Nuclear weapons agency breached amid massive cyber onslaught(politico.com)
politico.com
Nuclear weapons agency breached amid massive cyber onslaught
https://www.politico.com/news/2020/12/17/nuclear-agency-hacked-officials-inform-congress-447855
221 comments
The solarwinds hack gets more expansive every time we find out more. This really doesn't bode well.
And this is why all the "they got into our left pocket but could not access the right pocket" statements can be ignored for now. It would be better to assume that every network/system in smelling range of a Solarwinds sticker is compromised.
The CISA post yesterday https://us-cert.cisa.gov/ncas/alerts/aa20-352a
mentioned "Note (Updated December 18, 2020): CISA has evidence of initial access vectors other than the SolarWinds Orion platform."
This raised any eye that there are other attack vectors that have been found but which they have not or do not have information on.
mentioned "Note (Updated December 18, 2020): CISA has evidence of initial access vectors other than the SolarWinds Orion platform."
This raised any eye that there are other attack vectors that have been found but which they have not or do not have information on.
Yea, what concerns me is the sophistication of the attack, and just how widespread the damage/fallout is. The attack very good cover, while everyone scrambles to limit exposure and not sure exactly what to look for.
What concerns me is lack of clear precedent for some equitable retaliation.
And if some equitable retaliation is designed would there be public support for it if it were to include conventional warfare in some proxy fight.
Much of the country has been told that China is the enemy and investigations into Russian interference in our country is a hoax.
If this is more work from the fancy bear folks this is problematic.
The US is a month away from a new president.
The new president’s authority to act against this attack continued to be undermined by the sitting president who just fired the head of cyber command because he said the election itself was secure. Not because it wasn’t, but because he said it was to the public!
I can not think of a more sophisticated and long term military intelligence operation than the epic we are witnessing right now.
The United States could not be in a weaker position than now.
And if some equitable retaliation is designed would there be public support for it if it were to include conventional warfare in some proxy fight.
Much of the country has been told that China is the enemy and investigations into Russian interference in our country is a hoax.
If this is more work from the fancy bear folks this is problematic.
The US is a month away from a new president.
The new president’s authority to act against this attack continued to be undermined by the sitting president who just fired the head of cyber command because he said the election itself was secure. Not because it wasn’t, but because he said it was to the public!
I can not think of a more sophisticated and long term military intelligence operation than the epic we are witnessing right now.
The United States could not be in a weaker position than now.
Retaliation for a cyber attack, with cyber attacks, sanctions, or military operations could set a dangerous precedent. Don't forget that the US and allies have been behind many cyber attacks, including against Russia and China ( and probably were involved with Stuxnet against Iran). Do you want Russia, China, Iran, etc. to retaliate against US cyber attacks? Because that's how you get an escalation.
https://en.m.wikipedia.org/wiki/Cyberwarfare_in_the_United_S...
https://en.m.wikipedia.org/wiki/Cyberwarfare_in_the_United_S...
Tit-for-tat at least has precedent. The two major problems are attribution and how you actually launch a retaliatory cyber attack. DDoSing the enemy for crippling your power grid (a la Ukraine) is weak at best.
One way is to have your backdoor planted, but only use it in retaliation. I assume that's why EnergyBear was found on the US power grid - not because Russia wanted to preemptively strike our grid, but so that they'd have the retaliation option ready to go, just in case.
One way is to have your backdoor planted, but only use it in retaliation. I assume that's why EnergyBear was found on the US power grid - not because Russia wanted to preemptively strike our grid, but so that they'd have the retaliation option ready to go, just in case.
Much better article: https://www.politico.com/news/2020/12/17/nuclear-agency-hack...
Changed from https://www.reuters.com/article/idUSKBN28R34N. Thanks!
Dang, the link should be replaced with this one.
The reuters article is a single sentences simply referencing this original article
I love that it's impossible to tell if you're mildly upset at the current state of this post or asking a mod to change it.
That's the beauty of it: many invocations of "dang" in HN will be done for both reasons. I don't know the origin of that username, but it's grown into it's role.
That is the origin. It seems to have held up pretty well.
https://news.ycombinator.com/item?id=7494093
https://news.ycombinator.com/item?id=22767267
https://news.ycombinator.com/item?id=7494093
https://news.ycombinator.com/item?id=22767267
his name is Dan G
I think he even has a trigger on that which sometimes leads to funny situations.
dang has a trigger on the nuclear weapons suite? wow, I thought being an hn mod was powerful but I had no idea.
Off topic, I know, but this entire exchange was quite wholesome and funny. With everything going on these days you all brought some levity to my day, thanks.
[deleted]
You have my apologies and my thanks for posting a better link :)
[deleted]
We’re all still here, so it could’ve gone slightly worse.
Maybe not much, though.
Maybe not much, though.
I wonder if we have dead man switches.. In a MAD world you would want to launch without human intervention from isolated systems.... I wonder how that would work... maybe it's not possible.
At least two, one for each Cold War power:
- ERCS: https://en.wikipedia.org/wiki/AN/DRC-8_Emergency_Rocket_Comm...
- Perimeter: https://en.wikipedia.org/wiki/Dead_Hand
- ERCS: https://en.wikipedia.org/wiki/AN/DRC-8_Emergency_Rocket_Comm...
- Perimeter: https://en.wikipedia.org/wiki/Dead_Hand
I have always wondered, if I were at the helm of a government asserting MAD capabilities, I would probably just not hold up my end of the bargain. Threatening MAD makes total sense, but once your enemy has assured your own destruction, is there much sense in actually following through? All you are doing is assuring millions of innocent people die for the actions of some generals.
All this to say, that it is unthinkably inhuman to have MAD be an automated response.
All this to say, that it is unthinkably inhuman to have MAD be an automated response.
Assuming your counter-attack doesn't make the difference between complex civilisation surviving and being wiped out on Earth, it has the potential benefit of preventing the initiating party from repeating their attack against other nations.
Even if the initial launch was a genuine mistake, there is some value in launching a retaliation because it prevents such mistakes (or "deliberate mistakes") from happening in the future. In fact, seeing how much the mistake costs the initiating party may be sufficient motivation for all the remaining countries to properly commit towards disarmament.
Even if the initial launch was a genuine mistake, there is some value in launching a retaliation because it prevents such mistakes (or "deliberate mistakes") from happening in the future. In fact, seeing how much the mistake costs the initiating party may be sufficient motivation for all the remaining countries to properly commit towards disarmament.
Though it's not what they've done so far, it's what they learned, and what they may have left behind that is more problematic.
I am pointing the finger at Microsoft for allowing bad security practice in windows kernel, architecture and other aspects of the Windows operating system. I am have to hand it to Microsoft for the good job security.
However without knowing the extent of the incident, and going off of this part:
"At this point, the investigation has found that the malware has been isolated to business networks only..."
It is more than likely this news story is overblown.
However without knowing the extent of the incident, and going off of this part:
"At this point, the investigation has found that the malware has been isolated to business networks only..."
It is more than likely this news story is overblown.
Yeah, and if MS tries and change this and make the kernel more secure I would expect huge outrage on HN from people complaining about MS restricting their freedom.
Having the police put a lock on your front door that you don't have the key to will technically make your home "more secure", but not in any way that's useful.
Locking down devices is actually just giving up on security. Trusted code and centralized review don't scale. Real security implies effectively mediating between many different interacting parties, not simply reducing the number of them.
Locking down devices is actually just giving up on security. Trusted code and centralized review don't scale. Real security implies effectively mediating between many different interacting parties, not simply reducing the number of them.
UAC (User Account Control) is some of the best thing Microsoft ever did for their security (and it might have inspired android permission system), probably following the Unix. I feel my naivete of complaining at the time I had to click a security prompt.
It's still sorely missing fine-grained control like network access (perhaps even fine-grained network access control), and access to various devices and folder locations; within reason, the more controlled and restricted the better.
Linux ought to make a move in this front and gain ground on security advantage: shouldn't we be able to give access to specific processes (say an installed game or text application) to specific folders and devices? Why should a game be able to read all my files (and not just its own folder), and why should any of those be able to use the network?
It's still sorely missing fine-grained control like network access (perhaps even fine-grained network access control), and access to various devices and folder locations; within reason, the more controlled and restricted the better.
Linux ought to make a move in this front and gain ground on security advantage: shouldn't we be able to give access to specific processes (say an installed game or text application) to specific folders and devices? Why should a game be able to read all my files (and not just its own folder), and why should any of those be able to use the network?
Microsoft moved the GDI into the (formerly) NT microkernel back in the switch from NT 3.51 to NT 4.0, for performance reasons -- and it was needed back then.
If the Linux kernel is getting too heavy for you (there really is a lot going on in there now), you can always switch to FreeBSD or OpenBSD. (no snark intended, this is actually quite a viable option for many workloads.)
If the Linux kernel is getting too heavy for you (there really is a lot going on in there now), you can always switch to FreeBSD or OpenBSD. (no snark intended, this is actually quite a viable option for many workloads.)
No, we are talking about security here. FreeBSD is even worse than Linux, and OpenBSD is not much better, just slower.
Microkernels with capabilities are the only way to go. L4, Fiasco, Genode, ...
Microkernels with capabilities are the only way to go. L4, Fiasco, Genode, ...
>overblown
I'm not sure about that. For example, FERC doesn't have a non-business network — they aren't a system operator. They do have all kinds of juicy data though, including details of various high voltage interconnects and the like that would be good stuff for an infrastructure attacker.
I'm not sure about that. For example, FERC doesn't have a non-business network — they aren't a system operator. They do have all kinds of juicy data though, including details of various high voltage interconnects and the like that would be good stuff for an infrastructure attacker.
They said "business network" so MS is a likely suspect. Then again the full extent of SolarWind's contracts with the government, and the impact of their own hack, aren't completely clear and it would be a decent sized coincidence if multiple nation-state hacks around the same time we're unrelated.
I'm not a fan of Windows in the slightest, but it should be noted that the Linux kernel has been moving in that direction for the better part of 2 decades now. The amount of privileged code running in the kernel now is absolutely mind boggling.
I'm really hoping to see an industrial-scale push to develop a solid headless unix-y userland for SeL4.
I'm really hoping to see an industrial-scale push to develop a solid headless unix-y userland for SeL4.
Do you mean eBPF? Or what kind of privileged code is the problem?
Regarding security. I think the problem is simply that neither Linux nor Windows is the right tool for this job. They are secure, but not nuclear arsenal secure. And there is where SeL4 and other formally verified components should come in.
Regarding security. I think the problem is simply that neither Linux nor Windows is the right tool for this job. They are secure, but not nuclear arsenal secure. And there is where SeL4 and other formally verified components should come in.
If you were a government agency responsible for a deterrent that has held the peace since WW2 and that deterrent had just been compromised would you tell the public?
[deleted]
It feels like we're in the calm before the storm and nobody is watching the approaching squall.
China growing in power and influence, flexing itself on the global stage. The US waning internationally, citizens divided and full of hate.
We're factory-less, fab-less, and have fewer educated. Fewer consumers. Lots of debt.
We have SpaceX, but China's pace of exploration and international cooperation is increasing faster than NASA's.
The only advantage I can think of us our military and navy, but China has carrier-killers and ICBMs.
Zoomers on TikTok hate capitalism and the military, and it seems like they're being indoctrinated by an "algorithm". Or maybe it's the lack of opportunity we're providing for them.
If and when our tech companies and entertainment companies get leapfrogged, what will we have to export that brings us wealth?
What happens to democracy and liberty when the top economy and producer in the world is a single-party state?
I hope we're hacking back just as hard. That's what the NSA should be doing rather than domestic spying.
China growing in power and influence, flexing itself on the global stage. The US waning internationally, citizens divided and full of hate.
We're factory-less, fab-less, and have fewer educated. Fewer consumers. Lots of debt.
We have SpaceX, but China's pace of exploration and international cooperation is increasing faster than NASA's.
The only advantage I can think of us our military and navy, but China has carrier-killers and ICBMs.
Zoomers on TikTok hate capitalism and the military, and it seems like they're being indoctrinated by an "algorithm". Or maybe it's the lack of opportunity we're providing for them.
If and when our tech companies and entertainment companies get leapfrogged, what will we have to export that brings us wealth?
What happens to democracy and liberty when the top economy and producer in the world is a single-party state?
I hope we're hacking back just as hard. That's what the NSA should be doing rather than domestic spying.
I think China has been playing us for years, and doing so masterfully. There's no _good_ reason for the US, with our economy and standing, to be ripping itself apart from within -- but, indeed we are.
Not only is China growing in power and influence, as you point out, it has been investing in American media and other industries. They're famous for playing their strategic game over a long span of time (the long game).
My pet theory is that Hollywood, Silicon Valley and the Left are thoroughly (and probably unwittingly) influenced by the infiltration, and are the medium for memes and messaging that divides us so much. It's as though we're about to re-fight the Civil War. China, the master that it is at cultural revolution and re-education, is playing a shrewd game.
I think they're about to beat us cold by causing us to implode from within. If so, it's beyond sad -- but in terms of military strategy, a brilliantly played hand by President Xi and the CCP.
Not only is China growing in power and influence, as you point out, it has been investing in American media and other industries. They're famous for playing their strategic game over a long span of time (the long game).
My pet theory is that Hollywood, Silicon Valley and the Left are thoroughly (and probably unwittingly) influenced by the infiltration, and are the medium for memes and messaging that divides us so much. It's as though we're about to re-fight the Civil War. China, the master that it is at cultural revolution and re-education, is playing a shrewd game.
I think they're about to beat us cold by causing us to implode from within. If so, it's beyond sad -- but in terms of military strategy, a brilliantly played hand by President Xi and the CCP.
Is it Hollywood, Silicon Valley, and the Left who are choosing to buy cheap Chinese goods?
Are they forcing Walmart and Amazon to carry those goods?
Are they responsible for the low wages Americans are making?
Did they move manufacturing overseas?
Otherwise a water tight theory ..
Are they forcing Walmart and Amazon to carry those goods?
Are they responsible for the low wages Americans are making?
Did they move manufacturing overseas?
Otherwise a water tight theory ..
> My pet theory is that Hollywood, Silicon Valley and the Left are thoroughly (and probably unwittingly) influenced by the infiltration, and are the medium for memes and messaging that divides us so much. It's as though we're about to re-fight the Civil War.
Interesting you should attribute that to “Hollywood, Silicon Valley, and the Left” since the people spreading memes and propaganda literally advocating either a new Civil War and publicly advocating military overthrow of the lawfully elected government are on the Right (the former groups like the Boogaloo bois; the latter a number of prominent figures, including recently pardoned former National Security Advisor Gen. Michael Flynn.)
> China, the master that it is at cultural revolution and re-education, is playing a shrewd game.
Both the pro-Trump elites counselling extra-Constitutional violence and some of the more (superficially, at least) grassroots groups in the White nationalist/supremacist vein preaching race war have been well documented to have been engaged with and influenced by Russia; China less so.
Interesting you should attribute that to “Hollywood, Silicon Valley, and the Left” since the people spreading memes and propaganda literally advocating either a new Civil War and publicly advocating military overthrow of the lawfully elected government are on the Right (the former groups like the Boogaloo bois; the latter a number of prominent figures, including recently pardoned former National Security Advisor Gen. Michael Flynn.)
> China, the master that it is at cultural revolution and re-education, is playing a shrewd game.
Both the pro-Trump elites counselling extra-Constitutional violence and some of the more (superficially, at least) grassroots groups in the White nationalist/supremacist vein preaching race war have been well documented to have been engaged with and influenced by Russia; China less so.
If you're going to throw generalities: Meanwhile the Right believes a guy named Q, that Biden stole the election (despite Giuliani Total Landscaping providing zero evidence), that there's a furniture store selling missing kids hiding in plain sight... Sure, not all of "The Right", but as I said, generalities.
Your bias is showing, and you're totally blinded by propaganda as badly as you accuse some others.
Your bias is showing, and you're totally blinded by propaganda as badly as you accuse some others.
I hear a lot of fear that the US may no longer be on top, from which I assume you are an American. The good news is that Americans (as individual humans) may be better off when America is no longer an empire.
The British empire was good for the rulers and owners of the companies integrated into it, but not for the average brit.
The British empire was good for the rulers and owners of the companies integrated into it, but not for the average brit.
any proof of this besides your word? I'd love to read about it.
China has massive internal problems, and all data out of china's government are falsified and outright lies. China is a paper tiger in more ways than one. In 10 years, the power struggle between west and east will be a stalemate, and eventually both super powers will be overtaken by a growing power from India. India will be the powerhouse of the 21st century IMHO
Wake me up when India has a semiconductor fab < 65nm.
You will be sleeping like rip van winkle, as I am thinking in terms of decades.
>"I hope we're hacking back just as hard. That's what the NSA should be doing rather than domestic spying."
You can sleep well. Spying is what every government does.
You can sleep well. Spying is what every government does.
>I hope we're hacking back just as hard. That's what the NSA should be doing rather than domestic spying
You really care about the ideals of "liberty" and "democracy" I see.
You really care about the ideals of "liberty" and "democracy" I see.
Well, not reacting just encourages more attacks.
If your goal is fewer attacks,launching your own is a terrible method of achieving your goal. Even if you stop all the "enemy" attacks that doesn't mean the number has decreased.
Deterrence is a time-honored strategy. As the Romans liked to say, "if you want peace, prepare for war." It tends to prevent adversaries from miscalculating, a proximal cause of many a bloody conflict.
Launching attacks isn't deterrence. Even if your general philosophy were correct, which I disagree with, it is not one of peacefully promoting democracy and liberty.
If an undemocratic adversary is trying to gain secrets to put them at an advantage against our military, citizens, or economy, it's only fair that we do the same.
They're not going to stop trying. We shouldn't just let it happen.
They're not going to stop trying. We shouldn't just let it happen.
If it is unacceptable for them to do it to us, it is unacceptable for us to do it to them. Stop caring only for yourself under the false guise of "democracy and liberty."
A lot of countries aren't number one.
no reason the United States has to be an empire
no reason anything has to be an empire, for that matter
We make the biggest blockbuster movies. Have you even seen End Game? What about Frozen? (Not the sequel) The snowman Olaf transcends national borders. We'll be fine.
The studio system is shut down and blockbusters aren't coming back. Movies are going straight to streaming. Disney and Warner are doing far-reaching reorgs to see to it. Look also at directors like Nolan and Villeneuve complaining - they know their familiar way of life is coming to an end, and they're struggling to cope with the new reality.
Low-budget is something we'll get schooled on. International studios are just as good as we are.
China owns a number of US studios outright, and they also own a lot of the tooling (eg 40% of Epic Games, which is being used for Star Wars). They're cultivating our tech and using it themselves.
Most of the deep fake research amenable to use in films is coming out of China.
I'm not saying it's a sure thing, but China is in a very good position to attempt a takeover of the movie market if they want to.
edit: I'm now being greeted by "You're posting too fast. Please slow down. Thanks." on all messages I've attempted to post.
It appears my account got flagged for this thread. I've never seen this before in my ten year history of using HN. Not sure if this is automatic or manually added. Does anybody else know what this is about? [1]
[1] https://github.com/minimaxir/hacker-news-undocumented/issues...
Low-budget is something we'll get schooled on. International studios are just as good as we are.
China owns a number of US studios outright, and they also own a lot of the tooling (eg 40% of Epic Games, which is being used for Star Wars). They're cultivating our tech and using it themselves.
Most of the deep fake research amenable to use in films is coming out of China.
I'm not saying it's a sure thing, but China is in a very good position to attempt a takeover of the movie market if they want to.
edit: I'm now being greeted by "You're posting too fast. Please slow down. Thanks." on all messages I've attempted to post.
It appears my account got flagged for this thread. I've never seen this before in my ten year history of using HN. Not sure if this is automatic or manually added. Does anybody else know what this is about? [1]
[1] https://github.com/minimaxir/hacker-news-undocumented/issues...
Sure, but Olaf? He sneezed his nose off! That's original. That will keep the US at the bargaining table on any geopolitical issue. Heck, China won't even allow the words "Winnie the Pooh" to be spoken on Chinese soil, so that crazy honey addict is in our pocket forever.
China owns 40% of epic games? --- EDIT: wow, that's "unreal" ( excuse the pun ) ... what a sell out Epic games!
Everyone hates on Chinese repression and human rights violations until they get the check in the mail. What do you reckon the career prospects are of an Epic employee who criticizes China's treatment of Hong Kong? If precedents are followed, the entire company would be forced to make an embarrassing apology.
Yes. Tim Sweeney also stated he wanted to exchange expertise.
https://www.mcvuk.com/business-news/publishing/tencent-acqui...
https://www.mcvuk.com/business-news/publishing/tencent-acqui...
Tencent own stakes in a lot of gaming, film and music companies. If you enjoy Western content there's a strong chance a chunk of the profits go to China.
> Zoomers on TikTok hate capitalism and the military, and it seems like they're being indoctrinated by an "algorithm".
I don't see how that connects to your larger point. Can you please explain?
I don't see how that connects to your larger point. Can you please explain?
Capitalism is fuels our wealth machine. The military helps project power and protect our interests.
If younger generations grow up hating these structures, they might vote against them.
If younger generations grow up hating these structures, they might vote against them.
I think younger generations believe that these structures have led to "the lack of opportunity we're providing for them," as you phrase it. By that reasoning, they should vote to change the military and economic status quo.
I have a lot of faith in the younger generations. They are much more desensitized to bullsh*t, and tiktok will quickly fade in popularity just like myspace and facebook.
Stagnant wages, unattainable housing, crushing student loans, the collapse of the American dream, young people don’t hate capitalism because of TikTok propaganda, they hate it because it has completely failed them.
Those characterizations of yours make it sound really bad.
Yet, the quality of life in America, as well as around the world, has improved drastically. How many people have luxuries like cell phones, computers, TVs, cars, refrigerators, indoor plumbing and heating, as well as access to resources like ambulances and hospitals--the list goes on. How humans of centuries past would long to have lived at this time, if they could see how we live today.
And it's not just about material things. For example, in the past hundred years, although the world population increased from 2 billion to 7 billion, the number of people who die to natural disasters each year has greatly decreased.
This video shows how widespread these misconceptions about world situations are: https://www.youtube.com/watch?v=N1dvfH3s1Ak In this study, about 80% of people were wrong about more situations than if they had chosen an answer randomly.
This is not to say that there are no problems in the world, or in America. There will always be problems. But your characterizations are misleading, and your claim that capitalism has "completely failed" young people is extreme, and it fails to credit capitalism for the prosperity that it has enabled for most of the world's population compared to most of human history.
Yet, the quality of life in America, as well as around the world, has improved drastically. How many people have luxuries like cell phones, computers, TVs, cars, refrigerators, indoor plumbing and heating, as well as access to resources like ambulances and hospitals--the list goes on. How humans of centuries past would long to have lived at this time, if they could see how we live today.
And it's not just about material things. For example, in the past hundred years, although the world population increased from 2 billion to 7 billion, the number of people who die to natural disasters each year has greatly decreased.
This video shows how widespread these misconceptions about world situations are: https://www.youtube.com/watch?v=N1dvfH3s1Ak In this study, about 80% of people were wrong about more situations than if they had chosen an answer randomly.
This is not to say that there are no problems in the world, or in America. There will always be problems. But your characterizations are misleading, and your claim that capitalism has "completely failed" young people is extreme, and it fails to credit capitalism for the prosperity that it has enabled for most of the world's population compared to most of human history.
There’s a reason Bernie Sanders was so popular with young voters. HN is an echo chamber for capitalism, but the reality for most people is capitalism is failing them, society is failing them, and if we want to keep what we have today, we urgently need to address these failings.
I agree with you - the world isn't set up to benefit young Americans in this generation as easily as in the 60's and 70's. I'm not sure we'd agree on the causes though.
People are still told to go to expensive college. A cheap community college degree in STEM is worth much more than an expensive liberal arts education. A self-taught programmer has more marketable skills than a liberal arts degree holder. The freely available loans made the institutions money hungry, and they grew to absorb all of the new income.
We really need to fix education.
The post-war / post-energy boom is over, and the easy gains that yielded have faded. Today's economy is harder. The knowledge economy is not as accessible and requires more training. The US can't compete with the cost of manufactured goods as our standard of living and minimum wage are too high. By importing, we're moving that negative externality of hard or menial labor to economies that can handle it - bringing them up to our level, but destroying those opportunities domestically.
Housing is still affordable outside of major cities. I'm not sure what to do about the price of housing in major urban areas though. It's supply and demand, and wages for the average worker haven't increased.
People are still told to go to expensive college. A cheap community college degree in STEM is worth much more than an expensive liberal arts education. A self-taught programmer has more marketable skills than a liberal arts degree holder. The freely available loans made the institutions money hungry, and they grew to absorb all of the new income.
We really need to fix education.
The post-war / post-energy boom is over, and the easy gains that yielded have faded. Today's economy is harder. The knowledge economy is not as accessible and requires more training. The US can't compete with the cost of manufactured goods as our standard of living and minimum wage are too high. By importing, we're moving that negative externality of hard or menial labor to economies that can handle it - bringing them up to our level, but destroying those opportunities domestically.
Housing is still affordable outside of major cities. I'm not sure what to do about the price of housing in major urban areas though. It's supply and demand, and wages for the average worker haven't increased.
You didn't even respond to a single thing I said. You just repeated your original claim that, "Capitalism is failing them." That's tantamount to propaganda--keep repeating yourself until people believe you.
You sound just like a politician with your empty, alarmist assertions ("failing! urgently address!"). Are you a Sanders staffer? I mean, it would explain your comments.
You sound just like a politician with your empty, alarmist assertions ("failing! urgently address!"). Are you a Sanders staffer? I mean, it would explain your comments.
https://news.ycombinator.com/item?id=25513074
Capitalism is failing these people. There’s statistics all around. If you want to bury your head in the sand and lash out at random people on the internet, I feel sorry for you.
Capitalism is failing these people. There’s statistics all around. If you want to bury your head in the sand and lash out at random people on the internet, I feel sorry for you.
Really? You actually repeat yourself again after I just pointed out your repeating yourself?
You: "Capitalism is failing people!"
Me: "Actually, it's enabled much prosperity around the world, so that only a small minority of the world population lives in poverty compared to a few decades ago. For example, here's a YouTube video showing how public perception differs from reality."
You: "Capitalism is failing people!"
Me: "You're not even making an argument. You're just repeating your assertion."
You: "Capitalism is failing these people! You're lashing out at me!"
It sounds like you're trying to convince yourself by sheer repetition.
You: "Capitalism is failing people!"
Me: "Actually, it's enabled much prosperity around the world, so that only a small minority of the world population lives in poverty compared to a few decades ago. For example, here's a YouTube video showing how public perception differs from reality."
You: "Capitalism is failing people!"
Me: "You're not even making an argument. You're just repeating your assertion."
You: "Capitalism is failing these people! You're lashing out at me!"
It sounds like you're trying to convince yourself by sheer repetition.
Zoomers not liking capitalism is just young people being young.
wow_never(3)
Too bad Biden is a China lap dog...
Meanwhile the President salutes Kim Jong-Un
I congratulate anyone who is able to create a dialogue with a country that is otherwise bristling for violence. Better words are flying that bullets or missiles.
Dialogue i.e. getting played?
He was bending over to yet another strongman dictator, e.g. fussing over getting him a Elton John CD for example.
He was bending over to yet another strongman dictator, e.g. fussing over getting him a Elton John CD for example.
It seems that some prefer warfare?
Well this administration is the most drone happy of since Clinton, executes people willy-nilly, and throws away treaties so perhaps judge it by those same standards.
Right, so Biden has still been soft on China and allowed his family to become financially entangled with the CCP; you haven’t spoken to that yet.
Who was executed “willy-nilly”?
Who was executed “willy-nilly”?
Bit of a misleading title by Reuters.
They accessed the business networks of the NNSA, the agency responsible for maintaining the nuclear stockpile, but did not access the networks managing the actual nuclear weapons, as the title half-implies.
There was no threat of random nuclear weapon exploits, those networks have not been compromised as far as we know.
They accessed the business networks of the NNSA, the agency responsible for maintaining the nuclear stockpile, but did not access the networks managing the actual nuclear weapons, as the title half-implies.
There was no threat of random nuclear weapon exploits, those networks have not been compromised as far as we know.
There is an odd quirk in our culture, where lying is universally acknowledged to be toxic behavior, but the use of intentionally misleading language is merely frowned upon--as long as it doesn't contain a falsifiable claim. But this is really a distinction without a difference, as they achieve the same goal, which is to put an idea in the mind of the listener/reader which the speaker/writer knows to be false. After all, lying isn't what got us into the current era of a post-truth public discourse. What got us here is a historical and ongoing toleration of journos and politicians who are careful truth tellers in a technical sense, but liars in practice.
In my opinion, these liars-in-practice are far more pernicious than the liars-in-fact. It's easy to disprove a fact, whereas it takes time, effort, and some analytical ability to unpack a carefully worded untruth.
Apologies for the rant.
In my opinion, these liars-in-practice are far more pernicious than the liars-in-fact. It's easy to disprove a fact, whereas it takes time, effort, and some analytical ability to unpack a carefully worded untruth.
Apologies for the rant.
Excellent point. The goal of honest language should be the creation of correct beliefs about reality in the minds of who listens to you, even if those beliefs might sometimes not serve your ends. Otherwise, it's not communication, it's warring against truth.
(Of course, there is disagreement about what is true in many cases, but in this particular case, the reporter or editor presumably knew the difference and went forward with the title anyway.)
(Of course, there is disagreement about what is true in many cases, but in this particular case, the reporter or editor presumably knew the difference and went forward with the title anyway.)
"liars in practice" is uncharitable at best. A headline has some maximum number of words, and there is only so much that can be conveyed. "Technically true" is strong standard to meet in under a sentence. Is this purposefully misleading? I would say no.
It’s interesting to me, because in my mind Reuters is characteristically a good actor in this space, often opting for more of a mouthful but not misleading title.
It might have been an honest mistake? Although it would be surprising to me that a Reuters editor would miss the implication of this headline.
It might have been an honest mistake? Although it would be surprising to me that a Reuters editor would miss the implication of this headline.
I would argue that there's a caveat: if the lie is about a person or group that the mainstream media is active hostile against, lying is not just expected, but encouraged and rewarded.
Or so, anonymous sources familiar with the matter tell me.
Or so, anonymous sources familiar with the matter tell me.
Or in other words, exposing frauds for who they are based on facts, not their talk.
[deleted]
> They accessed the business networks of the NNSA, the agency responsible for maintaining the nuclear stockpile, but did not access the networks managing the actual nuclear weapons, as the title half-implies.
That they know of / are admitting at this time.
The damage could really be far worse. It's hard to tell right now I think.
That they know of / are admitting at this time.
The damage could really be far worse. It's hard to tell right now I think.
Yea, also, who would build a nuclear bomb that could be detonated via the internet? I would be outright shocked if there wasn’t a mechanical part of the process... eg, in the early days, they literally had the warhead and bomb parts physically separated
"I would be outright shocked if there wasn’t a mechanical part of the process"
More shocking things have happened, like the nuclear launch codes being "00000000" for 15 years:
https://www.huffpost.com/entry/nuclear-missile-code-00000000...
More shocking things have happened, like the nuclear launch codes being "00000000" for 15 years:
https://www.huffpost.com/entry/nuclear-missile-code-00000000...
NAAS (Nukes as a Service) is probably part of the JEDI defense contract Azure signed with the government.
A cold comfort. That is still incredibly embarassing.
Well, it looks like they started to build up narrative for another military deployment once new president is in power, who cares about specific details?
Hopefully the networks that have launch and scheduling are fully airgapped.
There is an automatic response system ARS in place. On both sides. Tit for tat was still a thing decades ago, until it was mathematically proven to be not a good strategy.
Movie recommendation: https://letterboxd.com/film/virus/ The better japanese version is also on youtube.
Movie recommendation: https://letterboxd.com/film/virus/ The better japanese version is also on youtube.
That's for data exfiltration. Wouldn't be useful for sending launch and scheduling commands.
Nobody worry: There's a security company named SolarWinds that has a lot of experience when it comes to getting hacked, and they've already got contracts with the Federal government. Working together, I'm sure the Feds & SolarWinds can leverage those existing relationships to help get to the bottom of this situation and make sure it never happens again.
sjg007(2)
Does this mean the nuclear systems are less secure than the voting machines?
Wow, I must have touched a nerve with my question. Didn't mean to Red Pill anyone, just critical thinking. SoZ
It seems that the U.S. approach to “cyber” defense is a complete shit show... I can’t imagine the level of incompetence and bureaucracy that led to this Solarwinds oversight - this is amateur hour stuff.
"Most secure <whatever> in history!"
/s
/s
This is the result of 4 years of neglect in the oval office. This is a disastrous breach - but not a surprise under our current leadership.
Considering the OPM hack under the predecessor provided information on every person with a security clearance, I don't think it is quite fair to blame one as this sadly seems to be par for the course. I'm sure the incoming octogenarian will understand the series of tubes better...
When you have the President firing people (Director of DHS Cybersecurity ring any bells?) for not playing his insane games, does the apple fall far from the tree?
If you think the president needs to actually "understand" anything subtle like (even physical) security, you are being deliberately obtuse or naive.
If you think the president needs to actually "understand" anything subtle like (even physical) security, you are being deliberately obtuse or naive.
It is pretty reasonable to say that managers need to have at least a cursory understanding of the business they are managing. That doesn't mean anyone expects a president to take a direct hand in selection of components for a security infrastructure, but rather have an appreciation that information security is quite serious and put competent managers in place over those decisions. Even a Director level position in any location in government is still rather far removed from the decision process as their purview typically includes HR, budgeting, procurement, regulatory oversight, and somewhere further down the pole is the actual work. That isn't naivete but reality of how this bureaucracy works.
With fear-based toxic culture, nobody reports anything and you get USSR and Chernobyl the series.
This hack happened prior to the firing.
Good to know the buck doesn't stop at the presidency anymore. Guess it's just a free for all.
Information security is a boondoggle for high levels anywhere as there are no repercussions for failure. Neither CEOs nor high level government officials give it the respect it is due because it is expected and they can all point the blame somewhere else and feel no pain. Compare export control laws that have individual implications that a company cannot cover in the case of a violation, while cyber security breaches have no similar penalty. If a law were made to impose fines of 2-3 times the total compensation package of C-level management for one or more years including unvested stocks and unexercised options, then I'm sure we would see security departments expand rapidly as a CYA. The buck should stop at the top, but without laws to force the issue, it won't.
When did it ever stop at the presidency?
https://www.theguardian.com/us-news/2020/nov/17/chris-krebs-...
Sycophancy and dishonesty spread pretty quickly - two things you don't want in anything important.
Sycophancy and dishonesty spread pretty quickly - two things you don't want in anything important.
> Trump fired Christopher Krebs, who served as the director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (Cisa), in a tweet on Tuesday, saying Krebs “has been terminated” and that his recent statement defending the security of the election was “highly inaccurate”.
Absolutely damning. Sadly even on HN some cybersecurity experts that will trash companies for breaches will turn a blind eye to this because of their politics.
Absolutely damning. Sadly even on HN some cybersecurity experts that will trash companies for breaches will turn a blind eye to this because of their politics.
> even on HN
The delusions of grandeur HN has about it's own culture is why is still has these biases. There is no politics on HN, ipso facto it cannot be biased.
What the "no politics" really means is no vaguely left-wing shibboleths allowed.
The delusions of grandeur HN has about it's own culture is why is still has these biases. There is no politics on HN, ipso facto it cannot be biased.
What the "no politics" really means is no vaguely left-wing shibboleths allowed.
Why is all of this important stuff just hanging off the internet like it's a public webserver in a data center?
So that they can get software updates.
It's kind of a lovely paradox -- connect to get software updates, but if you didn't connect you wouldn't need updates.
Not all bugs relate to internet connectivity. If you had a non-networked computer, you might still want bug fixes.
For that matter, non-internet-connected computers can still be networked to each other using internet protocols, so they can still need bug fixes for internet stuff.
For that matter, non-internet-connected computers can still be networked to each other using internet protocols, so they can still need bug fixes for internet stuff.
Non-public networks are a thing... And there are other patch delivery mechanisms...
This stuff was solved BEFORE the Internet was in widespread use.
This stuff was solved BEFORE the Internet was in widespread use.
Oops your launch codes have been encrypted!
What Happened to My Nuclear Deterrent? Your abort codes are encrypted and your nuclear arsenal has been placed at DEFCON level 1.
Many of your ICBMs, submarines, launch silos, bombers and other facilities are no longer accessible because their communication channels have been encrypted. Maybe you are busy looking for a way to cancel the launch, but do not waste your time. Nobody can recover your abort codes without our decryption service.
Can I prevent thermonuclear war? We guarantee that you can recover all your nukes safely and easily. But you don't have enough time. If you do not pay within 7 days, you will not be able to recover from nuclear winter forever.
How do I pay? Payment is accepted only Bitcoin. Click for more information.
What Happened to My Nuclear Deterrent? Your abort codes are encrypted and your nuclear arsenal has been placed at DEFCON level 1.
Many of your ICBMs, submarines, launch silos, bombers and other facilities are no longer accessible because their communication channels have been encrypted. Maybe you are busy looking for a way to cancel the launch, but do not waste your time. Nobody can recover your abort codes without our decryption service.
Can I prevent thermonuclear war? We guarantee that you can recover all your nukes safely and easily. But you don't have enough time. If you do not pay within 7 days, you will not be able to recover from nuclear winter forever.
How do I pay? Payment is accepted only Bitcoin. Click for more information.
This would be a pretty wild explanation for the run on BTC recently
I should've never opened that Nuclear_Update.pdf.exe attachment!
"Good thing Bitcoin is just one of our many projects."
For a second I thought this was channeling Clippy. I'll bet MS didn't see that one coming as a result of their being hacked.
I have to wonder how many corporations have been hacked but we will never know, because they are worried about the value of their stock. This could actually be a much greater threat to hobbling our infrastructure or blackmailing wealthy people to do their bidding.
Presumably all medium and large corporations have been hacked. I don't think I've ever worked at an organization that hasn't been hacked. And all but one were hacked multiple times, though I'm sure that's because I just wasn't privy to the other incidents (the company may not have been, either). For criminal organizations it's just a numbers game--penetrate as many organizations as you can and then look for monetization opportunities. For many nation-states the calculus probably looks much the same, and in any event the techniques are similar.
I worked for a company that had all their Customer data stolen and then sold on a darknet market place.
They completely swept it under the rug, told the infosec guys that if they talked about the incident with anyone they would have their employment terminated and that it was to never be discussed because they were worried about their share price.
We also have laws here in Australia that says if this happens to a business it mandatory to disclose the breach to your customers.
> you must notify affected individuals and us when a data breach involving personal information is likely to result in serious harm.
A employee anonymously reported the breach to the government agency that handles this, who in turn contacted the business with a "Please explain. Right now."
The next day after they were contacted they fired every single IT department staff member. Helpdesk, Infosec, Networks... All fired, because they couldn't figure out who reported it.
Nothing ever happened to the business as they somehow convinced the government that the data that was stolen was "made up junk data used for testing" despite it being obviously clear that it was current customer info.
This crap happens all the time and businesses are continued to be allowed to get away with hiding breaches from people.
All it does is help the share price and disadvantage the customers.
They completely swept it under the rug, told the infosec guys that if they talked about the incident with anyone they would have their employment terminated and that it was to never be discussed because they were worried about their share price.
We also have laws here in Australia that says if this happens to a business it mandatory to disclose the breach to your customers.
> you must notify affected individuals and us when a data breach involving personal information is likely to result in serious harm.
A employee anonymously reported the breach to the government agency that handles this, who in turn contacted the business with a "Please explain. Right now."
The next day after they were contacted they fired every single IT department staff member. Helpdesk, Infosec, Networks... All fired, because they couldn't figure out who reported it.
Nothing ever happened to the business as they somehow convinced the government that the data that was stolen was "made up junk data used for testing" despite it being obviously clear that it was current customer info.
This crap happens all the time and businesses are continued to be allowed to get away with hiding breaches from people.
All it does is help the share price and disadvantage the customers.
Open source software has "more" vulnerabilities because more of them get reported. With proprietary software black hats are gathering exploits in a weapons silo ready to be sold on the black market.
For some reason businesses prefer to cover up their vulnerabilities instead of fixing them. When you report a vulnerability as a white hat there is a big risk that the company will use you as a scapegoat and sue you. For a business it is much easier to claim that they "caught a hacker" rather than admit their weakness in public.
Hackerone is basically a "vulnerability blackhole as a service" because researchers are dependent on bounties for their income. Disclosing an ignored vulnerability publicly weeks or months after the hackerone report can lead to getting banned on hackerone and thereby ruin your ability to collect bounties.
For some reason businesses prefer to cover up their vulnerabilities instead of fixing them. When you report a vulnerability as a white hat there is a big risk that the company will use you as a scapegoat and sue you. For a business it is much easier to claim that they "caught a hacker" rather than admit their weakness in public.
Hackerone is basically a "vulnerability blackhole as a service" because researchers are dependent on bounties for their income. Disclosing an ignored vulnerability publicly weeks or months after the hackerone report can lead to getting banned on hackerone and thereby ruin your ability to collect bounties.
Why not name this company?
Because they'll come after me for slander / defamation.
Australian law provides almost no protection for speaking out against this kind of thing. Does not matter if it's true or not, it's still considered slander/defamation because you said something that makes the company look bad.
Australian law provides almost no protection for speaking out against this kind of thing. Does not matter if it's true or not, it's still considered slander/defamation because you said something that makes the company look bad.
Too late now but consider using a throwaway account next time.
How did that mass firing not trigger the whistleblower laws?
That's why GDPR includes personal liability for DPOs(Data Protection Officers) and chief executives, and requires the company have a DPO with no conflict of interest ( e.g. working under the CEO with bonuses based on stock price).
I think the idea of "no conflict of interest" for an employee of a company is a bit silly. No internal conflict of interests sure, but everyone on payroll has a vested interest in the continued financial health of the organisation.
The good news is that US nuclear weapon silos are stuck with 1970s technology.
https://slate.com/technology/2014/04/huge-floppy-disks-and-o...
https://slate.com/technology/2014/04/huge-floppy-disks-and-o...
This is no longer the case, they’ve since upgraded: https://www.nytimes.com/2019/10/24/us/nuclear-weapons-floppy...
Everyone calm down:
It was just a kid trying to hack into a video game company. He accidentally started a war simulation. The US had recently turned over control of its entire nuclear arsenal to an AI because humans resisted launching weapons that would kill millions.
Anyway, the kid accidentally started a war simulation and now the AI wants to nuke everyone. Don’t worry though, as soon as the AI plays itself in tic-tac-toe, it will realize that peace is the only way.
If you aren’t old enough to understand this, you need to catch up on your 80s nerd movies. :)
It was just a kid trying to hack into a video game company. He accidentally started a war simulation. The US had recently turned over control of its entire nuclear arsenal to an AI because humans resisted launching weapons that would kill millions.
Anyway, the kid accidentally started a war simulation and now the AI wants to nuke everyone. Don’t worry though, as soon as the AI plays itself in tic-tac-toe, it will realize that peace is the only way.
If you aren’t old enough to understand this, you need to catch up on your 80s nerd movies. :)
How about a nice game of chess?
Reliable, boring old tech to the rescue.
> Reliable, boring old tech to the rescue.
Reliable is not a word that comes to mind when recalling floppy disks of my youth.
Reliable is not a word that comes to mind when recalling floppy disks of my youth.
Reliable no, but difficult to access via a REST API yes
A Kubernetes cluster of nuclear weapons. Want mutually assured destruction? Simply deploy a helm chart!
Finally, Terraform and CloudFormation can truly live up to their names!
Have you heard of Amazon’s new Chaos Engineering as a service?
[deleted]
Which is probably the reason they were not compromised.
You mean either launch password 1111 or 1234.
What is it going to take for the US to do something about the threat from Russia?
Nothing hopefully. Russia is a nuclear armed power and dicking around in cyberspace doesn't kill anyone. The US gave billions to get Yeltsin elected which far surpasses by orders of magnitude anything the US has alleged so far.
https://www.washingtonpost.com/history/2020/06/26/russian-el...
https://www.washingtonpost.com/history/2020/06/26/russian-el...
From the actual article:
>The U.S. government has not blamed any particular actor for the hacks yet, but cybersecurity experts have said the activity bears the hallmarks of Russia’s intelligence services.
>The U.S. government has not blamed any particular actor for the hacks yet, but cybersecurity experts have said the activity bears the hallmarks of Russia’s intelligence services.
"The hack was so sophisticated, there must be the evil scary country behind it!"
"Their password was solarwinds123 and it was on their GitHub."
"Their password was solarwinds123 and it was on their GitHub."
What it is going to take for the US to build secure IT systems?
Israel is laughing at this kind of installed rhetoric.
Not sure! Trump assured the American people that "I have a son. He's 10 years old. He has computers. He is so good with these computers, it's unbelievable."
Can't imagine why the US government hasn't formed a strategic response under Trump. His foreign policy has been so good over the past 4 years.
Can't imagine why the US government hasn't formed a strategic response under Trump. His foreign policy has been so good over the past 4 years.
US has probably done worse to them. Tried at least so this is fair game
Clickbait nonsense.
Responding to this might be Bidens first major international crisis. Would not want that job.
As if dealing with COVID and growing domestic extremism weren't enough
COVID is solved. We have two effective vaccines now approved. It's just a matter of time to get them distributed at this point.
COVID is not solved. There are massive vaccine distribution problems to solve, vaccine misinformation campaigns to work against, and the 10's of thousands or 100's of additional deaths that will happen between now and widespread immunity.
And you could of course include the economic fallout of COVID under the same umbrella, which is nowhere close to being solved.
And you could of course include the economic fallout of COVID under the same umbrella, which is nowhere close to being solved.
Let's see how many are denied the second booster shot.
When you reward loyalty over competence, shit like this is just a matter of time.
So USA can blatantly infiltrate Iran with stuxnet but God forbid anyone try the same back to them. Oh no
Let's update Doomsday clock!
jeez this is terrifying. can someone just give me peace of mind that I'm not going to be nuked
Definitely aliens.
Given the scope of the attack I think it’s reasonable to assume all high value targets were compromised in someway. It’s more a matter of what specifically was compromised, what data was exfiltrated, how much of the attack was offline, are Thunder going to start breaking a as la stuxnet etc.
With how widespread this event has been, I would wager that those scam emails saying they have "recorded you relieving yourself, and you must send X bitcoin or we'll expose you" must be true for at least one person at these agencies / companies.
Stux to be them.
[1] - https://en.wikipedia.org/wiki/Stuxnet
[1] - https://en.wikipedia.org/wiki/Stuxnet
Why the hell do they even have these top secret data over the network? They should cold store anything sensitive.
It's difficult and expensive to store this data without access to any network at all. Anything sent via email would still have to be sent via some other method if you didn't have email.
How come this community of self-proclaimed hackers and independent thinkers are so quick to believe whatever "cyber-attack" related news that gets published?
Classified networks are typically air gapped.[1] Doubtful that hackers obtained anything useful.
[1] https://en.wikipedia.org/wiki/Air_gap_(networking)
[1] https://en.wikipedia.org/wiki/Air_gap_(networking)
Wouldn't be so sure. Data is eventually copied out of the airgapped side, e.g. NSA exploits are developed in the airgap and copied to an attack staging server on the Internet. And there's one-way connectivity into the airgaps via data diodes. So it's possible that a sufficiently advanced malware got through the data diode, infected the airgap side and hitched a ride out over sneakernet.
Yes evidence, more evidence, just like the good ol' time that US had evidence from Nayirah, and Powell wielded a tube of wash powder in UN claiming that was WMD.
I do believe that President Trump deserves a Nobel Peace Prize, because with so many evidences, his precedents, including our be-loving Obama, would have bombed the hell out of our designated enemy.
I do believe that President Trump deserves a Nobel Peace Prize, because with so many evidences, his precedents, including our be-loving Obama, would have bombed the hell out of our designated enemy.