5 ms·

Cases like this usually boil down to one of three things: 1) Someone left an unpatched server exposed to the Internet for months with a known critical vulnerab

Cases like this usually boil down to one of three things: 1) Someone left an unpatched server exposed to the Internet for months with a known critical vulnerability. 2) Someone uploaded the data to a world-readable S3 bucket or similar, or left it in an Internet-accessible database server with no authentication. 3) Someone with administrative credentials was using the password "password1!" or similar with no two-factor authentication. In an ideal world (not the world we live in), in these cases, that someone would be prosecuted for gross negligence.

pjc50 1y ago
Perhaps. So you prosecute your £30k low rank administrative assistant in charge of the thing. All the other unionized low-paid civil servants immediately go "we didn't sign up for this liability" and refuse to touch anything that could be deemed computer administration. Government grinds to a halt. Something similar happened to the British Museum a couple of years ago. Almost certainly an even worse pay/qualifications employer.
- egorfine 1y ago
  Sounds about right. So, shall we not protect people's data?
- jaoane 1y ago
  You prosecute whoever set the system up. The same way you’d prosecute a surgeon for malpractice. These are professionals. It’s their responsibility to build a solid, secure system. If they can’t or don’t want to then they should find another job.
  - oaththrowaway 1y ago
    Then you're going to have to start paying entry level IT like surgeons. Nobody is going to take that kind of risk for $30K.
    - ben_w 1y ago
      Or this becomes another profession where everyone gets (and needs) liability insurance. That might not be a bad thing, if the insurance comes with some kind of way to get lower premiums for being less risky.
    - AlotOfReading 1y ago
      More likely, they'd just start carrying errors and omissions insurance for a bit extra.
    - lurking_swe 1y ago
      since when does entry level IT “call the shots” on reviewing code that gets deployed to prod? Sure a junior programmer or devops may do something dumb. That’s not the problem - at all. The problem is pretending they are a professional. They are not. They are juniors that need mentorship and should be _expected_ to mess up frequently. To use a different analogy. If I bring my car to the mechanic, i’m OK with the new guy working on my car, assuming that the senior mechanic, you know, double checks their work. Is that not a reasonable assumption? None of this makes ANY sense to me. To be blunt.
  - egorfine 1y ago
    They are professionals. They cannot upgrade this particular windows server, because the software they're running on it requires visual basic 6.0 support. The vendor cannot provide any upgrade for their system, because certifying anything newer than Windows 2003 for this software is prohibitively expensive for the vendor. You cannot switch vendor due to obscure clauses in contract. Real situation btw.
  - netdevphoenix 1y ago
    If the pay difference doesn't reflect that additional responsibility, it probably is not expected
    - jaoane 1y ago
      I am not convinced by this attitude of “I am being paid peanuts so I’m not going to do my job”. If you don’t like the salary then find some other job.
      - celticninja 1y ago
        You have an incomplete understanding of the situation. The services that have been affected are 3rd party systems, built by the private sector on a government contract. The service was built by people who were not going to support it. It is not possible to upgrade and patch these services. The civil servant developers working on them do what they can, but they have been warming management, who have warned government, that they systems are insecure, but govt won't spend money on updating them. There are services built by civil servant developers, that are built with security in mind, and they are not affected by this breach. So it's nothing to do with being paid peanuts, or not wanting to do the best job possible. It's very easy to backseat drive and offer opinions but your opinion is based on a fallacy.
        lurking_swe 1y ago
        > The civil servant developers working on them do what they can, but they have been warming management, who have warned government, that they systems are insecure, but govt won't spend money on updating them. Makes sense. So if i’m understanding this right, the fault basically lies with the decision maker(s) in government who said “nope, not worth paying $x to secure/maintain our systems” Sounds to me like they shouldn’t be allowed to create these public facing systems in the first place if they can’t afford (or don’t want to) maintain them. no? That would be like paying someone to build a bridge for you and then deciding to purposely ignore maintenance on the bridge when the experts warn you it needs maintenance.
- harvey9 1y ago
  If someone puts a low rank admin assistant in charge then the boss needs prosecuting. It would be the public sector version of getting the boss's nephew to do it.
  - celticninja 1y ago
    But that's not what happened. It wasn't left unpatched because of incompetence of the developers. It's because it cannot be upgraded to a secure version of the software and to replace the entire system would cost a lot of money. Money that the Tory govt didnt want to spend. There are ongoing efforts to reduce reliance on this legacy tech but it's not an overnight solution.
egorfine 1y ago
It seems to me that 1) is the norm, not an exception in large enough corporations and especially government orgs. Personally, I do not see any other way out of this other than somehow criminalizing running outdated software.
drexlspivey 1y ago
Prosecuting someone for not having a strong enough password is beyond ridiculous. Your ideal world sounds like a black mirror episode.
- caulkboots 1y ago
  How would you feel if a bank used a screen door to access their vault? Protecting other people's info comes with responsibility.
  - drexlspivey 1y ago
    How about enforcing strong passwords or non-password authentication at the org level instead of puting rank and file employees to jail?

pjc50 1y ago

Perhaps. So you prosecute your £30k low rank administrative assistant in charge of the thing. All the other unionized low-paid civil servants immediately go "we didn't sign up for this liability" and refuse to touch anything that could be deemed computer administration. Government grinds to a halt. Something similar happened to the British Museum a couple of years ago. Almost certainly an even worse pay/qualifications employer.

egorfine 1y ago
Sounds about right. So, shall we not protect people's data?
jaoane 1y ago
You prosecute whoever set the system up. The same way you’d prosecute a surgeon for malpractice. These are professionals. It’s their responsibility to build a solid, secure system. If they can’t or don’t want to then they should find another job.
- oaththrowaway 1y ago
  Then you're going to have to start paying entry level IT like surgeons. Nobody is going to take that kind of risk for $30K.
  - ben_w 1y ago
    Or this becomes another profession where everyone gets (and needs) liability insurance. That might not be a bad thing, if the insurance comes with some kind of way to get lower premiums for being less risky.
  - AlotOfReading 1y ago
    More likely, they'd just start carrying errors and omissions insurance for a bit extra.
  - lurking_swe 1y ago
    since when does entry level IT “call the shots” on reviewing code that gets deployed to prod? Sure a junior programmer or devops may do something dumb. That’s not the problem - at all. The problem is pretending they are a professional. They are not. They are juniors that need mentorship and should be _expected_ to mess up frequently. To use a different analogy. If I bring my car to the mechanic, i’m OK with the new guy working on my car, assuming that the senior mechanic, you know, double checks their work. Is that not a reasonable assumption? None of this makes ANY sense to me. To be blunt.
- egorfine 1y ago
  They are professionals. They cannot upgrade this particular windows server, because the software they're running on it requires visual basic 6.0 support. The vendor cannot provide any upgrade for their system, because certifying anything newer than Windows 2003 for this software is prohibitively expensive for the vendor. You cannot switch vendor due to obscure clauses in contract. Real situation btw.
- netdevphoenix 1y ago
  If the pay difference doesn't reflect that additional responsibility, it probably is not expected
  - jaoane 1y ago
    I am not convinced by this attitude of “I am being paid peanuts so I’m not going to do my job”. If you don’t like the salary then find some other job.
    - celticninja 1y ago
      You have an incomplete understanding of the situation. The services that have been affected are 3rd party systems, built by the private sector on a government contract. The service was built by people who were not going to support it. It is not possible to upgrade and patch these services. The civil servant developers working on them do what they can, but they have been warming management, who have warned government, that they systems are insecure, but govt won't spend money on updating them. There are services built by civil servant developers, that are built with security in mind, and they are not affected by this breach. So it's nothing to do with being paid peanuts, or not wanting to do the best job possible. It's very easy to backseat drive and offer opinions but your opinion is based on a fallacy.
      - lurking_swe 1y ago
        > The civil servant developers working on them do what they can, but they have been warming management, who have warned government, that they systems are insecure, but govt won't spend money on updating them. Makes sense. So if i’m understanding this right, the fault basically lies with the decision maker(s) in government who said “nope, not worth paying $x to secure/maintain our systems” Sounds to me like they shouldn’t be allowed to create these public facing systems in the first place if they can’t afford (or don’t want to) maintain them. no? That would be like paying someone to build a bridge for you and then deciding to purposely ignore maintenance on the bridge when the experts warn you it needs maintenance.
harvey9 1y ago
If someone puts a low rank admin assistant in charge then the boss needs prosecuting. It would be the public sector version of getting the boss's nephew to do it.
- celticninja 1y ago
  But that's not what happened. It wasn't left unpatched because of incompetence of the developers. It's because it cannot be upgraded to a secure version of the software and to replace the entire system would cost a lot of money. Money that the Tory govt didnt want to spend. There are ongoing efforts to reduce reliance on this legacy tech but it's not an overnight solution.

egorfine 1y ago

It seems to me that 1) is the norm, not an exception in large enough corporations and especially government orgs. Personally, I do not see any other way out of this other than somehow criminalizing running outdated software.

drexlspivey 1y ago

Prosecuting someone for not having a strong enough password is beyond ridiculous. Your ideal world sounds like a black mirror episode.

caulkboots 1y ago
How would you feel if a bank used a screen door to access their vault? Protecting other people's info comes with responsibility.
- drexlspivey 1y ago
  How about enforcing strong passwords or non-password authentication at the org level instead of puting rank and file employees to jail?