Nah, we're just gonna get every state having its own mini-Great-Firewall and very limited access to non-friendly states, at the routing level. There's a next gen Internet protocol that makes this easy. Maybe also personal IDs with a kind of Internet "credit score". We already do that, but with IP addresses and machine fingerprints. I expect some countries will adopt something like that, even in the "West".

Either that or the cost of attacks will remain lower than the benefit of being able to sell bits and bytes to your adversaries. I do not expect this to be the case, but maybe.

The open, global, semi-anonymous web is what's not going to survive this fight, I'm afraid. I give it 20 more years, tops, and maybe a lot less.

That could sounds interesting to to a lawmaker, but it wouldn't change anything in practice. Those hacks don't come directly from the authors nicely identified by their affiliation and location. They'll come from a trusted node in the US. Some many already do.

It would force the attackers to enter the jurisdiction of a state that will prosecute them if they're discovered, to carry out the attack, or else resort to much more difficult and slower methods (sneaker-net introduction of initial malware infections in the target state, say).

You don't have to enter a specific jurisdiction. There are supply chain attacks, escalation through residential connections, existing international botnets, and a thousand other approaches. And of course, there's always someone out there ready to open an email which will own them.

> There are supply chain attacks

Yes, some relatively slow, difficult, and expensive attacks would of course still be viable. That does not mean that, "it wouldn't change anything in practice."

> escalation through residential connections, existing international botnets

Right—so how are you going to talk to your botnet from outside the target sub-Internet when it won't even route packets you send it, except maybe to some hardened commerce-and-propaganda-only subnet that may have limited or no connection to the rest of the target state/bloc's Internet (and again, even that part existing is a maybe)?

We have a small experiment with that already - corporate NATs which are supposed to achieve the same thing. They still get owned. Even SWIFT which is basically as isolated as it gets in business had bad actors with access.

I don't believe a complete separation would ever be possible. We'd have to put banks on the commerce side. But that means every single business entity would also have to have access to them. But most businesses also need access to the other side and will not do perfect separation.

In malware research labs you can find rooms literally painted in two colours to separate the isolated part and prevent joining networks by accident. Normal companies do not care that much. Most single-person entities will just plug both ends into one computer and go on with their life.

Sure, but there wouldn't be a "bad" network to connect to.

Two things that are surprising me in this thread: 1) "there are ways to work around this, so it's completely useless" (yes, that's... any security), and 2) either not a lot of people are paying attention to future-Internet development, as in actual, technical development and research, or they're not seeing what I'm seeing in them, somehow, as, for example:

https://en.wikipedia.org/wiki/SCION_(Internet_architecture)

There will be plenty of home grown hackers within the country doing it then too. Sure that might make prosecution easier if we can catch them, but it's not like we have anything close to a good track record in solving most crimes and bringing the criminal to justice. It will just be another risk/reward trade off that domestics criminals make every day already.

“The internet interprets censorship as damage and routes around it”

Even if you physically firewalled every connection into a country all it takes is one little node connected via RF (satellite, HF, etc) dropped near an open WiFi hotspot.

The topology for the commercial internet today is not the same as the topology for the early internet which that quote is from. Today's internet is more of a hub and spoke model that is much more susceptible to damage if certain nodes are affected.

Wifi hotspot asks for personal or corporate/server ID of the sender of packets coming from this new node, since it can't route the traffic any farther without that. Gets nothing. Drops that node's packets as either hostile or malfunctioning, and, regardless, useless, since it can't route them anywhere. OK, so maybe you manage to steal an ID. See how this is making attacks harder? Now you're stealing or forging identities just to get any packets routed, and if you do anything suspicious-looking you'll rapidly get your stolen ID on the automatically-managed collective shit-list and it'll stop being very useful. Because the volume of attacks is so much lower, your drop-a-radio-near-a-hotspot trick might even trip enough flags to get someone to come find the device, if you use it very much—and if you can't use it much without "burning" the hardware, then, well, sure seems like it made your job as an attacker a lot harder, right?

There is nothing that guarantees the Internet will keep working the way it does now, and if an open Internet causes enough problems, it will be reigned in. How it works now is a choice, not a law of nature. I'm not happy about it, but that's just how it is. Either these kinds of attacks won't get much worse, or they'll get a lot worse and something like that will be what happens.

Wouldn't it be easier for the vulnerable beef packers and pipelines to simply disconnect from the public internet? What qualities do they have that would force them to burn down the world rather than fixing their shit?

I think between telling big businesses to spend a bunch of money and fix their shit and do things without the Internet, and adjusting the Internet—which would also make state-level attacks and foreign astroturf disinfo/propaganda campaigns harder to carry out—we're going to pick the latter. Again, unless these threats don't keep getting worse, though I expect they will.

Back in the EFNet days pretty much everyone just banned .ru, .br, .se, .no, and a few others because it was all takeover attempts all the time.

Unless we shut down physical borders that won't work because the developed world has travel open enough that hackers can travel to the country if their target, setup the attack, and leave. A few months later it executes and we're in the same boat as before, albeit with an additional speed bump for the hackers.

Or it will just be home grown criminals doing the same thing.

While I don't doubt the motivation of such a naked power grab, it has almost no useful security effect.

How so? Can't attack from abroad if non-trusted states have trouble even getting packets routed to the target state, let alone the specific network you're trying to breach. Very hard to attack from inside the "firewall" if access is, as a condition of being considered a trusted routing peer, gated by tying all traffic to a personal or corporate ID that would cause all kinds of trouble for the holder of same IDs should they route traffic on some bad actor's behalf (as, say, through Tor or other means).

That's just a matter of finding a vulnerable ally county to hop through. That's SOP now to hide your tracks. It's not like current attacks from Iran to the US have Irani addresses in the IP header.

That's fine until it's nearly impossible to route a packet from (for example) Iran to any IP in any state that's legally unfriendly to hackers and scammers, or otherwise operates outside the broad legal jurisdiction of the hackers' target states.

That's why we have technologies like Tor which will happily find a number of hops that do allow you to establish that connection.

Also IP-level blocks will never be perfect. See Hong Kong proxies. Or people in traded IP ranges classified as coming from another country.

Yes, the Internet as currently structured is resistant to this. The Internet is not guaranteed to continue to have that structure. I'm saying that if our choices are "constant attacks such that the Internet is horribly dangerous" and "don't have the Internet", the popular (at the state level) solution will be "I choose neither—instead, we're changing the Internet".

It's not direct packets. You ssh into a box in, say, UAE, then Cuba, then Canada, then USA. You're just uploading and running scripts, so latency doesn't matter.

Yes, I know how the Internet works now. It doesn't have to keep working that way, and if attacks get really bad the result will not be that we just live with them. The Internet will be modified to reduce the threat to a tolerable level. There's already been some pretty serious work put into what this will look like, if/when it happens.

So all that will change is you use a wireless link (starlink?) to SSH into a box in another country that connects to a box to a box to a box. It will not change a lot, infact as starlink like satellites become common place you can use them as jump boxes....

Your random Iranian hacker might not, but states will find ways around it. Even smaller criminal organizations find ways around such limitations.

Security does not have to be perfect to be effective. If it did, we'd have no security, because none of it is both useful /practical and perfectly effective.

That is basically KYC for internet traffic. Hasn't stopped big operators in finance, and i doubt that it will be different in Internet. A new crime of "traffic laundering", and mesh networks untraceable and unregulated like cash transactions.

Because the problem is critical infrastructure with holes in it, not that someone might communicate with that infrastructure. Trying to change the environment to ensure there are no attackers on the net is not a feasible alternative to hardening the critical systems.

This is NOT a cybersecurity or network vulnerability problem. That's just a symptom.

The real problem is that here, like so many other places in modern society, we've allowed consolidation to proceed far beyond healthy levels - when a single company is responsible for 20% of beef supply, it's time for antitrust action! (Yes, I'm looking at you, too, Internet, Tech, Media, Pharma, Aerospace/Defense, etc. companies...)

Maybe just allow one merger per decade, only available to companies with less than 10% of their market?

Consolidation leads to efficiency. Which in the case of commodities, is the only way to ensure low prices. A new slaughter company is not going to innovate a more efficient means of producing a pound of beef. In theory, a perfectly run state monopoly would be the ideal system. But that rarely ends well. In the US we've worked out a sort of half way between the two extremes, where large private corporations are allowed to consolidate in the name of consumer prices, while still maintaining just enough competition for profit motive to keep things well run. It's not perfect but it's the best we've figured out so far.

The security state is willing to do anything, up to kidnapping, torture and murder, in order to not change a thing about the current economic order.

I expect the problem to be addressed with technology, treaties, extraditions and putting a lot of people in prisons before the fragility of consolidation is addressed.

There are many problems with over-consolidation, but this isn't one of them.

The primary problem here is criminals and criminal organizations parading as nation-states. The secondary problem is systems and networks that are insufficiently secured.

Couldn't there be an open internet for non critical things and the great firewall protected net would be what countries infra is on

I think it'll be easier to have one network that's secure (or, at least, securable) at the protocol level, than two networks. As someone notes down-thread, people don't like dealing with two highly-separated networks, and if you have devices on both then that's a huge threat vector.

Further, I think states are likely to use this both to prevent beyond-their-reach nationals from attacking infrastructure and citizens, and to curtail foreign astroturf propaganda efforts.

The ID stuff is something I don't think all states will adopt, but some might, even in Democratic states. I think adjusting backbone routing to allow easy network-wide black holing based on verifiable origin, though, is very likely to become widely adopted over the next couple decades.

The 'splinternet' allegedly.

Right. I posit that either we will arrive at that outcome, or "cyber attacks" and various other forms of Internet-enabled international abuse will never get bad enough to justify it. I suspect we're in for the former.

Certificate authorities, but for the evil bit.

Sorta, but more like marking anyone's packets from outside your (or a friendly and cooperative country's) legal jurisdiction with the evil bit by default, and then also tracking which person or company, not device or IP address, originated every packet, so if they sent anything that should have been evil-bitted you can track them down.

Again, I reckon it's either that or this problem never gets much worse. Given trends, I expect we're gonna lose the open, global Internet.

Hopefully its not endless. I kind of view these attacks as forced penetration testing of sloppy companies. They may not have been hired or perform their work legally, but hopefully their work results in changes similar to legal penetration testers. Also, the more that these attacks happen, the more that insurance companies will begin to increase premiums and the more that they will push back on companies that practice sloppy security. It may be painful in the near term, but hopefully these attacks are a net good in the long term.

Did anything happen after the Equifax hack?

awaits with bated breath

Yeah, my free credit monitoring offer ended and now I have to pay to continue using it.

Great marketing, Equifax - they created the problem and tried to sell you the fix.

The thing that really pissed me off about it is that the same organization that leaked my data in the first place was going to monitor my privacy. But in order to sign up, they needed... more personal data.

No thanks.

Maybe they have slightly better security? Or hopefully at least they patched the one flaw that was used to get in.

I don’t think a Cold War is a good description of what’s happening; it’s not as if there’s some arms race going on as it is just a very public exposure of how bad our overall tech / security infrastructure is.

The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected.

> The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected.

Considering downthread there are honest suggestions to send special forces after the ransomware gangs, I’m gonna go with “probably not”. That type of denial is pervasive.

The F500 and companies like JBS just need to move essentially dataframes around from automation to automation, but somehow the software ecosystem is still building that with the same tools used to write Google. The next answer is usually “they don’t invest in a security team, clearly,” and I’m waiting for that subthread to kick off, too, to continue the denial.

Software complexity is the enemy, not the malicious actors exploiting it. Fix one, fix the other.

Software complexity is hard to tackle because it's really the underlying business complexity that's being modelled, which is usually beurocratic, Byzantine-like.

See the recent post on why the Uber app is so large: https://news.ycombinator.com/item?id=25376346

I'm confused, why isn't a security team a good way to make and enforce things like smaller attack surfaces and network isolation?

It is, but it's never going to be perfect. Nobody has achieved that so far. Or at least not in an environment where you have international distribution and thousands of endpoints touching different areas of the system.

The arms race is in exploits and software development. The country with the largest stockpile of the former and the best talent in the latter will emerge the victor.

A large stockpile of exploits can only harm someone else's economy, and it does not protect your economy. So perhaps your neighbour will suffer more than you do, but none of you will be winners in any sense.

The threat of retalition is historically one of the best defenses.

With big limitations that don't apply here. Things like mutually assured destruction work if/because an attack is quickly detectable, reasonably clearly attributable, and a symmetric tit-for-tat retaliation is plausible.

That's not the case for cyberattacks. Solarwinds was attacked many months before it was detected, Stuxnet was hidden for years. We have attributed some attacks but not most and attribution often succeeds only years after detection. And the attackers aren't as vulnerable to cyberattacks simply because their economy is "less connected" - for example, North Korea is at the extreme end of that scale and they really don't care much about what exploits you have; you have a digital economy that's wealthy but vulnerable to attacks by those who don't have it.

Or you could go a step further that it is our hubris as a nation that expects the other side to fight us on a traditional battlefield with tanks and bombs and get crushed in a month. As if the other side is just so stupid as to never figure out a different strategy.

This is a 21st century hot war that we are losing badly.

The good news is that cyber-war has a huge asymmetric advantage for defenders. For modestly more money, we can stop building absolute crap infrastructure that constantly gets owned. A little bit of investment in quality drastically raises the cost of an attack.