Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax’s Maddening Unaccountability

nytimes.com

Post reply on HN
Print view View original

151–160 of 238 posts

Re: Equifax’s Maddening Unaccountability

#151

Post by grzm »

danjoc wrote: post #150
grzm wrote: post #125

Earlier quoted context omitted.

> She's blaming the software industry and software failure. That's Apache, and Struts. I interpret her differently: > There are technical factors that explain why cybersecurity is so weak, but the underlying reason is political, and it’s pretty simple: Big corporations have poured large amounts of money into our political system, helping to create a regulatory environment in which consumers shoulder more and more of…

>software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. TIL: No warranty == impunity. Nobody MADE Equifax use Struts. The source is open to inspection. The bug existed there for 8 years. Let's see how many audits Equifax did on the source code with no warranty. >If the costs of failure in production due to bugs were higher, businesses would make differ…

I'm sorry. I really think we're talking past each other. At this point I'm having a really hard time figuring out what you're trying to say.

I see you equating Struts and software practices with the businesses that use software. I see those as two separate things.

> Nobody MADE Equifax use Struts.

Yup.

> The source is open to inspection.

Yup.

> Let's see how many audits Equifax did on the source code with no warranty.

I'm not sure why you're including this. I think they should have done source code audits in accordance with how they weighed the costs/revenues. Do you disagree? I personally tend to lean towards more tests and code analysis, but I understand others weigh this differently.

> If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software.

I place the responsibly with the company using Struts in their product, not the Struts dev. I'm not sure how you're getting the impression I (or Zufrekci, for that matter) place this on the Struts dev. I'm responsible for the results of the applications I put into production, including the libraries I choose to use in that application. I don't hold generally hold the devs who wrote those libraries responsible.

Like I said, I think we're talking past each other. I still think you're reading too much into (and too little close reading of) Zufrekci, but I'm not sure how better to express what I'm trying to say. I've now read the piece through 3 times fully and I really don't see her making any of the points you're arguing against.

If you've got specific questions about what I've written, please ask. Otherwise, I'll sign off. Have a good evening!

Re: Equifax’s Maddening Unaccountability

#152

Post by SmirkingRevenge »

tyingq wrote: post #107
chiefalchemist wrote: post #38

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

I suspect it will become a priority soon. Somebody is likely to pastebin the data for some cabinet members, Congresspersons, etc. Then the matter will make it to the front of the queue.

Which sadly makes it a very short list of people they actually have to compensate for their troubles.

Re: Equifax’s Maddening Unaccountability

#153

Post by TulliusCicero »

dunham wrote: post #146
seanp2k2 wrote: post #142

Earlier quoted context omitted.

It should ask for permission if you try to do that, not when you install the app.

It might be an android thing. In iOS you can ask when you need it, and still use the app if you say no. I've gotten the impression that Android asks everything up front at installation time and doesn't install if you say no, but I'm not an android user/dev so I don't know for sure.

That used to be true but the permissions model changed to just-in-time a couple versions ago.

Re: Equifax’s Maddening Unaccountability

#154

Post by mark-r »

The author likens this to automotive safety, but I think a better analogy would be airline safety. When an airplane goes down, an immediate investigation is done by third parties to find the cause. Then remedial steps are drawn up and the entire industry is expected to follow them, not just the company involved in the accident. Data breaches need to be held to this standard.

Re: Equifax’s Maddening Unaccountability

#155

Post by cfeduke »

School-Cotton wrote: post #83
djsumdog wrote: post #73

Earlier quoted context omitted.

You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).

Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

You also cannot buy a house with cash. We had to launder my father's life savings in a bank for six months before we could use it to buy his house, because the seller still had a mortgage on the property when he listed the property. (Why my father's life savings was under his bed is a completely different story.)

Re: Equifax’s Maddening Unaccountability

#156

Post by avodonosov »

losteric wrote: post #88
chiefalchemist wrote: post #38

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

I still hold that this shouldn't matter to consumers. My priority of problems is * When fraud happens, banks can pass the pain and burden of proof onto consumers. * Banks use insecure SSNs for authorization; some data is used for validating eligibility, authenticating the application, and authorizing the loan. * There are minimal regulations on storing different classes of personal information (We need sarbanes-oxley…

I heard in US if somebody knows your SSN, he can take a loan accounted to you by phone.

It is so strange.

What gives banks right to do that?

Re: Equifax’s Maddening Unaccountability

#157

Post by fred_is_fred »

cloakandswagger wrote: post #19
bob1029 wrote: post #11

Earlier quoted context omitted.

>but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There w…

Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M? Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.

You need to think beyond the fine. There will be costs of new regulations (if passed), increased costs for lobbying against any said efforts, loss of revenue (would you want to have your company name as a partner for Equifax), and finally lawsuits.

Going long may make sense but we've not hit bottom yet.

Re: Equifax’s Maddening Unaccountability

#158

Post by drewmol »

Equifax played a slightly different version if this commercial during Monday Night Football a few times, it takes no accountability, but also doubles-down, claims your info might* be on the dark-web(*because they just negligently released it), and offers a "dark-web-scan" service to help find it...

https://www.youtube.com/watch?v=vjrydnr_pvQ

Re: Equifax’s Maddening Unaccountability

#159

Post by danjoc »

grzm wrote: post #151
danjoc wrote: post #150

Earlier quoted context omitted.

>software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. TIL: No warranty == impunity. Nobody MADE Equifax use Struts. The source is open to inspection. The bug existed there for 8 years. Let's see how many audits Equifax did on the source code with no warranty. >If the costs of failure in production due to bugs were higher, businesses would make differ…

I'm sorry. I really think we're talking past each other. At this point I'm having a really hard time figuring out what you're trying to say. I see you equating Struts and software practices with the businesses that use software. I see those as two separate things. > Nobody MADE Equifax use Struts. Yup. > The source is open to inspection. Yup. > Let's see how many audits Equifax did on the source code with no warranty…

>I place the responsibly

Nobody cares where you, or I, place it. You don't write for the NYTimes. You don't have that sort of sphere of influence.

>with the company using Struts in their product, not the Struts dev.

They don't.

http://nypost.com/2017/09/08/equifax-blames-giant-breach-on-...

It's very easy to explain to the public. "Those software hacker people did this to you. Look, here he is. He made the faulty software. Burn him at the stake."

Zufrekci is with them, blaming the developer.

Developer licensure, here we come. Illegal to write open source software. Another one of those crazy Richard Stallman predictions that comes true while you guys sleepwalk into the dystopia.

https://www.gnu.org/philosophy/right-to-read.html

Re: Equifax’s Maddening Unaccountability

#160

Post by davidcuddeback »

School-Cotton wrote: post #83
djsumdog wrote: post #73

Earlier quoted context omitted.

You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).

Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

They don't. I just bought a car from a dealership on August 1 without a credit check.

The dealership wanted to run a credit check if I were to pay with a personal check, but not if I paid with certified funds. I called my bank to have my debit card limit raised to $40,000 for 24 hours and paid for the car on my debit card with no credit check.

Post reply on HN