Live data from Hacker News

Equifax’s Maddening Unaccountability

nytimes.com

91–100 of 238 posts

Re: Equifax’s Maddening Unaccountability

#91

Earlier quoted context omitted.

You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).

Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

Because the patriot act. https://www.edmunds.com/car-buying/car-dealership-credit-rep...

I was also very surprised to buy a car with cash, only to have a credit check required. It's a real thing. And according to this article, not required, but dealerships are confused by the language of the law and insist on running a credit check, anyway.

Re: Equifax’s Maddening Unaccountability

#92
post #90

"I’m not unsympathetic to the needs of software developers." Yes she is. I read this as completely unrealistic expectations from the author. Struts is maintained by one person. https://github.com/apache/struts/graphs/contributors "Most software failures and data breaches aren’t inevitable; they are a result of neglect and underinvestment in product reliability and security." The attack happened in late July. The bug…

> Struts is maintained by one person.

I see nowhere in the op-ed piece where Tufekci mentions Struts or implies that she holds Struts responsible for this. She is clearly laying this at Equifax's feet, and their responsibility in their choice of software and the industry as a whole for actively pushing against better software practices and responsibility.

The section you quoted is followed by:

> Some number of unexpected errors — bugs — are unavoidable in computer programs. It would be unreasonable to allow a consumer to sue a software company every time a program suffered a glitch.

She's laying out a much more nuanced argument than you're given her credit for. You're right in that this seems to be zero-day which are more difficult to defend against, but there are practices (among them, defense in depth, and pen tests) which can limit the attack surface. Also actively looking for known exploit types (rather than specific exploit instances). For example, buffer overflows are a known attack vector in C, so people harden their code against buffer overflows. Deserialization attacks are known in Java, so people harden their code against deserialization attacks. SQL injection attacks are a known exploit type, so people learn to parameterize their SQL queries.

It's clear that this is something you care about and are passionate about. For topics that affect me like this, I consciously take a breath and re-read what I've reacted to, to see if my second (or third) read matches up with my first.

Re: Equifax’s Maddening Unaccountability

#93
post #37
post #28

Earlier quoted context omitted.

Since when is 3 billion dollars in revenue not serious money?

Because you and I do NOT pay for or directly use the product that contributes to the $3B. I can buy a phone and still avoid Apple. I can use the web and still avoid Google. I can avoid Facebook altogether (some argument as to wether I can actually avoid this). But if I want to use a credit card, buy a house, etc. I cannot escape Equifax.

Thanks. I understand your point now. It's money that will motivate congress but in reality the Equifax breach is more impactful to you or me.

Re: Equifax’s Maddening Unaccountability

#94
post #85

Earlier quoted context omitted.

The credit system sucks. But has anybody created a better alternative yet?

Yes! Germany and I presume other European countries have a much better system. The main difference is that there is no magic number that any one can use to borrow money in your name. Lenders have to verify a person's identity using ID. Further more, to get loan you don't have build up a score first. You could get a margage if you have never borrowed money in your life but have a stable income.

> You could get a margage if you have never borrowed money in your life but have a stable income.

Same in the US, although it's a bit of a pain in the ass. It's my understanding, though, (correct me if I'm wrong!) that Germany is a bit less thrilled about credit than most other countries—even in Europe.

Re: Equifax’s Maddening Unaccountability

#95

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

The credit system sucks. But has anybody created a better alternative yet?

Note that this is a great question to ask about all the f*ed up things in the USA. Hardly ever asked though for some reason. Having been the country that landed people on the moon seems to have removed the option to ask if other countries have better ways of doing things.

Re: Equifax’s Maddening Unaccountability

#96

Earlier quoted context omitted.

You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).

Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

[deleted]

Re: Equifax’s Maddening Unaccountability

#97

Earlier quoted context omitted.

You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).

Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

Can confirm. I bought a car last week in California with cash. Dealer did a credit check.

The system is rotten and (short of moving country) impossible to avoid.

Re: Equifax’s Maddening Unaccountability

#98
post #74

Earlier quoted context omitted.

> You may want to think twice. Try to design an architecture that doesn't have that. We have an architecture like that where I work. It's not that hard. Our web applications have very little direct access to databases; most of it is mediated by services downstream of the web app. That's certainly not a silver bullet, but it makes it impossible to exploit a RCE vuln in the web server in such a way that it lets you hav…

Have you had a netpen? Give me access to your web server (aka an RCE) and I can probably find a way to pivot to your downstream databases.

That's the point, you have to pivot. If you don't have to jump through another host or two to get unfettered database access from web tier, you're doing it wrong.

Re: Equifax’s Maddening Unaccountability

#99

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

Recourse? Of course there are! You can subscribe to paying them protection fee that's very vague on what it actually does and that you can't unsubscribe without faxing and snail mailing them forms.

Totally reasonable.

Post reply on HN