U.S. to give ransomware hacks similar priority as terrorism, official says • Hacker News Board

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#561

Post by 3pt14159 » Fri, Jun 04, 2021, 11:35 PM UTC

haimez wrote: post #319

3pt14159 wrote: post #148

Earlier quoted context omitted.

The incentives are all misaligned and the solutions aren't obvious. How is the USG going to secure some random admin access password? Are they going to update the code in the repo? I agree with hack-back. I agree with a number of proposed solutions, but at the very end of the day the problem with cybersecurity is that most orgs don't have the fiscal allocation that they need if they were to have any hope of stoping f…

> most fragrant violations I love the smell of marginally improved security practices in the morning.

Thank you for teaching me the difference between the two words with humour. I'm 35 and I somehow completely forgot it was spelled flagrant.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#562

Post by tempestn » Fri, Jun 04, 2021, 11:57 PM UTC

ixacto wrote: post #530

tempestn wrote: post #397

Earlier quoted context omitted.

Those bets could be easier to trace than the ransom payment though. Is there a way to make market bets completely untraceably?

Yes they can just pay in monero.

Just pay what? I'm not aware of a way to buy stocks or options anonymously with monero.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#563

Post by tempestn » Fri, Jun 04, 2021, 11:59 PM UTC

maerF0x0 wrote: post #523

tempestn wrote: post #391

Earlier quoted context omitted.

But the parent's point is that's still putting the liability on the vendor rather than the actual criminal. Perhaps it's more like if a car is sold without an immobilizer or an alarm, holding the manufacturer liable if it's stolen. But if that kind of fails, because it's pretty simple to mandate a handful of security additions to cars, whereas software is orders of magnitude more varied and complex. It would be hard…

Yeah, I think it's just a fault in the analogy and in part demonstrating why reason from analogy is faulty. My point is this If vendors were liable (at least in part) for security faults in their products, then they would be more diligent about closing those gaps.

Yeah, and in principle I agree. It's just tough to imagine how exactly you'd regulate that in practice without doing a lot of unintended harm along the way, especially to (potential) small vendors.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#564

Post by chitowneats » Sat, Jun 05, 2021, 12:01 AM UTC

jessaustin wrote: post #560

chitowneats wrote: post #558

Earlier quoted context omitted.

You’re well aware I’m not talking about opening your neighbor’s mail, or any other "crimes" that are still on the books but never prosecuted. When I refer to the federal crimes that are committed daily by crypto enthusiasts, I’m talking about blatant tax evasion that makes the Panama Papers look like child’s play. In a sane world, none of it would be possible. Soon enough.

Do you propose that Bezos should pay his taxes at the same rates my neighbors and I pay? That sounds good, but I don't see what it has to do with bitcoin. Do you allege that he is hiding income by not reporting it? It has been my impression that he prefers instead to hire people to write the tax law in his interests. You keep focusing on the enforcement itself rather than the goals we hope to accomplish via enforceme…

Just a special distaste for the crypto crowd. Who somehow manage to moralize all day about "authoritarian capitalism" while skimming off everyone in society with their tax avoidance scam.

I'm inclined to say Jeff Bezos is no better. But then I remember he and his companies have actually produced some innovations that are legitimately beneficial.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#565

Post by snowflake_ptr » Sat, Jun 05, 2021, 12:09 AM UTC

Given the borderline compliance with JPMorgan Chase that the DoJ engaged in[1], I'm not hopeful that this is going to go anywhere.

[1] https://www.rollingstone.com/politics/politics-news/the-9-bi...

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#566

Post by salawat » Sat, Jun 05, 2021, 2:10 AM UTC

WalterBright wrote: post #531

gilbetron wrote: post #515

Earlier quoted context omitted.

Not only that, but we spend billions of dollars on defense to protect those airlines from bad actors. I mean when a person blows up a bomb in an airplane, our response isn't "build bomb-proof airplanes".

It turns out that airplanes are fairly resistant to bombs aboard. Several attempts with smaller bombs have failed, despite causing significant damage. The cockpit door has been hardened, too. Airliners are now pretty resistant to engine explosions, once thought to be impossible to do. Keep in mind that a bunker will never fly. Nobody is suggesting not going after criminals who attack software.

The cockpit door being hardened introduces its own set of problems as well, and the engine failure containment is a good point.

Though the prevailing logic on a bunker taking flight is that the engine size will be too large to be economical, which you probably factor in, Walter, but the uninitiated in the aerospace industry tend to simplify away.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#567

Post by mcguire » Sat, Jun 05, 2021, 2:13 AM UTC

restalis wrote: post #552

mcguire wrote: post #550

Earlier quoted context omitted.

Because word processor documents have often been the vectors for attacks. And once an attack is inside your systems, there is nothing preventing the attack attached to a document from infecting and encrypting your machine or infecting your PLC and destroying your industrial equipment.

I'd say that the surface of attack here is the industrial equipment's link to general computing equipment (which it's expected to be less secure). The solution just can't be to secure the whole world of software that may somehow end up on general use computers. The point is, my remark is still valid, as a discussion on critical systems got mixed with clearly non-critical ones.

Ok, so I shouldn't have confused the issue by mentioning Stuxnet.

The point is, failing to secure those general use computers has bad consequences.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#568

Post by bouncycastle » Sat, Jun 05, 2021, 2:30 AM UTC

chitowneats wrote: post #494

dragonwriter wrote: post #87

Earlier quoted context omitted.

> Do you know how absurd that would be? Bitcoin is just a database in essence It’s really bot unusual for the law to treat things differently based on the purpose for which they are used when they are “just a database, in essence”.

I assume you'd have no issue taking down a database full of child pornography? You know there are some who argue that CP is just "bits on disk". What if society determines that cryptocurrency also has negative externalities? You're free to disagree but I just stuck my finger in the air and it's pretty clear which way the wind is blowing.

The only societies who determine that cryptocurrencies have negative externalities are the ones that are controlled by criminals in the highest levels of their government. Just google a map to see where crypto has been banned. (Note that many these may not even appear as criminals and project a legitimate image to their public)

Here's a thought experiment: If you're a political party that had taken over the government through criminal means such as election fraud or more coercive methods such as a disinformation/propaganda campaign or a coup, the first thing you will do is to make sure that you have control of the money. Since cryptocurrencies are too transparent and undermine the absolute control of state-issued currency, these will be seen as a threat to the criminal government and will be the first thing to get banned.

We can quickly see that the world's worst criminals at the highest levels hate cryptocurrency, and prefer to use the existing paper-based technologies instead, that allow them to be more opaque and retain absolute power.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#569

Post by salawat » Sat, Jun 05, 2021, 2:49 AM UTC

oblio wrote: post #467

krisoft wrote: post #452

Earlier quoted context omitted.

> For example, software is still stuck in the dark ages where the idea is better training / better programmers / more punishment will prevent these sorts of failures. What is your source on this? This goes against what anyone at any company where I have worked at ever believed. No-fault root cause analysis, process improvements, inherently safer practices, languages, libraries is what every place aimed for. I don’t e…

There are many, many programmers, you can see their comments right here, that fit (for many, probably despite their age), into what you could call brogrammer/cowboy coder/lone star/rockstar developer types and that will try to shame developers making mistakes or present certain types of failures as inevitable, "you just need better developers". You can frequently see them come out in Rust threads, they're generally a…

Okay, that criticism is legit, but they also have a point, and more importantly, they have docs, tooling, and cross-compiling experience. When you're implementing the basic C machine, or kernel, or drivers on which every other tool chain ever conceived at some level relies on for new architectures and hardware, you are operating in the most constrained setting of just about any programmer today. It is different, and you have to think different because you're trying to make sure you're getting the foundation right.

When the docs exist, and are accurate they can somewhat hide behind "get better programmers"; when they aren'the some can be even moreso, because there is nothing worse than trying to drive poorly documented hardware. It either works or it doesn't.

T. QA guy amongst a bunch of dev types who regularly points out how they do a great job implementing the wrong thing on a regular basis, and helps shape process to make that harder.

The fact they come out in Rust threads has more to do with Rust's evangelist types running afoul of the long standing love of "things that work". Somewhat in the cowboy camp's defense, none of theach no guardrail's type ever turns down a good static analyzer or test suite once you figure out how to get it smoothly integrated into their process. That's where I think Rust gets their outreach wrong.

Don't try to sell development on a brand new lang to learn and replace what they are using. Use the lessons you learn with making that lang, and improve the tooling they are familiar with. We don't have an infinite capacity to learn a new lang and library ecosystem every 6 months to just keep doing what we do. Once you get savvy enough with C and where the spec holes are, you've gotten to a point where you've gotten insight into how things actually work many levels more accurately than just about any other programming toolchain, and also onenjoy of the only languages completely divested of licensing lock-in on the planet.

There is also the point that you can'take really argue against C's effectiveness. It's always the first code to be made functional on any new silicon. I'm interested to see if Rust supplant's it, but I'm weary of any language that's heavily reliant on LLVM as I'm getting more savvy on how licensing risk tends to play out in the long run.

You can't beat the immortality and ubiquity of GPL. It is as close to the unrevocable toolbox from the public domain you'll ever get.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#570

Post by salawat » Sat, Jun 05, 2021, 2:59 AM UTC

grawprog wrote: post #540

WalterBright wrote: post #532

Earlier quoted context omitted.

In my paper "The Origins of the D Programming Language" I enumerate many direct influences aircraft design has had on D. https://dl.acm.org/doi/abs/10.1145/3386323#:~:text=The%20D%2... . BTW, I practice dual path in my personal life. If I'm doing something risky, I have a backup. For example, when I work under my car, I put the car on two sets of jackstands, even though I use stands that are rated for trucks. I'd nev…

Thanks for sharing. I knew some of D's history, but there was stuff in there I hadn't read before. I like much of the way D's designed. It doesn't try to be flashy, gimicky or different for the sake of being different. It gives you a set of practical tools and doesn't try to be too opinionated on the way they should be used. It mostly makes it hard to shoot yourself in the foot. But if you really want to you can. You…

That's defense in depth as applied to system design. Think of it like cleaning out a cat box, and only having bags with holes. You only need a couple bags whose holes don't line up, and you're good to go.

The simpler they are, the easier they are to learn. The easier they are to learn, and less "opinionated", the less resistance they tend to build up against adoption.

D is interesting, because it seems, from my experience, D, like Ada, has been a hypeless language. Though I haven't checked on licensing encumber meets that might be behind that.