nothing. If you want to achieve any other outcome you will have to trade some measure of security for the ability to do anything. Or as Matt Levine so aptly put it: the optimal amount of fraud is non-zero
  - whiterknight 2y ago
    Indeed. But I’m pointing out if it’s not the goal, then it’s a cost to minimize to achieve the goal.
TeMPOraL 2y ago
Thing is, it's not a problem. A problem would be if cybersecurity was playing first fiddle. (When concerns of security become the main worry in an organization, the term we historically use to refer to it is "police state".)
- djeastm 2y ago
  >police state Isn't a police state where a government is concerned with security above all else? To my mind, a place where private organizations are above all concerned with security is the exact opposite, anarchy, since there's no collective security framework in place to take the security burden off private organizations.
  - TeMPOraL 2y ago
    Police state on the inside, anarchy on the outside. This makes it even more similar to governments - sovereign nations are the highest organizational level; beyond them, there's no one to defer to. International affairs is anarchy - everyone's pogo dancing (to the tune set by nuclear powers).

notepad0x90 2y ago

I couldn't disagree more. Defenders and attackers are alike in many ways. I disagree with the post as well. Mature security teams for example use Bloodhound which uses neo4j to visualize attack paths in AD. Defenders (good ones) don't think in lists. > "The defender’s job isn’t defense." Yes, it is. Obviously! > "It’s a side show, and a distraction from the main business of whatever else the defenders are trying to do" I'm sorry, but what else are defenders trying to do that isn't defense? are all defenders completely incompetent then? > "By contrast, an attacker’s entire job is to attack the system." Yes, and there are people in mature security teams whose entire job is to search for and stop (not just react to alerts) attackers. > "Attackers win for the same reason that Microsoft is better at publishing operating systems than Cisco, because ciscos operating systems are a means to an end. Microsoft’s are the end" I think you have an incorrect perception of what security teams do. It is both a matter of strategy and resources. There are security teams whose budget is in the 100's of millions of dollars and who employ some of the brightest cybersecurity strategists and professionals. You rarely (if ever) hear their names in relation to a breach or compromise. There are also much less capable security teams who do well against most attackers, but will inevitably get pwned by an APT, except the good defenders catch the apt's before they cause significant damage. At well protected organizations, attackers lose 99.9% of the time (probably higher, I'm guessing here). Attackers simply need to win once to succeed, while defenders need to succeed 100% of the time.

eropple 2y ago
> I'm sorry, but what else are defenders trying to do that isn't defense? This is an uncharitably narrow reading of the post to which you're replying, isn't it? Defenders are trying to ship. To make money to make payroll. Create profit centers, not cost centers. You can say that security is a feature and a load-bearing one, and I'd agree with you, but not everyone who makes decisions will do the same.
- notepad0x90 2y ago
  You're wrong, defenders are not profit centers. You don't expect the security guard for your office building to generate profit, why would you do so for your digital assets? defenders are like lawyers and hr, they are cost centers whose existence is justified because attackers also exist. > "You can say that security is a feature and a load-bearing one, and I'd agree with you, but not everyone who makes decisions will do the same." Maybe it is, but I wouldn't put it that way. Security teams exist because people with bad intent that want to harm you exist. Just like lawyers exist because people who sue you (including the government) exist. Imagine stating "lawyers don't exist to protect from lawsuits", that's how it sounds to me. If defenders aren't there to defend, then their existence isn't justified. > "Defenders are trying to ship" Defenders are there so that when other teams who "ship" attempt to do so, they don't get the application, system, company or wherever you have protected data doesn't get compromised. And this is before and after "shipping" or deployment. Security is a cost of business, whose RoI is measured by the fact that you are doing business without getting hacked, nothing more.

tsujamin 2y ago

> By contrast, an attacker’s entire job is to attack the system. If cyber defence is a sideshow to the actual businesses objectives, then surely the same holds of cyber attack and whatever the actual criminal/strategic goal?

tpmoney 2y ago
Not at all. The attack is directly inline with the goal of getting to whatever is at the other end of the attack. By contrast, nothing about SSL certificates, forward secrecy, encryption at rest or authentication and access controls is inline with the goals of say Facebook to deliver as many cat pictures and political memes to you as possible, and as many eyeballs to advertisers as possible. Or put another way, in a world with 0 cyber security attackers, there would be no money or time spent on cyber security defense. But in a world with 0 cyber security defenders, there would still be people attacking resources and taking things the owners would rather they not have.
makeitdouble 2y ago
Cyber attacks are in the same position as sales in most orgs: they can focus on getting other people's money and some failure rate is acceptable as they don't get paid much if they don't succeed. The org can invest as much as they bring in, they're a profit center, where defense is always a cost center that will be reduced to the minimum acceptable.

mcmcmc 2y ago

> By contrast, an attacker’s entire job is to attack the system. There is no other purpose they are serving, no secondary masters or considerations that need to be used to weaken their attacks. This seems like a serious misconception. Cyber attacks absolutely have purpose, whether that’s to steal data, disrupt services, whatever. Your viewpoint might apply to unsophisticated actors who just want to break things and cause chaos, but it’s completely ignorant when considering nation-state actors and financially motivated criminals.

throwaway290 2y ago
Attacker purpose is perfectly aligned but defense may not align with tons of things like user convenience or ease of development
tpmoney 2y ago
Yes, but that purpose is accomplished by way of attacking the system. By comparison, most cyber security defense gets in the way of the purpose of the defenders. We know this, and even joke about it openly. The ultimate secure system is a computer unplugged, sealed in a lead vault, encased in concrete and buried a mile beneath the surface. It might not be useful, but it is completely secure. Even less flippantly though, we inherently know this. How many things do we do every day that could be "more secure", but "more secure" gets in the way? Do you use memorize 256 character unique passwords for every site and system and refuse to record them even in a password manager? Do you use GPG encrypted emails and only E2E encrypted messaging services? Are all your home network devices independently fire walled, with strict in AND outbound rules ensuring they can only talk to the specific devices they should be able to talk to and only on specific well defined ports? Have you hardened your home network against data exfiltration via DNS queries? Is all network traffic fully encrypted with mutual client and server cert validations? If you've answered no to any of these questions, you have chosen to prioritize something else over better cyber security defense. And it's probably a good bet that at least some of that is because doing these things would actively get in the way of doing what you actually want to do with your electronic devices. You've knowingly chosen a weaker defensive stance to do something else instead. Attackers on the other hand have no need to choose weaker attacks on your defenses in order to do something else instead. The attack is the point of their usage of their devices (and yours). You might argue that the attacker might choose a lesser profile in order to remain hidden and beneath detection, but I would argue this still isn't the same choice. Given the option, no company would spend any time or money on resources for cyber defense. They would rather spend all that time and money on their actual business. But Attackers would spend time and money and resources on their attacks because those attacks directly serve their goals.

amelius 2y ago

I think the main problem is that most organizations put security at the end of the budget list.

tpmoney 2y ago
Even if they put it near the top, it's still going to be reduced in effectiveness by the actual needs and goals of the organization. Any company that has a VPN and remote employees is objectively and inherently weaker from a cyber security standpoint than an otherwise equally equipped company with no external access to the network. But they do that because remote employee access means they can do their actual business better. Any company that uses networked computers in objectively and inherently weaker from a cyber security standpoint than one which requires physically moving data from one machine to another by way of personal handoffs between employees at the same physical location, but they do that because it means they can do their actual business better. It does not matter if cyber security is at the top or the bottom of your budget list, if the choice is ever "better cyber security" or "do more business", cyber security is always going to lose that battle. You will never convince a company to use E2E encrypted email for all communications with all customers and vendors, no matter how high on the budget list cyber security is, because doing so would actively hinder the day to day operations of the business.
- exe34 2y ago
  the safest computer is turned off, in a Faraday cage, in a vault under a mountain.
  - szundi 2y ago
    Or thrown out from the solar system, antenna facing an other galaxy
- TheColorYellow 2y ago
  I don't think this is relevant. Even on-prem "air gapped" networks get breached. I would say it happens on as frequent a basis as any other network tbh. Microsoft hacks get headlines because Microsoft is a public company; there are lots of undisclosed breaches happening out there. Security vulnerabilities come from the same place they always have. Where IO happens, where transactions happen, and where an operating system does a lot of work. How attackers get to these points, what happens when they do, and then how the system reacts when a malicious event occurs are the factors that matter. In today's world of complex technologies, I have yet to meet a single organization that is invulnerable to these threats. I've seen a lot of organizations limit damage, patch vulnerabilities, and generally manage their risk profile effectively - but losses are a part of the business. IMO, the only thing that will really make a difference is when we have technologies that are sufficient enough to male the user more resilient. Only then can we have a truly safer web.

greenthrow 2y ago

This is exactly right. There's also the underlying asymmetry; defenders need to get everything right, attackers only need one vulnerability. (Which is usually human behavior based.)

edejong 2y ago

For cloud providers, security is their raison d’etre. On the cloud you can have confidentiality, integrity and availability that was unheard of two decades ago.

tpmoney 2y ago
No, it's not. Cloud provider's raison d'etre is selling access to compute resources. That confidentiality and integrity are resources they can also sell does mean that they might spend more on those things than would otherwise be expected but if their single and sole purpose was security, they would't be selling networked access to computer systems at all because that is objectively less secure than physical terminal access. But no cloud company that requires their customers to staff a physical presence at a terminal in the data center is going to be as successful as one that allows you to remote into your cloud from anywhere, even though tht is objectively less secure.

9991 2y ago

> Microsoft is better at publishing operating systems Is that a joke? Microsoft seems to be in the advertising business. Their OSes are also a means to an end.

bryanrasmussen 2y ago

> There is no other purpose they are serving, no secondary masters or considerations that need to be used to weaken their attacks. Nowadays their purpose has some sort of monetization component, therefore there is consideration as to which attack vectors seem to be the most likely to lead to the kind of a monetization scheme they are targeting on. For example does a group of attackers ransoming companies prefer the same attacks as phishing individuals? Are these the same companies / groups (I prefer companies at this point, they are organized crime, they are a company and have the same sort of problems in that any small company have in deciding where to put their resources - we don't have a phishing division here, we ransom data, we don't denial of service - nobody is paying us for that, we ransom data and that's it!)

tpmoney 2y ago
Sure, the final business goal is selling access to the resources gained by the attack, but ultimately the attacking IS aligned with/directly enables that goal. Defense in cyber security is almost always at odds with the goals of defender's business. Or put another way, if there were no Attackers, no one would spend any money on cyber security defense. But if there were no Defenders, someone would still be paying for cyber security attacks.

blueflow 2y ago

> It’s a side show, and a distraction from the main business I'm pissed this is accepted as normal for the IT sector, while in railroad engineering and aviation (where human lives are at stake) you'd get your licenses and certificates revoked. Therac-25 something.

TeMPOraL 2y ago
Security != safety. Safety in civil engineering and aviation is paramount. Security is an annoying, bolt-on side issue at best, nonexistent typically (e.g. railroads). Therac-25 was a safety event, not a cybersecurity event.
- blueflow 2y ago
  IT security is a thing at all because software safety is near non-existent.
  - stavros 2y ago
    How are you going to retain safety in a compromised software system?
    - blueflow 2y ago
      You don't? Safety is not having that compromise in the first place. Like, if the code can handle all input correctly, then there is no exploit path. Regardless of whether the input comes from an attacker or not.
      - stavros 2y ago
        You said "security is a thing because safety is nonexistent". This means that, if you had safety, you wouldn't need security. I'm asking you to explain how a perfectly safe system wouldn't need security, as someone who compromised it would be able to simply undo all the safety.

deleted 2y ago

[deleted]

vishnugupta 2y ago

This is well put. I think one way to drive home the point is defenders are cost centers and attackers are profit centers.

deleted 2y ago

[deleted]