Hacker News Reader

Comment by Asdfbla | Hacker News Reader

I guess it will unfortunately take a long time for the world to realize that the rules of "cyberwar" are different from the conventional military. (Of course, there's a lot of literature from security and cyberwar researchers, but that doesn't seem to reach the politicians.)

You can't just pour money in offensive capabilities of your intelligence agencies, as is currently done in most countries, and hope to "win". Your exploits and zero days will be stolen, your critical systems will be weaker (because you intentionally weakened them or didn't disclose vulnerabilities) and you simply can't control the weapons you created. Worst of all, the weapons developed by state actors will fall into the hands of ordinary criminals, which makes for an even more complicated world.

View on HN

How is that any different from manufacturing physical arms that somehow end up in the possession of some enemy foreign power?

It's vastly faster and more reproducible, enough so as to make it a different environment with different considerations.

It's more akin to manufacturing portable arms factories, that can also replicate themselves.

Lose one and you're SOL.

SOL except that the arms can be rendered useless with a simple update in defenses.

Except it could be a simple update after substantial damage has been done.

Yeah, and when the US power grid is offline for three days due to latest NSA cyber toy to get out of fucking Fort Meade, I'm sure the priority of those people stuck in an elevator or families watching their loved ones die due to a life support system failure will be to fucking update Windows XP.

If that were to happen it would be more the fault of power companies that do not have critical systems well protected. Fort Meade is hardly the only entity developing these sorts of exploits, so you have to expect them. The patch for this has been out for a while now.

A simple update applied to a few hundred thousand of people, most of which don't work for you or know enough to care.

If the vulnerability had come from Google Project Zero, the same worm could have been created. The only difference is a lower barrier to entry, but with enough malware authors out there, even GPZ's descriptions are enough to cause vulnerabilities to turn into exploits in the wild. Why does the discoverer of a vulnerability matter if the vulnerability was patched before it was publicly announced?

Physical objects take dollars and time to design and produce at scale. Most of these vectors take time to design and money for living and the initial computer, but the implementation of them takes almost no money nor time (ok, yes a few miliseconds and the electrical power, but it's basically nothing). Corey Doctorow has said it best : "A lot of threat modeling is based on something like economic rationality by your adversary: you assume that no one would spend $10 to steal $1 from you. But with nitwits, all bets are off: this isn't about designing a safe to keep out a smart mastermind cat-burglar, it's trying to figure out if a drunk and belligerent dudebro will walk up to you on the street and punch you in the face to blow off some pent-up hormonal steam."

(https://boingboing.net/2017/05/13/heroism-through-domain-squ...)

That's exactly right. The strongest offence is a good defense.

Reply on news.ycombinator.com