Hacker News Reader

Comment by kissickas | Hacker News Reader

> In the wake of last year’s attack by North Korea against Sony Pictures Entertainment and numerous other breaches, the urge to hack back, or at least build up the means to do so when and if needed, has increased.

So this is just casually accepted as fact now?

View on HN

It's sad that Mutually Assured Destruction is the first place they go.

They could get a better understanding of security and enforce, research, and advise standards of protection on consumer data, making everyone in the country better off, or they can "hack back".

I don't really see how knowing what the average Joe in North Korea is Googling is supposed to help when my data is leaking like a sieve, but whatever.

They could, and then they'd be fighting an endless losing war over security. They'd rather like to have their own information attack capabilities.

Security will always be cat and mouse, but in the case of information security a good offense does not at all make for a good defense. Those holes in our information security system will still be there, to be exploited by whomever finds them. The only reasonable course of action is to devote resources to penetration testing ourselves and implementing strong security standards, along with developing good disaster recovery and damage minimizing plans.

Whether or not offense makes for defense depends somewhat on the actor. For some, deterrence does work.

For the rest, we have the basic problem that defense is much harder than offense. Also, the US seems to be far more vulnerable than most.

Those aside, offensive capabilities are needed. It's just a question of balancing them against defensive capabilities. I know firsthand that significant effort is going into defense, it just doesn't get the press that offensive capabilities do.

Their desire for a government accessible backdoor in everything consumers own says something different.

Yes, some of the top-level political efforts are pretty damn ugly... and likely to backfire.

Those shouldn't be mistaken for the whole of ongoing defensive efforts, though. Many of the others are much more practical.

Doesn't matter if it's fact if it creates a nice narrative for increasing and securing funds and power.

Why is suddenly everything the government says automatically a lie/coverup/false flag/conspiracy, yet the opposition in this case just happily accepted as fact?

The USG has no need to falsely accuse North Korea in order to step up it's cyber warfare game. Stuxnet did that a long time ago and was started under the Bush administration.

Stuxnet was a complicated maneuver that was directed at Iranian civilian facilities and wasn't retaliatory or relatable to the layman at all.

The reveal of Stuxnet was before the reveal of the reach our surveillance apparatus has. The narrative was one of plausible deniability and a nod to the fact that nations were engaging in offensive online attacks.

The NK hack was an attack on American culture and values. It was symbolic in a way that attacking Iranian civilian nuclear power plants isn't. It also doesn't involve exposing and admitting to running offensive campaigns on civilians of countries we aren't at war with.

NK hack says that we need cyber defense front, since the internet is the new land bridge across the Atlantic and Pacific for anti-American extremists to attack us directly.

It fits the narrative that the measures we are taking regarding near total electronic surveillance are justified and warranted. It also is a call for more funding and power to the agencies that are engaging in the activities.

It still does seem unlikely that a nation state would hack a film company specifically because of a scene featuring their leader being assassinated and immediately publicly dump exactly that clip in a load of stolen email data, so that it ends up all over reddit while still in the process of demanding that it is not released in any format ever.

That said, from another point of view, monumental fuck-up is a consistent feature of many human endeavours.

If it is said enough times ;-)

Reply on news.ycombinator.com