4 ms·

Did you see Google or facebook or Miceosoft customer databases breached ? The issue is there is too little repercusions for companies making software in shitty

by pojzon 1y ago

Did you see Google or facebook or Miceosoft customer databases breached ? The issue is there is too little repercusions for companies making software in shitty ways. Each data breach should hurt the company approximately to the size of it. Equifax breach should have collapsed the company. Fines should be in tens of billions of dollars. Then under such banhammer software would be built correctly, security would becared about, internal audits would be made (real ones) and people would care. Currently as things stand. There is ZERO reason to care about security.

GlacierFox 1y ago
Didn't Sharepoint get hacked the other day? :S
- jaynate 1y ago
  Yes, but those were on-prem deployments of Sharepoint, not Microsoft's infratructure.
  - Spooky23 1y ago
    Many of those deployments were there because Microsoft can’t deliver the required assurance level!
  - sugarpimpdorsey 1y ago
    Is the non-defective software only available in the SaaS version?
  - samplatt 1y ago
    It was for ALL on-prem deployments. This wasn't due to the user being insecure, this was Microsoft's fault. If anything it's yet another point AGAINST them - if they can't guarantee secure software without the caveat of running on a closed hardware black box then it's not secure software.
slivanes 1y ago
I’m all for companies to not ignore their responsibility for data management, but I’m concerned that type of punishment could be used as a weapon against competitors. I can imagine that certain classes of useful companies would just not be able to exist. Tricky balance to make companies actually care without crippling insurance.
tempnew 1y ago
Microsoft just compromised the National Nuclear Security Administration last week. Facebook was breached what last month? Google is an ad company. They can’t sell data that’s breached. They basically do email, and with phishing at epidemic levels, they’ve failed the consumer even at that simple task. All are too big to fail so there is only congress to blame. While people like Rho Khana focus their congressional resources on the Epstein intrigue citizens are having their savings stolen by Indian scammers and there is clearly no interest and nothing on the horizon to change that.
- reactordev 1y ago
  Agree. Google is buying the data for ads and ad brokerages. Don’t kid yourself. They may use a 3rd party to distance themselves but they definitely buy the data.
- gruez 1y ago
  >Facebook was breached what last month? source? A quick search suggests the "breach" is a bunch of credentials that got harvested/phished got leaked, not that facebook themselves got breached. >Google is an ad company. They can’t sell data that’s breached. They basically do email, and with phishing at epidemic levels, they’ve failed the consumer even at that simple task. In other words, they haven't been breached, but you still think they're bad people.
  - tempnew 1y ago
    To me, Facebooks’ entire business model seems like spyware and selling personal info to third parties. Whether people at such companies are good or bad is not at issue. I assume most people everywhere are good people. But are the companies themselves “good”? Microsoft and Google maybe, certainly in the past (Google wave was very innovative). But Facebook? The context was privacy and people being victimized by Indian scammers. We know those scammers use Facebook to gather info and target victims, all without any actual breach taking place. To me, not having a breach does not make Facebook “good”.
    - 1y ago
conception 1y ago
Microsoft lost their root keys to Azure. ¯\_(ツ)_/¯
- baobun 1y ago
  And had the Russians reading their exec emails
reactordev 1y ago
We need both. The allowance by law enforcement to do cyber security as well as engineers not writing shitty software and lax IAM permissions or exposing private keys or the myriad of ways they mess up.
bobmcnamara 1y ago
> Did you see Google or facebook or Miceosoft customer databases breached ? Are you being facetious? Yes, yes, yes, they have.
- deleted 1y ago
  [deleted]
- abenga 1y ago
  Do you have concrete examples of incidents? Honestly asking.
  - bobmcnamara 1y ago
    This is the first notable, semi-reputable Google result for each "${COMPANY_NAME} data breach". Some of these are examples of an API being leveraged to exfiltrate database records rather than direct database breaches like getting the admin password to postgres. If you want to see more for the same company, try appending "-{YEAR_OF_KNOWN_DATA_BREACH}" to skip the ones you've already read, though this will tend to exclude companies who have multiple data breaches in one year. https://en.m.wikipedia.org/wiki/2018_Google_data_breach https://en.m.wikipedia.org/wiki/2018_Google_data_breach https://www.npr.org/2021/04/09/986005820/after-data-breach-exposes-530-million-facebook-says-it-will-not-notify-users https://www.npr.org/2021/04/09/986005820/after-data-breach-e... https://support.microsoft.com/en-us/topic/national-public-data-breach-what-you-need-to-know-843686f7-06e2-4e91-8a3f-ae30b7213535 https://support.microsoft.com/en-us/topic/national-public-da...
Den_VR 1y ago
I’m curious. What do you think about legalizing “hack-back” ?
- red-iron-pine 1y ago
  not a solution
- clown_strike 1y ago
  Given how many attacks are false flags conducted through proxies this would be disastrous. However, open intermediary victims up to contributory lawsuits and everyone will have to take security more seriously. Think twice before you connect that new piece of shit IoT device.
arvinsim 1y ago
I agree. When it becames penalized by law, project owners/managers won't be tempted to take shorcuts and will have the incentive to give developers more time to focus on security.
lr1970 1y ago
> The issue is there is too little repercusions for companies making software in shitty ways. The penalty should be massive enough to affect changes in the business model itself. If you do not store raw data it cannot be exfiltrated.
Xx_crazy420_xX 1y ago
There is some incentive to leave 0days in customer software, as it creates a commodity to be sold on gray 0day markets. On the other hand, securing your own garden brings less value then covering and deneing that your 'secure' cloud platform was whacked.

by pojzon 1y ago

GlacierFox 1y ago

Didn't Sharepoint get hacked the other day? :S

jaynate 1y ago
Yes, but those were on-prem deployments of Sharepoint, not Microsoft's infratructure.
- Spooky23 1y ago
  Many of those deployments were there because Microsoft can’t deliver the required assurance level!
- sugarpimpdorsey 1y ago
  Is the non-defective software only available in the SaaS version?
- samplatt 1y ago
  It was for ALL on-prem deployments. This wasn't due to the user being insecure, this was Microsoft's fault. If anything it's yet another point AGAINST them - if they can't guarantee secure software without the caveat of running on a closed hardware black box then it's not secure software.

slivanes 1y ago

I’m all for companies to not ignore their responsibility for data management, but I’m concerned that type of punishment could be used as a weapon against competitors. I can imagine that certain classes of useful companies would just not be able to exist. Tricky balance to make companies actually care without crippling insurance.

tempnew 1y ago

Microsoft just compromised the National Nuclear Security Administration last week. Facebook was breached what last month? Google is an ad company. They can’t sell data that’s breached. They basically do email, and with phishing at epidemic levels, they’ve failed the consumer even at that simple task. All are too big to fail so there is only congress to blame. While people like Rho Khana focus their congressional resources on the Epstein intrigue citizens are having their savings stolen by Indian scammers and there is clearly no interest and nothing on the horizon to change that.

reactordev 1y ago
Agree. Google is buying the data for ads and ad brokerages. Don’t kid yourself. They may use a 3rd party to distance themselves but they definitely buy the data.
gruez 1y ago
>Facebook was breached what last month? source? A quick search suggests the "breach" is a bunch of credentials that got harvested/phished got leaked, not that facebook themselves got breached. >Google is an ad company. They can’t sell data that’s breached. They basically do email, and with phishing at epidemic levels, they’ve failed the consumer even at that simple task. In other words, they haven't been breached, but you still think they're bad people.
- tempnew 1y ago
  To me, Facebooks’ entire business model seems like spyware and selling personal info to third parties. Whether people at such companies are good or bad is not at issue. I assume most people everywhere are good people. But are the companies themselves “good”? Microsoft and Google maybe, certainly in the past (Google wave was very innovative). But Facebook? The context was privacy and people being victimized by Indian scammers. We know those scammers use Facebook to gather info and target victims, all without any actual breach taking place. To me, not having a breach does not make Facebook “good”.
  - 1y ago

conception 1y ago

Microsoft lost their root keys to Azure. ¯\_(ツ)_/¯

baobun 1y ago
And had the Russians reading their exec emails

reactordev 1y ago

We need both. The allowance by law enforcement to do cyber security as well as engineers not writing shitty software and lax IAM permissions or exposing private keys or the myriad of ways they mess up.

bobmcnamara 1y ago

> Did you see Google or facebook or Miceosoft customer databases breached ? Are you being facetious? Yes, yes, yes, they have.

deleted 1y ago
[deleted]
abenga 1y ago
Do you have concrete examples of incidents? Honestly asking.
- bobmcnamara 1y ago
  This is the first notable, semi-reputable Google result for each "${COMPANY_NAME} data breach". Some of these are examples of an API being leveraged to exfiltrate database records rather than direct database breaches like getting the admin password to postgres. If you want to see more for the same company, try appending "-{YEAR_OF_KNOWN_DATA_BREACH}" to skip the ones you've already read, though this will tend to exclude companies who have multiple data breaches in one year. https://en.m.wikipedia.org/wiki/2018_Google_data_breach https://en.m.wikipedia.org/wiki/2018_Google_data_breach https://www.npr.org/2021/04/09/986005820/after-data-breach-exposes-530-million-facebook-says-it-will-not-notify-users https://www.npr.org/2021/04/09/986005820/after-data-breach-e... https://support.microsoft.com/en-us/topic/national-public-data-breach-what-you-need-to-know-843686f7-06e2-4e91-8a3f-ae30b7213535 https://support.microsoft.com/en-us/topic/national-public-da...

Den_VR 1y ago

I’m curious. What do you think about legalizing “hack-back” ?

red-iron-pine 1y ago
not a solution
clown_strike 1y ago
Given how many attacks are false flags conducted through proxies this would be disastrous. However, open intermediary victims up to contributory lawsuits and everyone will have to take security more seriously. Think twice before you connect that new piece of shit IoT device.

arvinsim 1y ago

I agree. When it becames penalized by law, project owners/managers won't be tempted to take shorcuts and will have the incentive to give developers more time to focus on security.

lr1970 1y ago

> The issue is there is too little repercusions for companies making software in shitty ways. The penalty should be massive enough to affect changes in the business model itself. If you do not store raw data it cannot be exfiltrated.

Xx_crazy420_xX 1y ago

There is some incentive to leave 0days in customer software, as it creates a commodity to be sold on gray 0day markets. On the other hand, securing your own garden brings less value then covering and deneing that your 'secure' cloud platform was whacked.