Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker wipes Romania's land registry database

news.risky.biz

Post reply on HN
Print view View original

211–220 of 440 posts

Re: Hacker wipes Romania's land registry database

#211

Post by b112 »

sib wrote: post #119
b112 wrote: post #107

Earlier quoted context omitted.

The sad part is, the whole world worked perfectly fine without anything online, ever, prior to 20 years ago. Even 10 years ago for slow-moving change. It's literally not a requirement to have it all online. And the cost of developers, plus coding + security updates + platform costs, really just means you replace a few assistants which would process requests by hand, with all that. Except? It's a lot harder to hack a…

There are many examples of important paper records (property, birth/death, etc) being lost in fires or floods, so it's not the case that "everything worked perfectly fine" in those days either.

All those examples are not different from not having backups of digital data too. Making copies when you microfiche, having duplicate stores, it's all exceptionally easy and a solved problem.

And of course everything didn't work perfectly, it did however work "perfectly fine", which means "very well" or "good enough". Meanwhile, adding in network connectivity to anything vital these days is just insanely dumb.

No software is secure, and will never ever be secure. Ever. Anyone who thinks that software can be made secure, is 100% wrong, period. My point is that the advantages aren't worth the disadvantages.

Re: Hacker wipes Romania's land registry database

#212

Post by margalabargala »

c7b wrote: post #124
margalabargala wrote: post #112

Earlier quoted context omitted.

You can have decentralization without blockchain. A defining feature of blockchain is that each node depends on the precise ordering of prior nodes which is a huge liability if you have network disruptions, etc, in a bureaucracy. A git repo with cryptographically signed commits solves all the same problems without the headache.

Agreed that you don't need total ordering and hence consensus for pure asset transfers. But if you want to make any changes at all, like updating the list of nodes, you do. So in practice, you do need it. Every other proposal will fall short in a critical and avoidable way. Amending your git proposal with the necessary parts will turn it into a blockchain.

Disagree. We're talking real estate here. The time between transactions is months to years, not seconds to minutes. A git history will work fine. If there are racing transactions against the same piece of real estate, that's probably fraud, not something that should be automatically resolved.

Re: Hacker wipes Romania's land registry database

#213

Post by UltraSane »

iAMkenough wrote: post #132
UltraSane wrote: post #98

Enterprise storage arrays have immutable snapshot functionality that makes ransomware easy to recover from.

What does it take to delete a snapshot?

local admin credentials or two factor or the BEST is a immutable time-lock, so a snapshot cannot be deleted before the retention period that was set when it was taken expires

Re: Hacker wipes Romania's land registry database

#214

Post by b112 »

marginalx wrote: post #113
b112 wrote: post #107

Earlier quoted context omitted.

The sad part is, the whole world worked perfectly fine without anything online, ever, prior to 20 years ago. Even 10 years ago for slow-moving change. It's literally not a requirement to have it all online. And the cost of developers, plus coding + security updates + platform costs, really just means you replace a few assistants which would process requests by hand, with all that. Except? It's a lot harder to hack a…

Everything comes with a risk, and people usually take it with a decent understanding of how to mitigate it mostly. If we start thinking along the lines of technology has risk and we shouldn't use it, we should go back all the way to the discovery of fire as we all know fire can cause a lot of damage if in the wrong hands.

Technology can make lives safer. However, software is never secure, cannot be made secure, this is empirically proven to be a 100% valid position.

In as software is not secure, and can not be made secure, using it for important records storage makes zero sense, unless you a) have full backups offline in physical, non-digital, read only medium or b) just don't do it online, at all.

And my point is, it's not worth the convenience.

Re: Hacker wipes Romania's land registry database

#215

Post by AdrianB1 »

alexpotato wrote: post #37

Romanian friends have told me that this is really due to corruption. Specifically: - government gives IT/data contracts to cronies - cronies don't actually do any real security work to protect the data - things like this happen

It is not corruption. Or not just corruption.

A close relative, government employee, was in charge of building a new application. They have nobody in that entire organization of several thousands people that know how to write specifications for an IT application, nobody that knows how to design, test and deploy it. This is because some government employees have decent salaries, but in IT the private sector is paying a lot more, so almost anyone remotely competent is going to the private sector. So in this case an organization of non-IT people had to deal with the contract and all the associated problems - there is no need to guess, it did not go well. That kind of project could have been done properly with ~ 10% of the budget in the same timeline.

I have a friend that worked as a developer in such a government IT project. The project cost was ~ 5-10 times what was worth, a chain of sub-contractors did the work, less than ten competent people doing the project, charged by the bid winner for over 100 people and actual staff was around 70 at most, for a short period of time.

Both projects above are in Romania. Lack of competent people in the projects, especially in decision roles, was the main problem.

Re: Hacker wipes Romania's land registry database

#216

Post by iso1631 »

amarant wrote: post #191
kefabean wrote: post #183

Earlier quoted context omitted.

I always wonder how things would be reconciled if something similar happened to a bank. What would be the simplest way to ‘download’ one’s balance whilst proving that the downloaded files were signed by the bank?

I'm good with starting from 0 if the bank is (my mortgage is a lot bigger than my balance)

Sods law would be the only bank not affected would be those I owe money to

Re: Hacker wipes Romania's land registry database

#217

Post by c7b »

codedokode wrote: post #125
mschuster91 wrote: post #99

Earlier quoted context omitted.

> It is a poor idea to use blockchain for government registries. If you want transparency, simply publish signed daily updates and that's enough. A blockchain is essentially that, just with the daily update that's being signed also including the signature and hash of the previous day. Blockchain as a technology is actually useful here. It does not mean automatically that blocks have to be mined by third parties, alth…

Blockchain is unnecessary complicated, for example, it has mining, rewards for those who add new records, even VM and scripts and all of these are not needed for a government registry. I do not need scripts within a land registry.

Clearly, you would scope the features and choose implementation options so that it makes sense for the use case. Mining (ie PoW and/or Nakamoto consensus) is clearly inferior to any deterministic consensus here. A cryptocurrency isn't necessary and would be a distraction. But at least some limited programmability could make sense (eg for escrow).

Re: Hacker wipes Romania's land registry database

#218

Post by iso1631 »

ExoticPearTree wrote: post #150
skinfaxi wrote: post #5

> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania. So it seems not all has been lost. I was worried about the societal implications of being unable…

> I was worried about the societal implications of being unable to prove land ownership but it seems that may be avoided. You know, it's not like people would come and steal your land overnight because you can't provide proof of ownership.

https://www.bbc.co.uk/news/articles/ckg15ev0347o

Re: Hacker wipes Romania's land registry database

#219

Post by AdrianB1 »

sebow wrote: post #184

[Fairly off-topic and political] There's a growing (retarded) perspective, not only here in Romania but in most of the EU, that we must digitalize at all costs; this itself is obviously not a problem, but it usually comes with the removal of the "traditional" options too. The same goes for payments (removal of cash) and basically every aspect of the administration/society where this could be applied. The most recent…

I don't think that most competent IT people are pushing for digital-only systems. The people that I see pushing for digitalization are either clueless politicians or corrupt or incompetent IT people selling snake oil. The sad part is that the snake oil sellers are probably a majority already, so fighting against politicians and snake oil sellers is a tought one.

Re: Hacker wipes Romania's land registry database

#220

Post by ajb »

nutjob2 wrote: post #185
ajb wrote: post #171

The UK used to have a distributed system - everyone had to have a solicitor store "deeds" of their property, which were a sort of paper blockchain of all the transactions the land had been in since - I don't know, since records began I guess. Since we got a centralised land registry cheaper solicitors have binned these, but some properties still have them as a historical record.

Not sure what you mean by 'binned'. In some Common Law jurisdictions the deed document represents the property and whoever psychically holds of the deed controls the property. Any centralized recording system merely records the last known status of the deed and additional information such as the nominal owner, mortgage holders, etc.

In the UK, the old common law rule does not apply to land that has been registered centrally, that is then the legal definition of who owns the property. However there are still properties that are not registered and for those, the rule you describe is still applicable; the holder of the deeds is the owner.

Registration is now compulsory on sales, but that only came in in 1990.

As to what I mean by binned, I mean literally binned, thrown away.

Post reply on HN