Hacker News Reader

Comment by p_h | Hacker News Reader

It's depressing that this is so out in the open, and it seems like there's nothing America can do to defend itself.

> "it seems like there's nothing America can do to defend itself."

We could consider a legal requirement to disclose security breaches. If every firm that failed its customers had to admit it to the market, I would think financial pressure would move us toward more effective security fairly quickly.

States have already been passing such laws for security breaches that contain personal identifiable information since 2002:

http://en.wikipedia.org/wiki/Security_breach_notification_la...

It has to be considered that effective security has significant costs financially and non-financially. (An example of a non-financial cost is a overly difficult registration process for a web application that requires long, complex passwords with multiple security questions and answers.)

I was thinking more about the systems for major banks, defense contractors, industry suppliers, etc.

And effective security wasn't meant to imply the best thing you can think of. It would be a huge step forward if more people simply did the things we all know we should be doing: e.g. policies of accounts not having more access than necessary, network security not 100% focused on the firewall, etc.

It would be a huge step forward if more people simply did the things we all know we should be doing...

That's what I mean by "effective security".

Although security breaches at banks should fall under such laws (especially since they have personal identifiable information), I do not believe defense contractors, energy concerns, industrial suppliers, etc, should even acknowledge such breaches simply because of national security.

> "That's what I mean by "effective security"."

That stuff doesn't cost all that much more. It's non-trivial, sure. But it's not going to make a huge impact on the bottom line. A demand for it would end up costing enterprise software suppliers quite a bit in one-time costs to clean up their code-bases and standard install practices.

> "I do not believe defense contractors, energy concerns, industrial suppliers, etc, should even acknowledge such breaches simply because of national security."

Perhaps not to the general public, but certainly they should be required to disclose to their clients.

Seems like good news to me: amateurs! I haven't seen a video of US government hackers in action.

You don't think we hack them? We're far more proficient than they are, the only difference is that Chinese systems are more difficult for your average script kiddie to hack due to the language barrier.

We're far more proficient than they are

I wouldn't be sure of that. Check out the country distribution of Google's Code Jam participants: http://www.go-hero.net/jam/11/regions

And more importantly, the distribution in subsequent rounds. Especially the Polish and Russians are beast, but China is up there too.

(Ex-)communist countries are on top. I don't mean to imply anything with that, because I have no clue, just sayin'.

Interestingly India has so many people in qualifiers but none in the finals, now I don't know what that says about India!

Because the ability to code algorithms quickly is the same as the ability to break into systems.

The same type of mind is likely to be good at both, yes. [I would expect]

Seems to me like it correlates with economy more than anything else. The best American (and to a lesser extent western european) programmers are making six figure salaries working on world class products and/or getting funding for their own startups. The best Russian and Chinese programmers are doing ... Google Code Jam.

The logical counter-response would be to encourage the sort of unrest present in the "Jasmine Revolution". This would present China with the same sort of dilemma...they might suspect (or even know) that we were stirring up trouble, but would probably be reluctant to go to war over it.

> The logical counter-response would be to encourage the sort of unrest present in the "Jasmine Revolution".

The US has a lousy history wrt helping such folk. We tend to abandon them.

We did it in both Iraq (during Saddam) and Iran (a couple of years ago).

Who said anything about helping them? I was responding to a comment that suggested we had no useful counter-strategy to hacking, since it's difficult to respond to a cyber attack via conventional means. They know this, which is why it's relatively safe for them to engage in targeted hacking of US targets.

China is vulnerable to social unrest, and stirring up that social unrest puts them in a similarly difficult position...it's not something that they'd likely be willing to go to war over, but causes them great inconvenience. Developing/distributing vpn or other software that would bypass the great firewall would be useful here.

> Who said anything about helping them?

I was responding to the person who wrote "The logical counter-response would be to encourage the sort of unrest present in the "Jasmine Revolution".

If the suggested encouragment doesn't help, what's the point?

Note that some of our "help" has consisted of "we'll help if you accomplish {goal}" promises that we've broken.

What kind of "encouragment" and "stirring up" are you proposing that doesn't include help?

The funny part is, that youtube video in TFA, in the first several minutes it's been keep blaming US being the first and lead in cyber offence/defence warfare.

seems like there's nothing America can do to defend itself

Well that's ridiculous. Just install McAfee. Disconnect yourself from the network. ;-) Seriously, computer security is a big business. Money is being made. Something is being secured out there.

Edit: Please read the other comments and calm yourself down.

Carpet nuke.

Reply on news.ycombinator.com