Thread

1. jacobgold · 1790110395 · focus · HN ↗

   At this point, no one seems capable of keeping a large database safe. I assume all medical and biographical information that exists is in the hands of the major state actors.

   China hacked 22.1 million records of US government employees:

   <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;2015_Office_of_Personnel_Management_data_breach" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;2015_Office_of_Personnel_Manag...

   1. coldpie · 1790111715 · focus · HN ↗

      It is unthinkable to me that anyone believes there is such a thing as computer security after so many years of nonstop hacks and leaks. If you have a computer and it is connected to a network with access to the Internet, assume that computer is semi-public. Meaning, if someone was interested enough in accessing your computer, they could do it. Do not hook any computer with access to anything that would be devastating if it was made public to the Internet. Do not put anything that would be devastating if it was made public onto someone else&#x27;s Internet-connected computers.

      For example, do not hook your goddamn water or traffic or electricity infrastructure up to the goddamn Internet, and then, do fire the guy who suggested it.

      The correct analogy for computer security is not locks and keys and doors and gates. It is a house in a floodplain. Your house will not survive the flood of it hits you. Do not store anything critical or irreplaceable in that house.

      1. shepherdjerred · 1790112734 · focus · HN ↗

         It used to be that nothing was secure but that was OK because at least adversaries would have to expend effort. If you are one of a million companies why would anyone hack you. Maybe if you are a target you need a lot of investment, but most orgs only prevent the most egregious of vulnerabilities.

         The calculus has certainly changed. Hacking is becoming even more frequent and… I’m not really sure what the equilibrium looks like.

         It’s not really an option to stop using computers or networks. But it’s going to be way too expensive (or maybe even impossible) to secure even just critical systems.

         Maybe banks and governments can secure themselves (and that’s a big IF) but it really feels like something fundamentally has to change.

         1. jjmarr · 1790117252 · focus · HN ↗

            We will tolerate it. Companies will make robust identity verification schemes to enable agentic commerce. And it helps reverse hacking, making it a no-brainer.

            Let&#x27;s say my cryptosig gets hacked by SkyNet, or my agent goes rogue. Either way someone files a million loan applications in my name! Normally my agent uses that to buy $200&#x2F;month of Funko pops, or negotiate my recent purchase of a used car.

            I get the notification from my cryptosig company. I freak out, report as fraud, and wait.

            They comp the $3000 advance on my loan the scammer managed to withdraw, and I get off scott free, changing nothing about my behaviour.

            If cryptosigs meant I am liable for someone stealing my identity like in 2026, I wouldn&#x27;t use them. I&#x27;d negotiate everything myself with document scans, or god-forbid go in person since only I can legally bind myself under my own name.

            That sucks! Nobody gets a commission when I make deals with a government ID. Startups don&#x27;t even allow it as cryptosigs are more secure than scanned passports.

            I don&#x27;t want to do that either. When I was 18, I got swindled by a human salesperson into a $1400&#x2F;month 27% APR muscle car when human soldiers got signing bonuses. It was face-to-face and they were smarter.

            When I let AI own the budget, it leased me a mostly depreciated BMW from another AI for $500&#x2F;month. The models are mostly the same now and always settle close to the Nash equilibrium.

            I was so grateful that I selected a 40% tip for the AI. I wouldn&#x27;t want to make things awkward with the companion I spend 8 hours a day talking to, after all. To avoid a conflict of interest she only accepts voluntary fees.

Unofficial Hacker News client; not affiliated with Y Combinator.