Hacker News Reader

Good. Make it law in every other country too. You would not believe the amount of duct tape holding systems together; crowd sourcing the inspections would at least get eyeballs on the problems, even if it caused an uptick in security incidents.

(Former pentester @matasano, though only for a little over a year.)

After witnessing the results of over 50 pentests, you’re dragged to the conclusion that (a) companies usually get pentests because they’re forced to by other companies, and (b) the security incidents that do happen tend not to affect the companies themselves.

By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. The cost is borne by the customers whose data is exposed, not the companies who allowed the breach.

De-legislating cybersecurity will improve security, almost by definition. As you say, you’re forced to secure your systems. This is probably a net positive, and hopefully the experiment in Belgium will show why.

> By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents.

Ashley Madison, and Mt Gox come to mind. I suspect Lastpass will be added to that list soon.

Just checked: Ashley Madison is still in business and reached their highest (known) peak of users in 2019, about 4 years after the leak.

This begs the question: who's more stupid, the business that negligently screwed their customers, or the customers who came back after?

There is an unstated implication that negligence doesn't happen twice.

I'd sooner assume the membership count comprises bots and repeat throwaway/voyeur accounts.

it wasn't that customers came back, aspiring women noticed the gap in the market from the data leaks and chose to be sex workers, replacing the sock puppet users with real women. the hack and leak was a blessing in disguise for ashley madison.

this is already reported but once you leave the corporate sex worker exclusionary echo chamber it becomes more obvious how efficient that market is, from the supply side

it would alter most of your assumptions and make a lot of things more obvious without needing to be “studied”

> By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. The cost is borne by the customers whose data is exposed, not the companies who allowed the breach.

Shouldn't the companies be liable for millions of dollars on a sane justice system?

Know of any?

Technically not a case of hacking but still:

https://facebookuserprivacysettlement.com/

Compare and contrast Google's Project Zero's disclosure policy: https://googleprojectzero.blogspot.com/p/vulnerability-discl...

They don't wait for your permission to publish - they give you 90 days to fix and 30 days from when the fix is ready, but if you don't cooperate, they're posting it anyway.

As I understand it they don't hack into someone else's system, but they might disclose a vulnerability in your software running on my device.

> Belgium will soon have the most secure systems in the world, or no one dares running open computer systems there.

There are three groups of people:

* People who hack for profit and want to exploit you.

* People who hack for fun and don't care about telling you.

* People who hack for fun and are polite enough to tell you about it afterwards.

#1 isn't going to be deterred by law, as hacking is illegal already. #2 might do it anyway, since the risk of getting caught is low, you just won't hear about it. #3 is the only group that this new law will affect, and the way it will affect them is that now they can tell you about it without fearing repercussions.

I don't see this making people more afraid to run open computer systems. The bad guys were always going to get to them anyway.

> Though, Belgium will soon have the most secure systems in the world, or no one dares running open computer systems there.

I doubt it'll deter anyone from running computer systems.

After all, hacking already goes unpunished if it crosses the right jurisdictional borders, or if the attacker can't be traced. And for most attacks both are true so the cops don't do anything.

The only difference this law makes is for in-country hackers who disclose their own identity.

> Why not let the organization self decide this? Or one-out-of-two?

I think there could be two different situations. In the first one, the company doesn't want to let the pubilc know about a vulnerability they had to not damage their image. But the CCB gives permission after the vulnerability has been patched.

The second one is that the company gives permission, but the CCB wants to wait to first evaluate how many companies could have the same problem and get in touch with them. Think e.g. a vulnerability that can be potentially widespread like log4j.

The context here is "without authorisation of the owner of the system"; if they agree to publication then the additional protections [need to] don't apply

It’s going to be interesting in the cases where the security researchers cause denial of service conditions, data corruption, or just weaken or breaks a security control totally leaving systems and data wide open.

Looks like the new legal framework puts everyone at the mercy of CCB, a government body. Hope they have enough incentives and processes to do the right thing with all those 0-days that will flow to them.

Otherwise, this could undermine the public disclosure concept itself, a mechanism to force a stubborn vendor to fix their vulnerabilities.

Unicorn world. How lovely: "hackers" will start to give "vulnerabilities" for "free" to some "agencies"... I wonder how many will stay secret for those "agencies" own agenda.

How can you expect any trust in the shady world of "vulnerabilities"? Are you serious?

It is about deterrence. I had more than one instance where I did not tell a government agency or an airport or whatever about a flaw in theie system, because I did not want to deal with them potentially "shooting" the messenger.

Makeing certain things legal explicitly has it's merits.

But the "process" is still "secret", and the whole issue is the shadow around this, gov agencies or corps, same same. At the time I was seeing "computer security" people: namely at the time I did learn deliverable "security" is a fantasy, some said they were "pressured" by some corps to shut up with significant help from the authorities.

There is only one way to do that safely: immediat full public disclosure. Corps and govs have to be ready for that all the time, this is a significant part of their job. The real issue is the trust about the source of "vulnerabilities", because upon publication, it must be validaded by competent ppl, and here we go again in the shadows where things could become "delayed" indefinitely (I guess as long as possible).

Ah, a crowd sourced NSA. Very clever.

Yes, a very cheap solution. Very typical, as security always ends up at the bottom of the budget plan.

Vulnerabilities are by definition dangerous. In some cases critically dangerous.

It is reasonable, common sense even, that vulnerabilities should not be publicised without a vetting process.