261–270 of 318 posts
Earlier quoted context omitted.
EVE Online had to put their foot down when people were talking about what could easily be considered terrorism.
Please tell us more, I need to hear the story!
You might be taking a game a bit too seriously if the FBI show up to have a chat.
Earlier quoted context omitted.
Through personal responsibility? That is not scalable; look at how many compromised devices there are. We need a better solution as an industry.
Yep. Manufacturers / distributors should be held responsible. Aligning the incentives is half the battle.
> by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries, Presumably it’s possible to log the residential IP of the source of these packets. Why isn’t there any industry group pushing for the ISPs to a) send the owners an email telling them or b) blocking off all traffic for a period to get them to do something - or is the economic cost higher than caus…
Earlier quoted context omitted.
Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update. The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected. This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://open…
This exchange is somewhat hilarious. Oh how on earth do we keep things safe and secure if everyone can see the code and verify what it does! Who would keep us safe if we turn our backs to unverifiable, unvetted, unprofitable security fixes, by for-profit companies!
Earlier quoted context omitted.
Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update. The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected. This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://open…
> You can manually and independently check the image signature before flashing an update. Of course you can. You can also read the ToS before clicking accept, but who does that?
> by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries, Presumably it’s possible to log the residential IP of the source of these packets. Why isn’t there any industry group pushing for the ISPs to a) send the owners an email telling them or b) blocking off all traffic for a period to get them to do something - or is the economic cost higher than caus…
> by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries, Presumably it’s possible to log the residential IP of the source of these packets. Why isn’t there any industry group pushing for the ISPs to a) send the owners an email telling them or b) blocking off all traffic for a period to get them to do something - or is the economic cost higher than caus…
Because then the ISPs have to provide support on how to secure those devices.
Earlier quoted context omitted.
Isn't the idea behind botnets that no one is paying for the bandwidth, besides the unsuspecting random people who have fallen victim to malware? I'd imagine the pricing is quite disconnected from the price of "legitimate" bandwidth. But I don't know in what direction.
The idea is, the botnets are in control of someone else. Who "owns" them. And some of those will rent "their property" for money, like they would legitimately own them.
Earlier quoted context omitted.
The idea is, the botnets are in control of someone else. Who "owns" them. And some of those will rent "their property" for money, like they would legitimately own them.
Ok, but that doesn’t change the fact that the price of renting them is completely disconnected from the price of bandwidth.
And a little bit of malicious bandwidth is easy to hide, a lot not. So there is a price to bandwith to the criminal owner.