Re:U.S. to give ransomware hacks similar priority as terrori...
by jeffbee on Thursday June 03, 2021 @06:59PM
(#27388528)
Right, security is definitely not a box you can check but American business have decided that if they run Qualys to get that PCI-DSS everything is good. Nobody is out there seriously talking about the fact that the Linux kernel is written in fucking C. Well it's 2% faster than if we wrote it in an actual language with, I don't know, bounds checking, and we'd rather use the 2% for dividends, thanks very much. We need some economic and regulatory incentives here so the public endpoints of your critical oil pipeline are running applications written in safer languages on seL4 platforms with hardware roots of trust, instead of god-damned DOS.
The software industry should be ten times bigger than it is, but the economic incentive has been to make it cost less, rather than to make it safer.
Re:U.S. to give ransomware hacks similar priority as terrori...
by midev on Thursday June 03, 2021 @09:09PM
(#27389346)
> run Qualys to get that PCI-DSS
I feel this deeply within my soul.
I think it's actually harmful, because people that don't know any better thinks a Qualys scan means something.
Re:U.S. to give ransomware hacks similar priority as terrori...
by throwaway3699 on Friday June 04, 2021 @01:33AM
(#27390921)
How many exploits are because of the Linux kernel, and not userspace software? No kernel will protect you running public ElasticSearch with "username" and "password01" as the credentials.
Are you sure about that? A lot of this stuff is way more than just some bored kid. For the company I work for, there is almost certainly a group of well paid people who sit around every day trying to figure out new ways run scams using our site.
When there is financial motivation, people go through great efforts to get that $$$.
"Security" isn't some catch-all box you can check. It's a non stop game of whack-a-mole where your adversary spends each day getting around whatever you put into place.