Comment by Buttons840 | Hacker News Reader

Comment by Buttons840 | Hacker News Reader

Parent Full thread

I depend on the security of many systems. If I want to test the security of those systems myself, with the intent to report problems I find, I will be arrested and thrown in jail.

Why are we sacrificing national security for the convenience of companies?

We should have strong legal protections for security researchers. Anyone who attacks a system with the intent of causing minimal harm and reporting what they find should be protected. We could also create a government agency whose job it is to continually try to break into these systems we depend on, a national red team.

The only downside is it will inconvenience and embarrass many companies. We might also find that the majority of our companies and institutions are incapable of creating secure systems, and that will be a hard political reality to deal with. But this is literally a matter of national security.

The bad guys will not be stopped by laws, but maybe the good guys can still win if we don't hamper the good guys with bad laws.

Unitedhealth IT labor force is vastly offshore, the system is inherently insecure.

The fact that healthcare providers are allowed to give access to sensitive healthcare data to foreign nationals should be illegal.

In some cases it is illegal but it requires you to essentially trust that systems are locked down according to frankly a flimsy attestation. I have my doubts how trustworthy are some of these attestors. There is a deep culture of ass-covering over anything else.

Yes, there's a deep culture of questionnaires and dubious "scans" in the security industry. It's all we got because nobody is actually allowed to kick the tires. Nobody is allowed to actually test the security of the systems they rely on.

> Anyone who attacks a system with the intent of causing minimal harm and reporting what they find should be protected.

Do you think that people should be allowed to penetration test your house without your permission?

At what point does a system become big enough that you think people should be allowed to attack that system - regardless of its owner’s desires - as long as the attacker has subjectively good intentions?

I am sympathetic to the idea behind your comment, but I don’t see how it’s compatible with strong private property rights. I don’t want you attacking my systems without my permission.

A thought provoking analogy, but I don't think it's applicable because my house isn't performing an essential service for other people.

A better analogy might be a friend stopping to double check that my front door is locked before he walks away leaving his child in my care.

If we use an analogy at all, it must account for the fact that millions of bad actors are constantly wandering by and checking the security of my proverbial house. Like, if my house was on an extremely busy street and a someone came to me and said "hey, the lock on your front door doesn't work", I would not have them arrested, nor would it be practical for me to arrest every passerby that checked the lock for whatever reason.

If my house depends on your house being sound, then yes, I should be allowed to nondestructively inspect your house form the outside or with whatever access you gave me.

This analogy has limits, but I work in the medical field. I even worked at change healthcare until last year. The consequences of PHI data breach are almost unbounded. Furthermore, If I put my reputation and that of the business on your service you better bet I will poke around with whatever access you gave me.

Reply on news.ycombinator.com