Comment by Top19 | Hacker News Reader

Comment by Top19 | Hacker News Reader

This is the choice quote:

> "This simply is not a company that deserves to be trusted with Americans' personal data," said Sen. Sherrod Brown, D-Ohio,

Obviously this quote leaves out a lot of nuance, but I like it and I like what Senator Brown has said in general. What Equifax has let happen is very bad, and I think moral judgments and perhaps even shame (which is how a society can enforce morality) should be brought onto its leaders individually.

I hate how businesses and business persons have been making horrible, destructive decisions for decades (not that humans in all fields weren’t beforehand) and have been escaping any kind of shame. Indeed they’ve been praised in many cases.

If you look at the top-level pages on Wikipedia (there are about 11 of them), one of them is for “Society”. About a third way down you’ll see “Business” listed under Society. I think this is a good reminder that business is a part of and functions for society, not the other way around.

https://en.wikipedia.org/wiki/Portal:Contents/Society_and_so...

Is it a moral failing to be slow to update a Struts vulnerability? As an IT engineer that makes be nervous because I don't know which of a hundred actions I take or don't take in a given day will explode on me. Or was the moral failing to agree to build such a system in the first place?

> to be slow to update a Struts vulnerability

If this Struts vulnerability can lead to the personal information of literally half of America? I'm not a lawyer, but that sounds pretty damn negligent to me.

I agree with your larger point that the system probably shouldn't be built in the first place, at least not the way it is now, but there are still plenty of things they could have done, like not store it in plaintext at rest.

My issue is not that they had the vulnerability, but that the vulberability allowed full access to social security numbers and it wasn’t even the “critical” database!

You can take proactive efforts to minimize the risk of breaches; they appeared to store large amounts of unencrypted (or encrypted in aggregate) personally identifiably information together and allowed a single struts vulnerability unfettered access.

For instance, one could not duplicate social security numbers, or could allow you to encrypt your data so you need to provide a key for others to access it. The possibilities are endless.

My design would be a ZeroMQ message bus between the database server and the application server. Social Security numbers shouldn't need to be displayed to the user (as they should already know it) thus all the message bus should be carrying is "it matches" or "it doesn't match" in regards to them.

> Is it a moral failing to be slow to update a Struts vulnerability?

Yes.

As a professional engineer you are responsible for the systems you build and maintain. The security of the modern internet depends on engineers on the ground understanding and proactively fixing security issues.

There is no one else who can take responsiblity for code you deploy to production. The buck stops with you.

Yeah, unless your management has other priorities and their management has other priorities. The buck actually stops at the CEO.

As a member of an unrelated professional body, the buck always stops with me on issues of ethical behaviour. I don't care how much the CEO wants me to do a thing that is good for the bottom line - if I want to keep letters after my name I have to behave in a way that is in line with the professional code of conduct I signed up to.

I'm not saying that such a model is the right one for devs, but it would certainly be an interesting move away from "not my fault - nobody would let me do it right".

CEOs would, of course, then have the choice to hire non-accredited engineers to work on their software, and then the buck does stop there because they made an active decision.

> I'm not saying that such a model is the right one for devs, but it would certainly be an interesting move away from "not my fault - nobody would let me do it right".

I would say I'm in a similar position, but that's because I'm more or less essential (no ego here, and can't explain obviously, but I am) and if I walk out, the company has a lot of BFPs to deal with.

Perhaps there should be some sort of guild? Some way that we could make it harder for ourselves to be replaced in such a way where we can actually stop bucks without just getting fired while they find some script kiddie to do what we wouldn't.

But ideally, "I was just following orders" should not be an excuse. Part of the reason we need proper professional accreditation is so that engineers can say "No, this is wrong.", and the CEO can't say "you're fired, I'm going to hire someone who will do what I say". We need to put loyalty to the profession ahead of loyalty to the business.

I'm not sure many IT Engineers are professionals (as in members of a professional body that they have to answer to, with training, licensing and code of ethics etc)?

https://en.wikipedia.org/wiki/Profession#Characteristics

That I think is the real problem? I mean how many of us on this thread alone are pushing around troves of consumer data today? Maybe just browsing habits or analytics or what have you but nevertheless, here we are, handling possibly terrabytes of data on people we don't know, who don't know us, and have no current way to hold us accountable if we do it wrong and they are subsequently affected.

I mean how many firms do we read about a DAY on here who are collecting by the truckload consumer data, either to be used or sold later? And how many of said firms are taking proper steps to anonymize or secure (or both) said data properly?

Bingo. That's why so much of HN doesn't want to be held to the same standards as actual Professional Engineers - all the shady shit Google and Facebook and their ilk do is enabled because of the lack of personal accountability among the mercenaries who enable the giant surveillance apparatus to exist by implementing it. Then they come here and hand-wring over why privacy is dead or why it's really not so bad what they're doing over there, honest. The cognitive dissonance is palpable.

Possibly a little more of a pessimistic view than I'd take personally, but I get what you're saying. Talking privacy and security is one thing, actually fighting for it in your own org is another.

I had an interesting debate a couple years back in another forum about this. The other person was saying that until people who build software are held personally responsible for our work the way other engineers are, we shouldn’t be calling ourselves engineers. I disagreed then but stuff like this makes me wonder.

If the data would be considered the customer's, it would have made sense to use application-level encryption [1]. Each user has a unique key which should be their property. If you need to give access to that data without the user's consent, you'll need to store their unique key for them. You'll better do that in a very secure manner.

If now somehow the database gets exposed, good luck! You'll also need to get the individual keys to decipher everything.

Then, although still you can be blamed for not using a vulnerability scanner, there is much less at stake.

[1] https://www.compose.com/articles/encrypting-sensitive-data-i...

The users whose data was exposed are not Equifax's customers. People who want credit reports on them are.

It was somewhere between that and:

* The executives selling stock before telling the public about the breach[1] — but "Equifax responded to TechCrunch’s questions about the timing of the transactions, particularly those of CFO John Gamble, with the following statement claiming that the executives in question were not aware of the hack which the company was made aware of on July 29"

* entering in phony name into the "Have I been breached?" site resulted in random answers; "Others have tweeted they received different answers after entering the same information."[2]

* Equifax hosted said "Have I been breached?" site, and services related to protecting oneself from the breach, on a domain that looked for all the world like a phishing site, and further, "What’s more, there is nothing tying the domain registration records for trustedidpremier.com to Equifax: The domain is registered to a WHOIS privacy service, which masks information about who really owns the domain (again, not exactly something you might expect from an identity monitoring site)." [4]

* Equifax wanted people to agree to a forced arbitration clause. [3]

* Equifax directed people to a fake phishing site [5]

…that it became a moral failing.

[1]: https://techcrunch.com/2017/09/07/equifax-managers-dumped-st...

[2]: https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri...

[3]: https://theintercept.com/2017/09/08/equifax-is-proving-why-f...

[4]: https://krebsonsecurity.com/2017/09/equifax-or-equiphish/

[5]: https://www.theverge.com/2017/9/20/16339612/equifax-tweet-wr...

The latter. It is a moral failing to build/market a product with failure modes that expose unconsenting victims to consequences they did not sign up for. And "we were just following orders" should not be a defense, either.

It seems dishonest to pretend struts was their only problem. That just happened to be the trick of the day. As others have mentioned, security is designed in layers. The fact that a single layer can fail and cause so much damage is simply bad design. Unfortunately there is a lot of bad design in IT. InfoSec may not be new, but I would argue up until about the last 15 years, it was really not considered outside of defense departments.

It's a moral failing to be engaged in the collection of personal data of this type and scale without having a solid, well articulated, well communicated, robust and redundant plan for managing security and mitigating the impact of security issues.

It's an ethical failure that this industry has so many examples of above.

I don't think this is a moral question.

Whether or not this information should be collected at all may be a moral question, but how it's secured is about technical competence.

I also think we should keep in mind that, even if it was well-secured, there could have still been a breach. Would that have been less bad? The result would be the same.

    Would that have been less bad?

Quite plausible yes, with better systems design.

The moral issue isn't one of technical competence, but rather of having the integrity to perform the appropriate due diligence required of a company handling such sensitive information.

No security professional is going to argue that you can or will prevent every vulnerability from being exploited. However, when you leave a critical vulnerability open for months on end, you knowingly and unnecessarily expose yourself, and any parties associated with you (by choice or otherwise), to a level of risk that is unacceptable.

If this were a 0-day exploit, then the conversation would be different. If their exec's hadn't sold off so much stock a such a suspect moment, then the conversation would be different. If the IT department had appropriately began remediating the vulnerability within a respectable timeframe but had already been exploited, then the conversation would be different.

To my view, collecting and storing that much information is presumptively immoral. It creates a public hazard, in the same vein as stockpiling explosives or toxic chemicals.

There is, however, a degree of respect for that hazard, demonstrated in concrete safety practices, that can override that presumption.

I don't think Equifax has demonstrated that respect. To a layman's view, not many companies do. It's possible that the amount of respect necessary for a hazard as large as the one Equifax created is too onerous for a for-profit entity to realistically implement, but I don't know that there's a fundamental reason that sufficiently paranoid engineering practices couldn't make this moral.

Failed to patch in a prompt manor. Waited to disclose the issue to the public. Set up a credit monitoring service that was insecure and would auto charge you (the auto charge was dropped after people were outraged). The CEO blamed the whole thing on one person (and that person was not him).

What part of that doesn't seem like a moral failure?

Then quit supporting these companies by working for them!

The elite have this country over a barrel, it sucks. All anyone that isn't rich can do is to choose to die before they will work for these companies.

We've got tons of young men and women that sign up to be in the armed forces who happily go die to enrich the already wealthy...and we celebrate them!

So as a society can we start shaming workers that work for Palanatir, Comcast, Pfizer, Equifax? You being on your death-bed and unable to afford food is not an excuse to make the world worse. Die with some fucking integrity.

I think Warren has something to say about accountability.

https://www.youtube.com/watch?v=vudP3ROnFYI

It's very difficult, if not impossible, for society or government to enforce moral judgments, shame, punishment, condemnation, etc on every individual / company that deserves it.

The amazing thing about our society is that in most cases, the incentives of individuals are such that even bad people engage in good behavior. You say that businesses and business persons have been making destructive decisions "for decades" but there's definitely a reporting bias there; an overwhelming majority of businesses quietly ship bacon, pack boxes, deliver fertilizer, fold laundry, etc without any moral/shame oversight from senators or society at large. In fact, many of these businesses are likely ran by sonofabitches, but they still engage in good behavior because their incentives are aligned with their consumers.

The problem with Equifax and other headline news behaviors (pollution, bank crashes, etc) is not 'bad people made terrible decisions' but 'bad people had no incentive to make right decisions' because, for example, the credit bureaus are simply not motivated to protect consumer data. Legal and financial incentives are both aligned against consumers, not for them.

It's a little unfair to pile on the CEO of Equifax or the company because that's just fighting yesterday's battle too late. What we should be doing is fixing the incentive structures such that future Equifaxes don't happen.

Also, as other commenters have pointed out, we don't want to discourage good people from running credit bureaus out of fear that innocent mistakes may get them hung.

> Also, as other commenters have pointed out, we don't want to discourage good people from running credit bureaus out of fear that innocent mistakes may get them hung.

I couldn't agree more with the rest of your comment, but I draw an almost opposite conclusion.

We should discourage people, good and otherwise, from running credit bureaus. Collecting and holding sensitive personal data on millions of people is inherently a mistake, and after the last few years of data breaches it's getting hard to argue that it's an innocent one.

Companies have proved time and again that they can't be trusted with huge datasets on the general public. They don't have much incentive to apply the level of paranoia necessary to actually protect data that valuable, and even when they do they rarely have the level of InfoSec skills and, more importantly, culture to actually pull it off. In practice we see 2 or 3 nines of reliability when we actually need about 5 nines.

We should stop waiting until leaks happen. Holding sensitive personal data on hundreds of millions of people ought to be congressional hearing level scandalous whether that data has leaked yet or not.

>It's a little unfair to pile on the CEO of Equifax or the company because that's just fighting yesterday's battle too late.

No it's not. He and the CSO are ultimately responsible. That is part of why they get high pay and golden parachutes. That is their job.

Their incentive to make the right decisions is being shown right now via investigations and congressional testimonies which may lead to other charges.

My point was not that they don't deserve condemnation, but that punishing them doesn't help correct the system to prevent the same problem from happening again.

I'll believe it when the Republicans get on board too.

FWIW, and perhaps the best evidence of the strange new universe we live in, Steve Bannon called Republican tax cuts on Charlie Rose “an economic hate crime against America” back in early September.

Trump & Co are definitely talking out both sides of their mouth.

Trump is pushing the GOP tax proposal which has massive tax cuts. Bannon appeases the GOP non-rich voting base with these platitudes.

Trump trusts Bannon (or Bannon would be out of a job), despite any Kardashians-like fake acrimony.

This is just like the pre-election micro-targeting - they are saying whatever message appeals to whoever they talk to.

> Bannon would be out of a job

Bannon _is_ out of his job at the White House.

Bannon works for Mercer (Breitbart), who is paying Trump's legal bills. Bannon changed positions, not teams.

http://www.newsweek.com/trump-legal-fund-paid-billionaire-ro...

That is HILLARIOUS coming from the government that spilled MILLIONS of classified background checks from the OMB offices a few years ago. Absolutely hilarious and ironic and hypocritical.

Also, the wife and I were one of the millions whose personal details were stolen from the OMB hack.

Sure but do you disagree with the point being made?

There are two points being conflated:

We should hold a high standard.

We should not hold a double standard.

I have to say I think there's something to what you are saying.

The Senators are beating up on this CEO for a security breach that happened under his watch -- suggesting he ought to be fired. For the OMB hack they were the ones with the power to fire the CEO of the organization responsible, i.e. the President. Did even a single one of them call for impeachment? Did any senators resign for thier lack of appropriate oversight?

They attack equifax for having bad security policies and procedures and dismiss the claim that one misfeasant employee is responsible. Well they are the organization largely in charge of writing and overseeing policies and procedures for the federal government. Did they attack themselves for doing a bad job after the OMB hack? Did they change any of those policies and procedures in response?

They are calling on equifax to fully compensate people whose information was released. What laws did they introduce and pass to fully compensate people whose information was lost by the organization they are in charge of?

Technically the identity of the speaker is of no moment, but it's a little hard to avoid rolling ones eyes in the face of such blatant hypocrisy.

> The Senators are beating up on this CEO for a security breach that happened under his watch -- suggesting he ought to be fired. For the OMB hack they were the ones with the power to fire the CEO of the organization responsible, i.e. the President. Did even a single one of them call for impeachment? Did any senators resign for thier lack of appropriate oversight?

Katherine Archuleta was in charge of the OMB during the time of the hack, lawmakers _did_ call for her to be fired, and she ultimately resigned due to the breach.

That's the equivalent of the head of HR, not the CEO of the whole company. No one called for Obama to be fired or resign.

I disagree with your analogy. Obama's job concerned way more things than the OPM. However, it was Katherine Archuleta's only job to lead that organization. When considering the OPM only, Archuleta was much more akin to the CEO than Obama was.

I think a more appropriate analogy would be that Obama was the "board of directors" of the OPM.

OPM isn't an complete organization. It doesn't have a mission that makes any sense independent of the rest of the federal government. It only makes sense as a department serving as part of larger organization. Like HR or IT in a particular company.

Equifax on the other hand is a complete organization. It has a bunch of different departments that all work together to accomplish the overall goal. Just like OPM, the State Department, and the Treasury all work together to accomplish the overall goal of governing the nation.

Therefore, the proper analogy for Equifax is the USG, not OPM, and the proper analogy for Equifax's CEO is Obama, not Archuleta. The group that is analogous to the Equifax Board of Directors is Congress.

I see your point with the OPM. Your analogy is logically consistent, but I still don't find it to be realistic.

Equifax fits into the relatively tidy box of credit reporting, identity theft protection, and maybe a few other services that I missed. The OPM fits into the relatively tidy box of investigating and managing security clearances, hiring Administrative Law Judges, and maybe a few other services that I missed. I can't even reasonably estimate the number of these services (to the same level of granularity) that the entire USG is responsible for.

Getting rid of the business structure analogy, really I just disagree with the sentiment that Obama should have been fired or pressured to resign over the OPM hack. I don't think there is much to be discussed there, so perhaps we should agree to disagree.

Reply on news.ycombinator.com