4 ms·

Why single out the Chinese government? No government anywhere cares about defective software. "Engineering" is certainly not the correct term to apply to this i

Why single out the Chinese government? No government anywhere cares about defective software. "Engineering" is certainly not the correct term to apply to this industry. [1] Yahoo loses all of their 3 billion account credentials https://www.sec.gov/Archives/edgar/data/732712/000073271217000003/a2017_10x3xoathxexhibitx991.htm https://www.sec.gov/Archives/edgar/data/732712/0000732712170... [2] Equifax loses PII of 150 million Americans, including their SSNs https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/refunds/equifax-data-breach-... [3] AT&T loses SSNs of 73 million customers https://about.att.com/story/2024/addressing-data-set-released-on-dark-web.html https://about.att.com/story/2024/addressing-data-set-release... [4] AT&T loses phone call/texting metadata of 110 million customers https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm https://www.sec.gov/Archives/edgar/data/732717/0000732717240... [5] Change Healthcare loses medical records of 200 million Americans https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html https://www.hhs.gov/hipaa/for-professionals/special-topics/c... To someone not drinking your nationalist kool-aid, it looks rather preposterous to make this about the Chinese bogeyman.

bjelkeman-again 3mo ago
Yeah. I subscribe to a mailing list from a data security company that sends me a summary of breaches, daily. I know it is in their interest to keep me worried. But they aren’t making these stories up.
pjmlp 3mo ago
Yes, which is I am so bullish into having this industry getting liability like everywhere else. Cybersecurity laws are a good start, however thanks to lobbying it will still take decades.
Gigachad 3mo ago
It's only going to get so much worse. Most companies right now are dropping all the standards they still had to ship AI slop code as fast as possible.
xmprt 3mo ago
To be fair, in many (maybe all?) of those cases, those companies faced consequences. I highly doubt this company is going to face any consequence for this data breach.
- applfanboysbgon 3mo ago
  AT&T was fined $177 million for one data breach, which represents 12 hours of revenue, and $13 million for the other, which represents 54 minutes of revenue. "Consequences". Right.
  - xmprt 3mo ago
    You can brush that $177M fine aside but I'm almost certain that none of the Chinese companies above with these security vulnerabilities will pay even $1 in fines.
    - applfanboysbgon 3mo ago
      Because they didn't cause harm to 100 million people. The headline is a blatant lie. Nobody was hacked, the reporter hired a pentester to pentest a product. Is it a good thing that it's insecure, obviously not. But obviously this is going to be a legal non-event compared to leaking PII for 100m people, regardless of nationality of companies involved, when leaking PII for 100m people is already slap-on-the-wrist territory. There are also countless insecure American hardware products on the market that also don't result in litigation because the scale is not national news-worthy.

bjelkeman-again 3mo ago

Yeah. I subscribe to a mailing list from a data security company that sends me a summary of breaches, daily. I know it is in their interest to keep me worried. But they aren’t making these stories up.

pjmlp 3mo ago

Yes, which is I am so bullish into having this industry getting liability like everywhere else. Cybersecurity laws are a good start, however thanks to lobbying it will still take decades.

Gigachad 3mo ago

It's only going to get so much worse. Most companies right now are dropping all the standards they still had to ship AI slop code as fast as possible.

xmprt 3mo ago

To be fair, in many (maybe all?) of those cases, those companies faced consequences. I highly doubt this company is going to face any consequence for this data breach.

applfanboysbgon 3mo ago
AT&T was fined $177 million for one data breach, which represents 12 hours of revenue, and $13 million for the other, which represents 54 minutes of revenue. "Consequences". Right.
- xmprt 3mo ago
  You can brush that $177M fine aside but I'm almost certain that none of the Chinese companies above with these security vulnerabilities will pay even $1 in fines.
  - applfanboysbgon 3mo ago
    Because they didn't cause harm to 100 million people. The headline is a blatant lie. Nobody was hacked, the reporter hired a pentester to pentest a product. Is it a good thing that it's insecure, obviously not. But obviously this is going to be a legal non-event compared to leaking PII for 100m people, regardless of nationality of companies involved, when leaking PII for 100m people is already slap-on-the-wrist territory. There are also countless insecure American hardware products on the market that also don't result in litigation because the scale is not national news-worthy.