Hacker News Reader

Comment by kibwen | Hacker News Reader

> But I guarantee you that most people reading this work at companies that are similarly vulnerable.

We hold Equifax to a higher standard because of the nature of the data that it collects.

> Everybody is insecure everywhere always

Some of us think that's neither necessary nor inevitable.

> If we can't get it right, why do you want the execs' heads to roll? Are you sure you won't be next on the chopping block?

In some professions, including many engineering ones, gross negligence is punished with the removal of one's ability to practice professionally. It's imaginable that if there were consequences for one's actions, things wouldn't be "insecure everywhere always".

Really, how am I still finding people taking time out to defend the incredible ineptitude of a privacy-oblivious company in a hated industry?

View on HN

More importantly I hold them criminally liable for their actions or lack thereof after the incident. There should be no retirement here. The CEO should already be in jail pending bail and should be found guilty and sent away for a long time. If found not guilty, we must amend laws to make sure the CEO goes to prison for a long time next time this happens. Nothing else will work. Fines will not work. Congressional hearings will not work. After all, we all read about how many phone calls the DNC and the RNC require our representatives and senators to make and how much money they must raise.

Prison for CEO and the board should be the least we need to do.

I strongly dislike the credit agencies as much as the next person but I have to ask: Guilty of what?

Just because something you don't like happened doesn't mean someone goes to jail. This is the hard but important idea you have to learn in a civilized nation. Bad stuff happens, and you don't just get revenge on whoever is nearby. This was a crime entirely perpetrated by another party. You don't get to transfer their guilt onto someone who may have been reasonably diligent.

Now the issue on aggregating the data in the first place is another conversation.

> Guilty of what?

In US we have a lot of what's called regulatory crimes. For example, https://www.law.cornell.edu/uscode/text/42/1320d%E2%80%936

Similar laws can be created to deter people from violating privacy of financial information. We can call what's happened a negligent disclosure financial information.

GP mentioned that

> This was a crime entirely perpetrated by another party.

I think I didn't make myself clear. I, personally, do not think the people who actually exploited the vulnerability should be the main target of any law enforcement investigation.

What I want to build are strong incentives to ensure that vulnerable data is as secure as possible. Unless the pressure goes to the top, this will not happen. This means that it is not enough to find a scapegoat in mid-management who might not have much of a say in how things run.

I don't even hate credit rating agencies. If the CEO and the board go to prison (or a slightly less desirable outcome if they don't and we get strong regulations to make sure people do in any such future incidents) will make the rating agencies stronger. They will be able to go to investors and say look, we have to do things this way and it won't hurt your bottom line because everyone else has to follow the same regulation as well! It is just the cost of doing business. If they disagree, they are more than welcome to go to prison themselves for anything that happens.

You are victim blaming and should take a hard look at your thinking.

The point is, you can hold them to whatever standard you want to. We collectively have not figured out any techniques to achieve the goal: to be impervious, always. And that's what you demand (or "require," as patio is fond of saying).

You can disagree with that, but you'd be hard-pressed to justify that position. Six decades of computing history would contradict you. And as someone who saw the landscape of real-world codebases and deployments at nearly a hundred companies, there is almost always a way in. People are smug thinking their code is great till you show them an SQL injection that works, or pop up an alert(1) on their favorite front end framework.

The moment the world freaks out about this lack of security, we've all lost. Imagine a dystopian future where the only way to write consequential software is to have it approved by three committees. You might think that's how it already is, but we can move way farther in that direction. Just look at how hard it is to run a simple medical study.

Nobody is asking for perfect security.

We just expect a company that stores the highly personal information of hundreds of millions of people to have better security than that of a random blog site maintained by one guy in his basement.

Well, you are asking for perfect security. Everyone here is. That's what it means not to ever be breached. I think that's the uncomfortable truth we've obscured. We are asking for the impossible.

If you don't feel that way, I propose asking some of your pentester friends how they feel about the breach. Somewhere between unsurprised and shrug, probably.

It doesn't change a thing that this situation demands higher security. We're fighting against forces of nature. Except instead of extinguishing forest fires, we're asking for the equivalent of no forest fires, ever, and arguing vehemently that modern technology is so good that forest fires should not have been allowed to happen.

> Well, you are asking for perfect security.

No need to read the rest of your comment. I'm not biting.

Here they left the door wide open. Google does not leave the door wide open. Google does not have perfect security. But we expect them to make the cost to an attacker high enough that it requires massive investment for a successful breach. Why should we expect less for a company that keeps 140+ million customer records?

They can be held to a much higher standard than this - a system that can leak all the sensitive data due to an error in the web app. You are describing an amateur architecture where there is a web app directly communicating with a database of sensitive information, and that web app has full access to the database. No experienced developer would do that.

And what would they do?

Everyone either goes silent or describes an idealized architecture that has glaringly obvious flaws in regards to meeting business goals.

I think maybe the top ten companies in our industry do this at scale well enough to work. Maybe.

1) keep an asset register up to date. This would include libraries used.

2) subscribe to a service that alerts on vulnerabilities in the assets listed in 1). Run Nessus scans. License cost you a bit over $1k a year.

3) invest in a resource to maintain the register and respond to alerts. Tie them into a governance model so management are aware of risks and can divert time and money when needed to mitigate

Security is a process not a technology. Nothing I've mentioned here is sexy or advanced.

> We collectively have not figured out any techniques to achieve the goal: to be impervious, always.

What? It takes vigilance, training, competence, and a culture of security. Oh, and lots and lots of money backing it up. If your company isn't willing to make that commitment, then your company shouldn't legally be allowed to handle any sensitive data at all. The legal consequences of a leak will be moderated if it is proven, by fellow professionals, that a company took every standard precaution necessary based upon the sensitivity of the data in question. Nobody (except for perhaps yourself) seems to be claiming that Equifax's technical chops were anything but inept.

> Six decades of computing history would contradict you.

Feel free to actually cite anything at all supporting your position, rather than glibly appealing to inevitability.

> The moment the world freaks out about this lack of security, we've all lost.

As if we haven't already lost? The Equifiax leak is a privacy disaster of the highest order.

> Imagine a dystopian future where the only way to write consequential software is to have it approved by three committees.

I welcome this dystopia with open arms, if it means it can save us from defeatists who have given up on the idea that software doesn't have to be completely terrible.

I have personally breached companies that fit this description. That was my job, and it's why I was hopefully the last person to breach that particular facet of their landscape.

But pentests can't catch everything. That's the dirty secret that is also somehow not a secret. The very next commit could make that pentest obsolete. Ditto for spinning up a server.

As if we haven't already lost? The Equifiax leak is a privacy disaster of the highest order.

Well, what do you think will happen from this? That may be true, yet the world will go on. We've been trained to accept the current system as inevitable, but SSNs aren't a security mechanism. The underlying absurdity is that we view leaking them as a disaster rather than recognizing and replacing the fact that we all rely on their secrecy.

If someone wants to impersonate your identity, they can usually find a way. This breach will certainly make that easier, but I'm not sure it will affect the actual fraud rate. Time will tell.

(I'm aware far more than SSNs were leaked. The point is that it was a bad idea to have this central point of failure in the first place. If it wasn't Equifax, it would've been someone else.)

> The very next commit could make that pentest obsolete. Ditto for spinning up a server.

This is addressed by "vigilance". And no, we still aren't asking for perfect security. Even on human-scale timeframes, the odds of a single exploitable vulnerability being introduced in any aspect of the software, for even a moment, are 100%. But if it takes only a single vulnerability to completely exfiltrate the whole of a company's sensitive data, then you're going to be hard-pressed to find anyone calling that a securely-designed system. I'm sincerely sorry that a career spent in the trenches has left you so jaded and cynical, but we can do better, and hopefully we as an industry do so before the government looks at our inability to self-regulate and imposes double-secret-hyper-SOX on all of us.

Reply on news.ycombinator.com