To get serious about cybersecurity governments need to start imposing hefty fines for failing security reviews, otherwise companies choose to maximise profit. This includes fining software vendors for 0-days, depending on their size and the severity of the 0-day. For example, a critical 0-day in a popular Microsoft/Google/Apple product should cost them e.g. $100 million. This will actually get them to allocate significant engineering time to preventing 0-days instead of working on the latest gimmicky features...
Cyber Security: A pre-war reality check
231–240 of 286 posts
Re: Cyber Security: A pre-war reality check
#232> I know it sounds devastating, but you have to get used to the fact that a new era has begun. The pre-war era. It is madness that we're in a position where this can be baldly stated by a PM and there has been no "huh?" moment when people stop and assess how badly the broader West's military, economic and diplomatic efforts have failed over the last 30 odd years. Possibly longer. I wasn't expecting to see land wars i…
What kind of diplomacy would have prevented Russia from invading its neighbours?
Can’t speak for Europe, but the US used the same ineffective playbook they’ve been using for decades. I believe more creativity and more “Is this working?” strategy assessment could have been effective.
As a few examples, what if Putin specifically was targeted with information warfare? Leak information on his health, finances, etc to his rivals. Fire up the meme factory to influence the military. Disrupt oil production via cyber attacks. Threaten to give Ukraine a couple nukes back.
The US doesn’t do aggressive (effective) things like that because “What if they do it to us?”
Re: Cyber Security: A pre-war reality check
#233Earlier quoted context omitted.
From https://clugproject.eu/en/presentation > A failsafe on-board multi-sensors localisation unit consisting of a navigation core (IMU, tachometer, etc.) brought in reference using GNSS, track map and a minimal number of reference points From https://www.clug2.eu/objectives/ > to complement the existing European Train Control System (ETCS) odometry system by using GNSS to enable absolute safe train positioning whilst…
Well. First, the goal is precisely to remove wayside balises and replace them with gnss for resetting of the absolute loc. You can parse the last section of this: https://www.ct5webapi.eu/api/documents/getfile?id=a5aa9e2b-e... Second, in a war-like scenario, do we really want to have our critical infrastructures unable to operate at full capacity?
I see a balise antenna even in the „long term“ architecture diagram and don’t have the time to parse ninety pages of technical documentation. Of course I wouldn’t be surprised if they went to reduce the number of balises, but I don’t think it’s possible to go completely without.
Re: Cyber Security: A pre-war reality check
#234Over a decade ago I wrote an article that included the prediction that the vulnerability of western infrastructure to cyber operations would prevent the US from intervening to support lesser allies. The rationale was the domestic costs of chaos caused by infrastructure attacks would cause hesitation to intervene in foreign wars, and this hesitation and vulnerability would embolden foreign antagonists like Russia and…
I think what is missing from this analysis is the offensive capability of American cyber.
The way it is completely downplayed I suspect is proportional to its strength.
If there was all this chatter how we need to invest more in offensive cyber I would be worried. The way we pretend like it doesn't even exist is all you need to know.
Re: Cyber Security: A pre-war reality check
#235Earlier quoted context omitted.
Part of this is that nobody has cared about security since the beginning, for basically anything in tech. It’s an industry-wide issue that permeates every level of the stack. And so yeah, individual companies trying to retrofit security onto a jenga tower of technology is going to have to spend a ridiculous amount of resources to have any kind of impact. I don’t know what the answer is, but I too believe things won’t…
> Part of this is that nobody has cared about security since the beginning, for basically anything in tech. > It’s an industry-wide issue that permeates every level of the stack. Can you explain? I don't understand. Here's my take. Let's start from the bottom of the stack. CPU has some good security protections. They have ways to ensure that boot code is signed. They have hardware protection for memory. They have mem…
>Let's move to OS. Well, there's lot of security stuff in any OS. Process isolation, namespace isolation, encrypted storage.
How can the user run some random application and not have it wipe out their OS? Can they plug in a random USB stick safely?
There's no real security in the OS part of the stack, but lots of security theater.
Re: Cyber Security: A pre-war reality check
#236Earlier quoted context omitted.
> they think God gave them the right to dominate half of the world, they will tell it to my face that genocide my nation is not personal, it is geo politics This part could well apply to Americans.
>This part could well apply to Americans. What about USA? But honestly I never chat with an american that would claim that half of the world belongs to them and they are not sorry for the future genocides that they will have to do to achieve it. Nice of you to confirm here for our HN community that what I said is true, Ruzz claim that God gave tehm half of the world to make a "sphere of influence" and that Moscowites…
> half of the world belongs to them
https://en.m.wikipedia.org/wiki/Monroe_Doctrine
Not strictly limited to the Western hemisphere. See also: Vietnam War
Re: Cyber Security: A pre-war reality check
#237Earlier quoted context omitted.
The USSR invasion of Romania? That's insane revisionism. Who, exactly, started the invasion? Like you realize the Romanians were literally guarding the front of the Germans at Stalingrad? Maybe Romania should've have invaded the Soviet Union with Germany?
Do you understand cause and effect, before Romania allied with Germany, guess who was allied with Germany ? Yes USSR, and guess what happened? Stalin and Hitler had a deal where Ruzzians were given parts of Romania. https://en.wikipedia.org/wiki/Soviet_occupation_of_Bessarabi... So here is the impressive Ruzzian logic, show me your mental skills explaining it USSR collaborates with Hitler and steals Romanian land, Th…
This has literally nothing to do with Putin what are you even talking about? You are justifying the Romanian invasion of the USSR and their collaboration with the nazi state. That's fine I guess, it just makes it hard to play the victim card. Again, this is about events that happened before Putin was even born. It's not Russian propaganda to say that Romanians were complicit until the very last moment when they decided to switch side in 1944.
You're also just saying stuff that doesn't even make sense. Can you give me a source about splitting up Romania, as in that Romania attacked the USSR because they wanted to split it up? Also, if you're saying that both the Nazis and the USSR wanted to take Romania, why did they ally themselves with the nazis? It's as if they were on the nazis side for more than that!
Also, remember that the USSR wasn't just Russia. The Romanians also killed thousands of Ukrainians while invading the USSR. When you invade a country, you get what you deserve when said country fights back. Like Russia is having now after attacking Ukraine. In your weird point of view, Russia would be the victim because they had no choice or whatever due to alliances, right? That's how you're justifying the fact that Romania attacked the USSR in 1941 lol
Re: Cyber Security: A pre-war reality check
#238Earlier quoted context omitted.
I was under the impression that GPS was a non-critical asset for aviation, ie. any plane can safely stop using it at any given time and keep flying with VOR and other navigational aids. This article [1] introduces some of the scenarios where pilots rely on GPS only: * GPS-based waypoints to optimize routing based on favorable winds and more direct routes even in the absence of VORs. * RNAV departures and arrivals tha…
I would assume its not 'safety critical' but 'business critical', disabling GPS would mean slowing down departures / arrivals which means the airport losing money. I recall there being a similar issue with Lufthansa and SFO causing planes to get rerouted to oakland.
There's a meme driver with safety vs business critical and software types seem to think they're special (a different meme) but I'm starting to understand it's everywhere, which is why nobody notices the software issue creeping into their physical systems thinking.
A "business critical" issue is defined by the appetite for risk. Most businesses aren't planning for total economic collapse: losing their accounts receivable is what that would look like. What they are concerned about is losing business to competitors or liability for not fulfilling contracts. Software seems to solve the latter problem with shrinkwrap agreements "not responsible for failure of software". That solves their liability problem; everybody else they'll sue.
On the other hand "safety critical" concerns the loss of life or property: the things insurers are traditionally concerned with. So if the plane can land, engine out or GPS out what's the difference? Businesses absolutely care about safety, that's why they buy insurance! Safety programs reduce the need and cost for such insurance.
Businesses aren't lying when they say they care about safety. However people swim in the ocean of systems without necessarily being systems thinkers: plugging a leak is plugging a leak. But a leaky roof is not the same as a leaky hull. All the people in cybersecurity warning of the dire consequences of breaches are proven wrong time and again by the market: look at the stock prices of Equifax, Solarwinds, United Health Care. It's not simply marketing, a lot of these people really Want To Believe (tm).
In the end business is never safe, it's taking risks all the time. Mostly it doesn't see a need to share those risks with customers (or competitors).
Re: Cyber Security: A pre-war reality check
#239Earlier quoted context omitted.
China makes consumer crap not our guns and bombs. In a wartime situation maybe people can’t get iphone cases from temu, big whoop. Not the first time the american population rationed consumer products in wartime. We will still have power and air, sea, and space superiority which is what really matters.
This is really out of date thinking, even South Korea is better at making ships than America now. In wartime China would switch from gadgets to bombs and drones and out produce us by an order of magnitude. They already produce 3x more vehicles than America; It’s 2024, not 1956. Review the article called “The return of industrial warfare”. https://www.rusi.org/explore-our-research/publications/comme...
Look at american shipbuilding in 1938 and compare it to 1944 and understand looking at peacetime warmaking capacity makes zero sense.
Re: Cyber Security: A pre-war reality check
#240Earlier quoted context omitted.
China makes consumer crap not our guns and bombs. In a wartime situation maybe people can’t get iphone cases from temu, big whoop. Not the first time the american population rationed consumer products in wartime. We will still have power and air, sea, and space superiority which is what really matters.
Everyone has outsourced all their cheap and low-quality manufacturing to China, therefore China is only capable of manufacturing cheap, low quality items. Is this your argument?
My argument is we have not outsourced bombs and sensitive military technology building to china. It is mostly the stuff we can stand to tighten belt on. Even if there is some demand for things like chinese medicine or whatever, its a market effect and not because only china is capable of making this medicine like how only US defense industry can make some of its secretive military tooling.