Hacker News Reader

Comment by moltensodium | Hacker News Reader

There is no reason to spend one dime on infosec after the big Equifax breach and the numerous Facebook hacks/intentional spreading of data. They already lost all the most important data for every American and both companies are doing far better than ever. Nobody went to jail, everyone gets to keep making money.

You should worry about lightning strikes and like solar flares disrupting your business before you worry about cyber security. Why should any enterprise risk manager waste their time on an issue that has no consequences?

View on HN

Part of this problem is that Congress has simply stopped functioning for the past ten years or so. They're pretty much just keeping the lights on while social conservatives refuse to compromise with anyone else. When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents?

The Consumer Financial Protection Bureau just barely makes the mark. Of course, Trump started gutting it almost immediately after joining office.

That is hilariously backwards. "Social Conservatives" have done plenty to try an protect or aid constituents, but it's held up by the Grand Old Party in the Senate.

Social conservatives usually mean GOP when referring to American politics

> When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents?

July 1st, 2019

H.R. 3151

"Taxpayer First Act

This bill revises provisions relating to the Internal Revenue Service (IRS), its customer service, enforcement procedures, cybersecurity and identity protection, management of information technology, and use of electronic systems."

https://www.congress.gov/bill/116th-congress/house-bill/3151...

Just because actual legislation is too boring for cable news and NPR doesn't mean it's not happening.

You can find all the bills that passed into law here: https://www.congress.gov/advanced-search/legislation?congres...

PS: Believe the 9/11 first responders bill would be more recent, but I figured people would take issue with that as a celebrity bill.

What makes you say this bill is doing more than call for a minimalist response to tax return fraud (giving people “identity protection ID number” to use with ID theft cases and a single phone number to call about tax related identity theft) and make updates correcting obvious flaws in the tax code (aka keeping the lights on)? The provisions in this law will not make it less likely that someone will file a tax return with your stolen info, and not make it easier to get it made right if that does happen.

At least the 9/11 first responders bill was about allocating resources to do something, but the main reason it doesn’t serve your point is the fact it stood for 18 years as an example of our government’s incompetence and inability to do basic, non controversial things.

I could quote from the bill, but the individual subsections all make material changes in the way the IRS runs.

Reducing everything to "creates a new department or abolishes an existing one" or "does nothing and just keeps the lights on" isn't a useful rubric.

Good law is acreted over time, in the same way bulletproof code is.

You are asking me to trust that the people making law now know what they are doing and are slowly moving things in the right direction instead of slowly in the wrong direction, while not contesting the claim that this law does nothing to accomplish its stated goal of reducing the public burden of tax return fraud.

US tax law has been dysfunctional and getting worse for decades, to me that says there are issues with how the system is designed and meaningful progress beyond “keeping the lights on” will require restructuring the law and the agency, not adding a new office here and giving taxpayers more notifications there. Those types of measures, as you correctly point out, have to be looked at as part of a larger plan for the organization that meaningfully addresses a problem, not in isolation. Except here we have a collection of measures that doesn’t coherently address a problem, so there is no way left to look at them except in isolation.

I was pointing out passed law that I consider answers "When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents?"

The law has many stated goals, as set forth in the quote I posted.

Compromise implies both sides have something to give. One side doesn't have anything the other side wants, so there can be no compromise.

Let's take freedom of speech. One side believes it's unlimited, and the other doesn't. How do you compromise on that? You can't. How do you solve that problem? You don't, it's not the government's job to solve all of society's problems. That's the point most people don't understand: quit trying to control the behavior of others.

They're pretty much just keeping the lights on while social conservatives refuse to compromise with anyone else.

Why is your assumption that the social conservatives are the ones that have to compromise? Shouldn't both sides be compromising?

The constituents of social conservatives favor this approach to governing. Those constituents don't want to punish corporations using the law because they view government regulations as bad for the economy.

Is it the same for small and medium sized company though? We spend quite a lot on infosec with the premise that a breach could put us out of business since we can't afford to tarnish our reputation and loose key clients.

Though I kind of agree that with Equifax and Facebook there weren't much consequences, to me they fall into the (unfortunately) too big to fail category, ie. most of Facebook members don't care and banks still need the credit score and there aren't much competition in that sector.

My post is obviously sardonic to some extent, there are lots of situations where you need to worry about security.

I think I'm just more angry about these "too big to fail" companies that are apparently immune from any oversight or consequence today. We should really just convert the FTC building into a homeless shelter and fire all employees, they have done absolutely nothing for decades so this would be great way to actually use the space effectively.

Did nothing? Oh no, don't forget the great service to the nation represented by the recently approved T and Sprint merger!

Depends on the market. Do your clients talk to each other?

In a small market with few potential customers, reputation loss could kill you. OTOH if you sell to general population, then even a scandal involving you being featured on national TV won't hurt your company directly (related lawsuits might, though).

> they fall into the (unfortunately) too big to fail category

They're absolutely not too big to fail. Equifax or FB? Other than the unfortunate employees and their families, does anyone give a shit? No. No one suffers. To the contrary, thinning sick herd members helpfully invigorates the health of the surviving individuals.

What these organization are are in too many pockets to be too big to jail. It's a trope but it's a fact, Jack

Edits for herd reference and reduced snark

The failure of Facebook might well be stimulative to employment and the economy. Imagine the wave of startups and new initiatives from other companies trying to compete in all the areas Facebook's in now. And unlike banks no significant part of the broader economy is at risk if facebook.com and instagram.com start 404ing forever tomorrow. A hiccup in the "influencer" economy, such as it is, which is negligible anyway, and they'll all have new homes one place or another (or several) inside a week and be building their followings back up.

And yeah, ditto Equifax. There are two other credit agencies already. They're all same-ish as far as I can tell. Pretty sure there are only three so they can pretend there's competition, not for any actual purpose. Again, it might be an opening for a new competitor anyway, while causing minimal short-term harm.

That just sounds like breaking windows to ensure more work for glassmakers to me. You're also ignoring the value Facebook ads provide to every business who advertises on that platform.

The shattering noise is the sound of self breaking windows.

The consequence is I won't use them and as much as possible others won't either. It's not the same as no consequence, but I get what you mean. The government plays so nicely with business that we shouldn't expect even a day's worth of business profits in related fines.

I wish I had the option of not using Equifax (or Experian, or Transunion, or the secret telecom one), but apparently there is no way to opt out of all your most personal data being the product they sell in these private systems.

LexisNexis? there are a bunch of opaque databases that can contain your info

> The consequence is I won't use them...

Yeah, i fully agree...But, what about orgs like equifax where you and I are not really given a choice about their role in our lives? Even before all the shenanigans around equifax, would i have willingly allowed equifax into my life? Heck no! So, while i 100% agree that we should vote with our wallets/purses, sometimes that isn't enough...and that makes me a sad panda. </sigh>

I am pretty sure the vast majority of people don't even know about these breaches, and even if they do it's news that passes them by quickly. Maybe a rant or two on Facebook and then onto the next thing. Almost everyone will continue to use their Capital One credit card and the company will barely see a blip in their revenue.

When the news is mainly about people dying, someone selling stolen rolodexes sounds insignificant in comparison

It does to me.

100m people losing a minute of their life to handling this (lets call it nanodeath) is 190 continuous years of wasted time that you could have spent with your family, napping, reading or other pleasurable life things.

That’s the kind of math that, say, an insurer, should do to determine whether an intervention should be paid for.

But usually you just get called a monster for doing that kind of math.

I agree that we've been given clear signals that losing consumer data won't result in any negative repercussions for your business from government. Unfortunately none of us are customers of equifax - the companies we share our data with are. And those companies don't care, and include every bank.

For Capital One, or other companies with which we directly do business, I think there's likely to be more direct ramifications - namely people refusing to do business with them. Letting anyone access your customers' data is a good way to lose those customers.

Wells Fargo did much worse with actually defrauding their customers, ruining some lives, and only got a slap on the wrist.

I, unfortunately, am forced to do business with Wells Fargo. I recently purchased a house using a different lender and they sold my mortgage to Wells Fargo. Nothing I can do about it. I now have to have a Wells Fargo account to pay my mortgage and am just dreading the day when they start adding features to it that I didn't sign up for. About a month after learning they'd be taking over our mortgage, they got slapped on the wrist for some sort of mortgage-related fraud. It's really infuriating. At some point I may refinance just to get it moved to a different bank, but it wouldn't make financial sense to do it just yet.

I 'm considering putting up a disclaimer before signing up to my sites: "Hey there, this is the internet. Even if we 're not bad people, any data you give us may be hacked and sold , publicized etc. So don't do the dumb thing and tell us your best kept secret."

Reply on news.ycombinator.com