3 ms·

How could you possibly make it illegal to host insecure services? Is any service 100% secure? And if it were how would we know? I do agree with the audit and p

How could you possibly make it illegal to host insecure services? Is any service 100% secure? And if it were how would we know? I do agree with the audit and punishments for clear failure to adhere to established standards.

hsbauauvhabzb 5mo ago
No building has a 100% chance of not caving in, yet somehow I think charges would be laid if a skyscraper caved in.
- jameshart 5mo ago
  This analogy seems to be portraying 'ransomware hackers' as an unstoppable force of nature akin to gravity. I'm not sure that's a fair analogy.
  - ryandrake 5mo ago
    The other side of that spectrum portrays the service providers as pure, negligence-free victims. The truth is probably somewhere in the middle.
  - hsbauauvhabzb 5mo ago
    Your analogy portrays gravity as a thing that buildings cannot be built to withstand. There are plenty of structurally sound buildings and while there are plenty of secure apps the problem is there’s no incentive to build the latter.
    - jameshart 5mo ago
      On the contrary. My analogy would be: of course buildings have to be built to withstand gravity. That’s a natural part of the world that cannot be eliminated. Buildings are built to stand up to natural forces. But not to, for example, the threat of a malicious actor crashing a plane into them. That isn’t typically considered a reasonable thing to architect civilian infrastructure for. When you built IT infrastructure likewise you should build it to handle the natural forces it will be exposed to. But are you as accountable for securing it against the acts of malicious parties as a structural engineer is for securing a building against gravity, or as accountable for securing against those acts as the structural engineer is for securing that building against terrorists?
  - varun_ch 5mo ago
    I think it’s a very fair analogy. The _only_ way to stop them is to make your stuff secure. That’s literally the only way.
    - jameshart 5mo ago
      We do not generally hold victims of crimes accountable for failing to defend themselves adequately. If someone threatens you with a knife and gets you to hand over your wallet, your bank doesn’t get to say ‘you should have hired better security’ when the mugger uses your credit card. The problem here is the mugger, and that’s who the state goes after. Even if the victim walked into a bad area. Even if the victim could have defended themselves. Same with ransomware attackers. They are the problem. We might encourage potential victims to behave in ways that make it less likely for them to be targeted. But if they are targeted, we should still focus our societal disdain on the criminal not the victim.
      - christina97 5mo ago
        While I’m sympathetic to this argument (it would be great if the internet were a safe place), in practice this thinking leads to governments trying to impose legislation that hurts legitimate uses but does little to protect from the long tail of harm. There’s little that can be done about North Korean state sanctioned cybercrime without a great firewall. If the perpetrators of this hack were caught and in a developed country, they would certainly be prosecuted for their crimes and not get off light (especially if any data is actually leaked).
        jameshart 5mo ago
        I think states should be able to do better than a ‘great firewall’ to defend their domestic net infrastructure from malicious foreign actors. But I do think it should be much more states’ responsibility to make their domestic network safe for citizens and businesses and institutions to operate.
- sieve 5mo ago
  The equivalent analogy is charging lock/door/drywall/timber makers and suppliers for lapses if a thief entered the house by picking a lock or drilling/sawing through the wall.
  - hsbauauvhabzb 5mo ago
    No, it’s more like me storing my money at a bank, and then someone stealing from the bank, who told me they were secure. And turns out they had shitty locks.
bawolff 5mo ago
This is a solved problem in pretty much every other domain of life - if you are following best practises but something that wasn't reasonably forseeable happens, then you're fine, but if the bad thing happens as a result of negligence then you are in trouble.
- isityettime 5mo ago
  "Best practice" in cybersecurity is largely vendor-driven with little to no independent empirical validation. That standard is likely to lock people into buying some pretty bad software, but it does little to ensure that they're running reasonably secure systems.
- jameshart 5mo ago
  Criminal law isn't about making things alright for the victim. That's what insurance is for. Even if you leave your door unlocked, if someone walks in and steals your stuff, it's a crime. The state has an interest in prosecuting crimes even if the victim didn't do everything they could to prevent it.
  - bawolff 5mo ago
    The company is not the victim here. Its users are. [I suppose my previous comment was a bit ambigious - i meant something bad happens to someone else not to yourself] A better version of your analogy would be if your landlord failed to repair your front door in a reasonable period of time and as a result soneone walked in and stole your stuff. Yes the theif is the primary responsible party, but the landlords negligence in maintaining the property probably also exposes them to some liability. P.s. This is neither here nor there, but restitution is a part of criminal law.
    - jameshart 5mo ago
      Some liability, sure. Civil, not criminal, though, right? But the post I was responding to said it should be a crime to have unsecured systems. That is equivalent to saying it should be a crime to leave your door unlocked.
morning-coffee 5mo ago
"established standards" - now who has the incentive to run shitty services? those big enough to control the "established standards".

hsbauauvhabzb 5mo ago

No building has a 100% chance of not caving in, yet somehow I think charges would be laid if a skyscraper caved in.

jameshart 5mo ago
This analogy seems to be portraying 'ransomware hackers' as an unstoppable force of nature akin to gravity. I'm not sure that's a fair analogy.
- ryandrake 5mo ago
  The other side of that spectrum portrays the service providers as pure, negligence-free victims. The truth is probably somewhere in the middle.
- hsbauauvhabzb 5mo ago
  Your analogy portrays gravity as a thing that buildings cannot be built to withstand. There are plenty of structurally sound buildings and while there are plenty of secure apps the problem is there’s no incentive to build the latter.
  - jameshart 5mo ago
    On the contrary. My analogy would be: of course buildings have to be built to withstand gravity. That’s a natural part of the world that cannot be eliminated. Buildings are built to stand up to natural forces. But not to, for example, the threat of a malicious actor crashing a plane into them. That isn’t typically considered a reasonable thing to architect civilian infrastructure for. When you built IT infrastructure likewise you should build it to handle the natural forces it will be exposed to. But are you as accountable for securing it against the acts of malicious parties as a structural engineer is for securing a building against gravity, or as accountable for securing against those acts as the structural engineer is for securing that building against terrorists?
- varun_ch 5mo ago
  I think it’s a very fair analogy. The _only_ way to stop them is to make your stuff secure. That’s literally the only way.
  - jameshart 5mo ago
    We do not generally hold victims of crimes accountable for failing to defend themselves adequately. If someone threatens you with a knife and gets you to hand over your wallet, your bank doesn’t get to say ‘you should have hired better security’ when the mugger uses your credit card. The problem here is the mugger, and that’s who the state goes after. Even if the victim walked into a bad area. Even if the victim could have defended themselves. Same with ransomware attackers. They are the problem. We might encourage potential victims to behave in ways that make it less likely for them to be targeted. But if they are targeted, we should still focus our societal disdain on the criminal not the victim.
    - christina97 5mo ago
      While I’m sympathetic to this argument (it would be great if the internet were a safe place), in practice this thinking leads to governments trying to impose legislation that hurts legitimate uses but does little to protect from the long tail of harm. There’s little that can be done about North Korean state sanctioned cybercrime without a great firewall. If the perpetrators of this hack were caught and in a developed country, they would certainly be prosecuted for their crimes and not get off light (especially if any data is actually leaked).
      - jameshart 5mo ago
        I think states should be able to do better than a ‘great firewall’ to defend their domestic net infrastructure from malicious foreign actors. But I do think it should be much more states’ responsibility to make their domestic network safe for citizens and businesses and institutions to operate.
sieve 5mo ago
The equivalent analogy is charging lock/door/drywall/timber makers and suppliers for lapses if a thief entered the house by picking a lock or drilling/sawing through the wall.
- hsbauauvhabzb 5mo ago
  No, it’s more like me storing my money at a bank, and then someone stealing from the bank, who told me they were secure. And turns out they had shitty locks.

bawolff 5mo ago

This is a solved problem in pretty much every other domain of life - if you are following best practises but something that wasn't reasonably forseeable happens, then you're fine, but if the bad thing happens as a result of negligence then you are in trouble.

isityettime 5mo ago
"Best practice" in cybersecurity is largely vendor-driven with little to no independent empirical validation. That standard is likely to lock people into buying some pretty bad software, but it does little to ensure that they're running reasonably secure systems.
jameshart 5mo ago
Criminal law isn't about making things alright for the victim. That's what insurance is for. Even if you leave your door unlocked, if someone walks in and steals your stuff, it's a crime. The state has an interest in prosecuting crimes even if the victim didn't do everything they could to prevent it.
- bawolff 5mo ago
  The company is not the victim here. Its users are. [I suppose my previous comment was a bit ambigious - i meant something bad happens to someone else not to yourself] A better version of your analogy would be if your landlord failed to repair your front door in a reasonable period of time and as a result soneone walked in and stole your stuff. Yes the theif is the primary responsible party, but the landlords negligence in maintaining the property probably also exposes them to some liability. P.s. This is neither here nor there, but restitution is a part of criminal law.
  - jameshart 5mo ago
    Some liability, sure. Civil, not criminal, though, right? But the post I was responding to said it should be a crime to have unsecured systems. That is equivalent to saying it should be a crime to leave your door unlocked.

morning-coffee 5mo ago

"established standards" - now who has the incentive to run shitty services? those big enough to control the "established standards".