Hacker News Reader

Comment by waynecochran | Hacker News Reader

Morality aside, the right thing to do is not pay them. That is the only move to win in the long run.

At least at my company, ransomware payments are covered by insurance so it's always worth it to pay and have a pretty good chance at getting our data back.

This is short term thinking .. most people think this way.

Are you saying that short term thinking has no utility? I am willing to bet that there are a multitude of circumstances in most peoples lives that require short term thinking, or their lively hood or lives will be destroyed.

In a threatening situation, you solve the short term problem in order to have an opportunity to think long term, which will help to prevent these problems subsequently.

If we were talking chess, you wouldn't ignore the immediate moves of your opponent, because their idea of how the game should be played doesn't fit with your long term desire of how you want the game to turn out.

Perhaps I am a little too glib. You are correct, often without the short term there is no long term -- especially for small businesses. But as a whole, if institutions pay ransom then there is an incentive for folks to carry out this kind of extortion.

The problem with the equation is it doesn’t include the individual who had their data stolen. If the school didn’t properly construct itself to code and I got hurt inside of it, I can sue. But if my data was stolen and my credit is destroyed I don’t have an option (I haven’t heard of anyone claiming this, but it could be true and idk).

We need laws out in place to treat human data as someone’s property. If your data is mishandled with negligence and you experience provable hardship, there should be repercussions just like any other situation.

I'm not sure if you're just using building codes as an analogy or if you're recommending them as a model, so take this for what it's worth.

I agree there should be some laws in place, but I think building codes would be a terrible model for software. If a building doesn't incorporate code changes until the owner modifies some system, the building doesn't become less safe. Fire doesn't look for ways to get around building codes. Largely, there aren't new threats, just new, better ways of dealing with those threats. The incentive is for building owners to not modify their buildings so they can put off and avoid those code change costs as long as possible. If the building was up to code when it was built/modified, and you get hurt, you might be out of luck.

Software is nearly the opposite and it's faster. I think that makes it a more difficult problem to solve. The last thing you want is to make the entire world work like tech in the medical field...

Morality is a set of rules about what's right and wrong.

I'd say that we won't win or lose depending on whether we pay or don't pay. Root of the problem is legislature and regulation that allows infrastructure to be badly maintained without tangible repercussions.

If you make a school not-thunder-proof and it burns down during a thunder storm, how's that different from a ransomware attack that abuses an unmaintained X? Because blaming thunder is foolish, but blaming a hacker is understandable? That could be a source of some of the confusion.

Isn't that morality though? Doing what's best for the greater good even if it's against their immediate interests?

Winning is orthogonal to morality. In fact, one can "win" by some measures (e.g., make money) by means that are wrong.

That arguably depends on the data, but obviously you can’t trust them to give you the keys if you pay.

This is true but the reality is that 99% of the time the hackers will abide by their word. There really isn't much for them to release the data after taking the ransom. It makes it much harder for future people to pay up.

I found no source that claims anything even close to 99%. For example, CyberEdges CDR [1] says the chance is ~66%, and has increased in recent years from 50%. Sure the narrative that "ransomware relies on customer satisfaction" is funny, but it is also wrong. Do not assume that criminals are honest people. Out of three, one does not care about the long term sustainability of their business model.

https://cyber-edge.com/wp-content/uploads/2020/03/CyberEdge-...

Even if you get all your data back, you now have created incentive for folks to keep doing this. We all lose in the long term.

Reply on news.ycombinator.com