Instead of the punitive angle, if they are critical infrastructure, what are the authorities of government doing to protect them?
The point is, if they want someone poking around these systems, they'll contract with them to do that. You should not tamper with them just out of curiosity. Convicted felons have a hard time finding jobs.
Once a customer of the penal system, always a customer. They've worked hard to get their retention / repeat business numbers up this high. Why take that away from them?
If there are more jobs than people, felons will be hired.
To pick a boring example, see the multitude of companies complaining about labor shortages and also the number of felons who are struggling to find jobs.
You can argue whether a punitive system that effectively provides a deterrent is right or wrong, but a punitive system that isn't effective as a deterrent cannot make the same argument.
You plebs have no business poking around and find out what people in power are doing or find out if they've done their job properly. If they wanted someone holding them to account, they'd contract them to do thay'
Okay, I call bullshit. That which can be claimed without evidence can also be refuted without evidence.
That said, if you’re feeling like finding out do heed caution because I’m sure the Man will love to make an example of the first person we figures out how to pump their gas at $0.01 per gallon.
Aside from the extreme rudeness, what evidence are you looking for? Do you want GP to attach sensitive or classified pen tests results here in public forum?
GP's claim is so obviously true that I don't see why they would need to provide "evidence," but you can find a mountain of it yourself with a single duck: https://duckduckgo.com/?q=us+government+penetration+tests&at...
Pen tests are a requirement for any vendor doing business with the gov. Check out NIST 800-53 and the FedRAMP security process. It's much more intensive than SOC2 which is the standard in the commercial world. I think your information is about 10 to 20 years out of date.
Not every claim is an argument requiring evidence.
I work in the industry, you are 100% wrong, due to NDAs I offer no proof of your wrongness.
Go find it yourself if so inclined.
I am claiming relevant experience as my insider knowledge. What experience or proof do you have to back your refutation?
That’s how this works. When somebody gives you a peek behind the curtain while chatting, you don’t go and demand proof. You can ask for it nicely of course. That is the socially acceptable thing to do.
Your behavior is out of line given the casual and pleasant discourse before you showed up.
It is up to you as a communicator to establish your credebility so that people can trust your words and take your seriously. It's not a favour to the audience.
As far as I can tell, this gentleman has categorised you as a random dude at the bar making things up.
What do you do?
Nothing. Because you are not in a position to know better. It’s your unsubstantiated guess against a possible lie.
If you are coming to the conversation in good faith, you don’t start with an accusation of lying. You share your doubts and ask politely for more information.
Not caring if you offend someone? That’s also quite rude!
Not every single thing spoken requires a double blind study.
The person “calling bullshit” was wrong. I work in the industry, and no I’m offering no evidence due to NDAs.
Yes, agree 100%. When you're busting balls with your friends it's perfectly fine, but when it's a stranger online who doesn't know you at all and is likely from a very different culture, it's not a good idea to respond that way, unless you want to offend.
> Pen tests are a requirement for any vendor doing business with the gov.
What does this prove? Solar Winds, Colonial Pipeline (maybe more relevant here), etc.
Your search link doesn’t include anything about extensive penetration tests ensuring the security of these devices. That’s the claim. Where is the evidence?
Also calling someone’s knowledge “out of date” is a, dare I say rude assumption. But judging by your assuring in the security of government contractors I’d say your opinions are quite naive :)
Sadly, this is an is/ought problem. I don't want to live in a world with poverty and war either, but that doesn't make it fact.
> What does this prove? Solar Winds, Colonial Pipeline (maybe more relevant here), etc.
The point of pen tests is not to guarantee perfection. There are also ways to sweep things under the rug if those in charge are so inclined. But the existence of those things doesn't mean pen tests aren't done, or that nobody cares about security.
> Your search link doesn’t include anything about extensive penetration tests ensuring the security of these devices. That’s the claim. Where is the evidence?
Did you look at either of the first two hits? The first four indeed are evidence that the government does pen tests. The first hit is a government department that solely exists to do penetration tests[1]. The second one called "PENETRATION TEST GUIDANCE" is all the rules regarding how penetration tests must be done[2].
1: https://www.doi.gov/ocio/customers/penetration-testing
2: https://www.fedramp.gov/assets/resources/documents/CSP_Penet...
Ok your turn for evidence. What evidence do you have that all of those things are fake? Or that none of the compliance officers actually check it?
> Also calling someone’s knowledge “out of date” is a, dare I say rude assumption.
You're right, I apologize for doing that. I actually thought that was more charitable than the other possibilities, but it doesn't add anything to the discussion so should have been left out.
Lol, exactly
> But the existence of those things doesn't mean pen tests aren't done, or that nobody cares about security.
No one said that. Are you okay?
>What evidence do you have that all of those things are fake? Or that none of the compliance officers actually check it?
I know for a fact that they do and that those documents are not fake :)
"I call bullshit" is a colloquialism that derives from the "Bullshit Game"[0].
Learn you some language for a great good.