> It is unthinkable to me that anyone believes there is such a thing as computer security after so many years of nonstop hacks and leaks.

Of course there is. For example, SeL4’s security and reliability proofs still hold in the world of LLMs. The problem is that most software isn’t written on that firm foundation. Instead, most software is made by people with the philosophy of “if it looks like it works, ship it”. You don’t get secure software by working like that, because security vulnerabilities aren’t visible.

We - humans - know how to write secure software. Just like we know how to make safe aeroplanes. The problem isn’t that we lack the capability to make secure computers. The problem is we don’t have a culture of security. Secure software is - somehow - niche. And as such, it’s much more expensive. And nobody wants to pay.

Air gaps are not magical, they will not stop the flood. The electrical grid has to communicate with itself to load balance, so you can run dedicated wires with giant cut-me signs pointing at it, or you can use symmetrical key encryptors to route it over the intenet. You needed to use the encryptors anyway, so why not. If bad software gets in via thumb drives music disks etc (and it will of the flood is pointed at you) it can still do bad things. But so can a hunting rifle pointed at a transformer station. That nearly blacked out all of socal once.

It used to be that nothing was secure but that was OK because at least adversaries would have to expend effort. If you are one of a million companies why would anyone hack you. Maybe if you are a target you need a lot of investment, but most orgs only prevent the most egregious of vulnerabilities.

The calculus has certainly changed. Hacking is becoming even more frequent and… I’m not really sure what the equilibrium looks like.

It’s not really an option to stop using computers or networks. But it’s going to be way too expensive (or maybe even impossible) to secure even just critical systems.

Maybe banks and governments can secure themselves (and that’s a big IF) but it really feels like something fundamentally has to change.

Many years ago, I regularly played cyberpunk tabletop RPGs with a number of other computer-inclined friends. We all used to laugh at ridiculousness of a key assumption of the game - the idea that giant corporations would ever connect their internal networks, full of valuable data, to the larger global telecommunications network.

A generation of coders who can't/are scared to write "Hello world" in C without Claude doing it for them has not helped.

This. I have an OpenStack homelab and a fast home internet connection. I update things pretty much daily, apply best practices, etc. And despite that outside of a wire guard instance i still host public things on a pair of VPSes, security just moves too fast to risk the home network (important things are backed up remotely and all that). I try to update the VPSes daily. Haven't gotten popped yet (to my knowledge!), but I am sure it'll happen eventually.

This is why I quit. You're all (excepting the parent) absolutely delusional. Computer security is literally snake oil. We kniw how ro do things right but we refuse to because it's too expensive.

This is the major problem I see with flock cameras. They say it’s okay because they’re only using it for good. But can they actually protect the honeypots they create? No. Is it their fault if it gets stolen? Yeah but at that point cats out of the bag.

There is such a thing, or, rather, used to be. Problem is that security is expensive (essentially one needs to examine all possible states of the system), and it inevitably failed to keep up with the crazy growth of complexity of modern computer systems. It became impossible to maintain a model of a system with myriad of moving parts, so it became impossible to make behavior guarantees.

Remove the complexity (all the way down to the hardware quirks), and security will be doable again.

If there were companies that never got hacked, how would you notice?

This is FUD. Cybersecurity is difficult but not impossible.

Computer security =/ publicly-accessable server security.

A linux box, layered in encryption and not plugged into any network = damb secure.

A network-connected linux box with a hardened OS, firewalled, acting only as a file server, given regular updates and 24/7 monitoring = less likely to be "hacked" than struck by lightning.

A hard drive with its power supply physically switched off = 100% secure from external attack.

Not a joke. The keys for editing the world's most important files, the root zone, are kept on no-power drives in air-gapped safes. They have yet to be hacked.

That what services that offer disposable and merchant-locked virtual cards are for. I have had good experiences with Privacy.com and Revolut.

What info can be gleaned from that? Surely the mere fact that you have a credit card means your name and billing address are floating around.

I guess your parking history around town could be valuable if someone is targeting you.

Oh yes, our one savior, Google

Yes that's why I run GrapheneOS, Google is very capable of inserting its own backdoors

"What do you hear, Starbuck?"

I loved the writers giving every firewall its own LED indicator, so we knew exactly how far the toasters had got.

but thanks to Baltar's firewalls and code obfuscation, just barely are able to escape after calculating the jump and having to literally wipe and reinstall all code on all systems.

> And unless those other systems are completely air gapped with no wireless or other access

That is exactly the canon.

> whichever part they exploited to gain access remotely

I think you missed the point of "no networking", you have to actually physically sit in front of the computer. There is no remote access.

So say we all

I thank you for your attention to this matter

I know a guy who named his kid Kash (before orange man) and he regrets it.

If you use Trump Coins to reflect the Evil Eye away from you, nothing bad can happen to you.

Was that the one where due to political grand-standing, we had a government shutdown that led to furloughing the contractors who worked on security, so no one was watching the dashboard? Or was that a different one?

Probably just one of the new recruits clicking on a link while viewing beastiality

That's assuming that the result of this will be to switch away from PeopleSoft.

The irony, of course, is that this will likely have a negative impact upon Oracle's reputation, which will have a negative impact upon its value, which will then be resolved with more RIFs.

It's okay. Larry got another island.

AFAICT in ~Dec 2024 the reasoning was that they had a paywall.

I don't know what percentage of their articles were behind a paywall back then, or the relative change to now. (Well, except for the fact that clearly some of their stuff is public today since we're looking at it.)

If I had my 'druthers, "paywall" and "register-wall" would be little icons on individual submissions. Then people would choose whether to upvote a more-accessible option instead, whether the hard-to-read stuff was still important enough to commenting on, etc.

Also true for all the frontier AI labs, who seem to be run by, essentially, clones of each other.

The US seems to breed this particular 'set' with remarkable consistency.

Even those in mainstream media who aren't ideologically aligned face pressure from threats and retaliation. https://en.wikipedia.org/wiki/Donald_Trump's_conflict_with_t...

it's Oracle, 99% chance it's a 0-day lol

'tis not. More of a RuneScape man myself.

I'm sure Czarek (a diminutive form of Cezary = Cesar) is flaunting his victory until this day. Now sit, nooblet.

ISO and ICC start with the same letter, just saying...

Uh yeah, it dangerous. Public data brokerage doesn't identify FBI agents in a master roster?

Consider open investigations with covert agents. Leaking their identitys could compromise entire investigations.

Hopefully there was some foresight in washing undercover agents from these systems to other secure ones or something otherwise that's pretty bad.

The 2015 OPM hack got every application for a security clearance. Which includes every place you lived for the past 15 years with names and phone numbers of people who knew you there. I expect the FBI data includes similar stuff. And because the FBI deals with financial crimes, I expect the data also includes bank account statements/transactions.

We as a country need to start treating PII as radioactive - that touching it or keeping it anywhere near your computer network is a company-ending disaster about to happen. The legal standard needs to be strict liability like CSAM or DUI.

Since I'm getting some positive feedback, I'll go even further and say that there should be security bounties established by law:

If a certified red-team of security researches breaches a company's system and discloses appropriately, the law should require the company to pay a security bounty.

The bounty doesn't have to be crippling to the company, but it should be large enough that the security researchers will be paid well and can live on collecting security bounties. We want an entire industry of good guys testing the security of everything.

There can be some regulation to. Like, it's not okay to run a massive DDoS to test systems. We want the red-teams doing constructive things, not just breaking everything. It should be legal for the red-teams to be annoying, but not purposely destructive.

How about putting some cash bounty flags out there in dedicated mock systems.. and maybe allow the public to attempt cyber breaches with the same impunity that anonymous perpetrators enjoy.

I’m sure there’s some value in that.

Well yeah, but I'm pretty sure there was another breach around 2016 that had similar info from the FBI

That was a long time ago.

DOGE got the IRS database, which got released to the Russians.

Well, I haven't tried asking my open-weight LLM for the FBI employee database. I imagine most people haven't.

There are 2 million people in US prisons, and yet this somehow has never stopped new people from committing crimes. It doesn't seem to be working that good as a deterrent.

The group is not afraid, but the individuals who got charged probably stopped all black-hat activity: there was an individual in his early twenties who "was sentenced to three years in prison and ordered to return $5 million", which is life-changing to say the least.

The FBI had some very smart people. The current regime/administration's number 1 priority is to eliminate anyone competent in order to replace them with loyalists. Stuff is only going to get worse.

The attackers exfil'd 3TB of data, which obviously included PII, from AWS servers. They should've had DLP, active monitoring, countermeasures, using a security vendor (you can set this up for AWS services using CloudTrail, CloudWatch Logs, etc). You're supposed to have that for sensitive government or military work, and it should have (at least) caught that much traffic going to a rando external IP, blocked and flagged.

If they did have it set up, then somebody wasn't doing their job. If they didn't have it set up, they didn't comply (which is also not doing their job). I see this all the time. The security analysts send tickets to people when they see major issues and nobody is held accountable for inaction. Management asleep at the wheel (which is also their cover, can't be blamed for what you made sure you never knew about).

It doesn't do nothing. It does make things somewhat harder to attack.

There was a time, 25-ish years ago, where exploits were thrown about like candy at a parade. The procedures you mention, along with other things, have made zero-days like these more valuable than gold.

If it was compressed prior to exfiltration it would be much smaller than the original data. I would expect this is mostly human readable text and a fairly high compression ratio. Agree it would still be large but 2 TB at 7:1 ratio drops to 285 GB. I don't know how much these servers are doing with data but I'd suspect sneaking out 10 GB/day over a month or 20GB/day over 2 weeks isn't going to trip up much. The CPU hog for the original compression might, but if you batch out the process in chunks (like a good data engineer), you probably wont trip many thresholds outside of expected use. Just a theory on how I might sneak that much data out of somewhere that has eyes on it, I don't know many details except what's in the article.

I'm less skeptical after seeing it happen to IDScan and terrabytes of government-issued IDs being exfiltrated quietly.

Still skeptical, but the FBI's vendors are just as vulnerable to 0-days as Hertz's vendors.