Hacker News Reader

While I mostly agree with you about cryptocurrencies, the idea that companies don't invest in security is a lazy argument. It's not that simple. Companies can't secure themselves against bugs in software that no one knows about (zero days) no matter how much they invest.

View on HN

While this is true, the overwhelming majority of these incidents do not use or require zero-days. The attack vector is nearly always basic phishing/social engineering, or wildly misconfigured/unpatched systems exposed to the internet. Implementing a bare-bones security program, or giving an existing security program the tools & authority to enforce policies, would cut down on ransomware incidents by a factor of 5-10, easily, without touching cryptocurrency in the slightest.

They can audit the projects they use. It will never be perfect but most do nothing.

Reply on news.ycombinator.com