Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. to give ransomware hacks similar priority as terrorism, official says

reuters.com

Post reply on HN
Print view View original

531–540 of 591 posts

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#531

Post by WalterBright »

gilbetron wrote: post #515
passwordqwe wrote: post #426

Earlier quoted context omitted.

But there is a big difference between airline safety and software safety. An airliner survives against the environment, it's PvE, a software system has to survive against hackers, it's PvP. If you shoot a rocket at an airliner, the airliner will fail, in that case we blame the person who shot the rocket.

Not only that, but we spend billions of dollars on defense to protect those airlines from bad actors. I mean when a person blows up a bomb in an airplane, our response isn't "build bomb-proof airplanes".

It turns out that airplanes are fairly resistant to bombs aboard. Several attempts with smaller bombs have failed, despite causing significant damage. The cockpit door has been hardened, too.

Airliners are now pretty resistant to engine explosions, once thought to be impossible to do.

Keep in mind that a bunker will never fly.

Nobody is suggesting not going after criminals who attack software.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#532

Post by WalterBright »

grawprog wrote: post #526
WalterBright wrote: post #460

Earlier quoted context omitted.

> What is your source on this? See "Trust the programmer" https://beza1e1.tuxen.de/articles/spirit_of_c.html Also, a general belief among C++ programmers that better training is the answer to programming bugs. This belief is slowly fading, but it's got a long way to go. Scott Meyers' books on Effective C++ represent a lot of effort to educate programmers out of making mistakes. For example, from the table of contents…

>If C++ was an airplane, #define would simply be removed. So would that make D the airplane version of C++?

In my paper "The Origins of the D Programming Language" I enumerate many direct influences aircraft design has had on D.

https://dl.acm.org/doi/abs/10.1145/3386323#:~:text=The%20D%2....

BTW, I practice dual path in my personal life. If I'm doing something risky, I have a backup. For example, when I work under my car, I put the car on two sets of jackstands, even though I use stands that are rated for trucks. I'd never rely on a single rope/piton if rock climbing. I cringe when I see climbers doing that. I carry an extra coat in the car in winter, and water when driving in the desert.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#533

Post by bostik »

im3w1l wrote: post #413
tracerbulletx wrote: post #199

Earlier quoted context omitted.

Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.

You have a lot of replies but as far as I can see no one made this point, so let me add yet another reply. Victim blaming is a framing that makes it sound like it's about moral and ethics. But it's about practicality. There is a causal chain leading to a bad outcome and we simply break the weakest link. Sometimes it's easier to lock up the treasure and sometimes it's easier to lock up all the thieves. Consider the ca…

> Locking up all the thieves is super duper hard, because they are located in places like Russia and China that wont cooperate with law enforcement.

Oh, they do. With their local ones. Those thieves can operate with impunity as long as they don't hit their fellow countrymen.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#534

Post by kersplody »

chongli wrote: post #25

What about the other side of this? Instead of seeking backdoors and using them to spy on Americans, the NSA should be stepping up their game and securing vital infrastructure and domestic businesses against these attacks.

The DHS in conjunction with the FBI is supposed to be protecting our critical systems from foreign attackers -- and they are failing spectacularly. New laws and new approaches will be required to even begin to make headway, especially where private companies' operations intersect with national security issues. When should the feds be allowed to access my network to verify my assets are secure.

The NSA's charter is foreign signals intelligence (including computer networks), not law enforcement -- They can't spy on Americans in America except under extraordinary circumstances (Must have a FISA warrant and that person must be talking to one of a few thousand foreign bad actors). And even then, the collected data is not court admissible. Only the FBI and other law enforcement agencies can spy on Americans in America in legally admissible ways using court orders.

The real issue here is when exploits should be weaponized or shared with industry. Should we prioritize the protection of our networks or should we penetrate the networks of our adversaries? This is a tricky political question that needs to be seriously addressed, the status quo is broken.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#535

Post by WalterBright »

MR4D wrote: post #519
WalterBright wrote: post #418

Earlier quoted context omitted.

It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that f…

> And the largest piece of hubris and madness in critical systems is allowing over-the-internet updates. What would you suggest in its place? You'd need to replace the internet with something - postal mail, Fedex, courier deliveries, etc, or just have things that never get upgraded. Every one of those options has significant limitations, and in many countries, I'd trust SSL over postal mail every single day. I think…

For critical systems, I suggest using a usb drive.

Do you really want a missile guidance system update-able over the internet? How about the auto drive system on your car? What about the code that keeps track of accounts in your bank? Don't forget the code that keeps the pipeline running!

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#536

Post by WalterBright »

throwaway210222 wrote: post #497
WalterBright wrote: post #471

Earlier quoted context omitted.

Certification/regulation is something orthogonal to the design methods used.

I disagree, mandated certification ensures that the budget required for certain design (and testing) methods is available. And its precisely those methods that keep the planes in the sky. Its not orthogonal, is a necessary prerequisite.

Dual path systems came first. Regulation came much later, it wasn't a prerequisite. Regulation didn't design airplanes, it standardized existing practice.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#537

Post by WalterBright »

542354234235 wrote: post #489
imranhou wrote: post #476

Earlier quoted context omitted.

I don't think this is valid comparison. If you are trying to compare software on a plane to application, then airplane software is not attempted to hack into due to it being generally well isolated from outside networks. If you are comparing physical build of systems in a plane to software, then hacking of software is equivalent to bird or drone running into an engine or a laser attack or hijack attempt... Which whil…

At the risk of putting words in their mouth, they are comparing the method of airplane safety, where they look at redundancy (assume X will fail and the plane needs to survive this), looking at system solutions over individual fault (redesigning a warning indicator so pilots cannot miss it rather than blaming individual pilots that do miss it), and a regulatory body of investigators that enforce standards and investi…

Yes.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#538

Post by jessaustin »

chitowneats wrote: post #493
jessaustin wrote: post #323

Earlier quoted context omitted.

Sure, the people who aren't proposing to outlaw mathematics are the confused ones...

If you honestly believe shutting down the likes of Coinbase and Kraken requires "outlawing math", you're gonna be real disappointed.

Thanks for finally admitting your intentions. I don't see a similar suggestion anywhere ITT or TFA, but it all did seem a bit too coy. Physically, it would be possible to shut down e.g. Coinbase. Legally, that seems a stretch. Politically, with the particular investors they now have, you're trying to shut the barn door after the horse has joined the circus.

Shutting down Coinbase, however, will have no effect on bitcoin or the people who use it. That's the point of bitcoin, and it has been since the protocol was published.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#539

Post by virtue3 »

ryanlol wrote: post #411
tkinom wrote: post #201

Earlier quoted context omitted.

Follow the $$$. If US government authorizes the NSA/CIA to infiltrate/attack all bitcoin exchanges that accept payments from wallet ID with ransomware, the problem likely be solved very quickly.

Not if the hackers use monero.

at some point they have to turn monero into currency.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#540

Post by grawprog »

WalterBright wrote: post #532
grawprog wrote: post #526

Earlier quoted context omitted.

>If C++ was an airplane, #define would simply be removed. So would that make D the airplane version of C++?

In my paper "The Origins of the D Programming Language" I enumerate many direct influences aircraft design has had on D. https://dl.acm.org/doi/abs/10.1145/3386323#:~:text=The%20D%2... . BTW, I practice dual path in my personal life. If I'm doing something risky, I have a backup. For example, when I work under my car, I put the car on two sets of jackstands, even though I use stands that are rated for trucks. I'd nev…

Thanks for sharing. I knew some of D's history, but there was stuff in there I hadn't read before.

I like much of the way D's designed. It doesn't try to be flashy, gimicky or different for the sake of being different. It gives you a set of practical tools and doesn't try to be too opinionated on the way they should be used. It mostly makes it hard to shoot yourself in the foot. But if you really want to you can. You gotta really try though.

Post reply on HN