Same way that they do it now with bank phising: Hire some bum off the street to go into the Western Union to cash in the money from the transaction slip you give him. He gets to keep a few pennies and hands you the rest of the dough.
I've been in IT security for about 10 years now. For most of this time, security was but an afterthought. Security is the equivalent of insurance or military: Expensive and utterly useless unless you really, really need it. Be honest, do you need fire insurance? As long as it doesn't burn anywhere, it's just a waste of money. And for the longest time, there was no fire anywhere in IT. Yes, from time to time there was a bit of a problem. A worm that dug into millions of computers. Or some big company was hit by a hack that did minimal damage.
The problem here is that the damage was simply not high enough to warrant employing people who cost 6 figures a year and can't even guarantee you to be protected against anything that may come your way. Take this highly simplified risk calculation: If your potential damage in case the risk manifests isn't higher than the chance of it manifesting times the cost to mitigate it, it is more sensible to just carry the risk.
And for the longest time, this was the case. Imagine a potential damage of a million bucks per incident. If that happens once every ten years in your company, your annual cost to mitigate must not be higher than 100k. And 100k isn't really much money in ITsec.
If it costs more, you're better off just taking the hit once a decade.
For the longest time this was actually a sensible way to operate. Financially sensible. We've been warning about something like this for years. It was pointless, because the risk never manifested as incidents.
Now the incidents happen.
And now it is too late. We're in too deep to recover. Most of the software and hardware we use cannot be sensibly secured, because, as noted before, security is an afterthought and was not part of the fundamental design. Take HTTPS of all the things. What is it, essentially, but a thin security fig leaf on top of http? And we're still dealing with crucial infrastructure like DNS and DHCP that are by no means secure (not only because they still use a protocol where you can't even sensibly find out who the hell sent the packet in the first place), and while secure replacements exist, their implementation cost too much. Not only because we'd need new hardware.
More importantly, we'd need better trained administrators. Wait, more precisely: We'd need administrators that get at least basic security training. When you see people shrug at you when you tell them that using self signed certs is not ok and you get back a "what's your problem, it IS encrypted, what else do you want?", you know that the person does not even understand what he is doing here. We are critically underprepared for what's coming our way, what we see here is the tip of the spear that's going to hit us right into the chest.
Actually most of the time. Which makes a lot of sense. You get to see the interesting parts of the movie in the trailer so you are excited about it and want to see it.
Unfortunately, and this is why the trailers become spoilers more and more, the interesting parts are also the parts that resolve issues. Movies, especially today, follow a certain logic, a pattern. In the penultimate act, the resolution happens. And this resolution is of course also the culmination, the climax of the whole show. Here, everything happens. And of course this is also the most action-loaded and fastest paced part of the movie.
Prime trailer material.
No! It is not! The perfect trailer material is the act preceding it. The one where the conflict looks like it is heading for a negative resolution, where the villain triumphs. The infamous "night is darkest before the dawn" moment of the movie. THAT is where you have to take the trailer from. It leaves the audience wondering how the hero will turn it around and makes them interested in seeing the resolution.
Remember the cheesy 60s Batman series? The cliffhanger was always them being trapped by the villain-of-the-week. Say what you want about that show, but this was done right!
Take your average movie. Say, anything Michael Bay did lately.
Now spoiler it in any meaningful way. I dare you.
Nearly all mass appeal movies of today are so formulaic and predictable that "spoiler" doesn't really describe the problem. The problem is more that it's "seen one, seen 'em all".
Is it my fault that the robber came in and shot the guy? It's not like I hired him or told him it's a good idea. There's even a sign in the window that it's pointless to rob the store because the clerk can't access the big bucks, they're in a steel box (mostly so the little asshole can't steal from me... I mean, for the cashier's safety, of course).
Lenin was a dilettante, a theoretician without any idea how to handle people. Stalin knew how to handle people and he knew that it's easier to be feared than to be loved.
Both of them wanted power. Killing people was a means to the end, and they didn't care that it happened, for the most part. Stalin's train of reason was that he can either kill these people and be feared for it, or let them starve and be hated for it. Which would you choose?
Then he's an ass that I don't want to work for me. That still makes him someone doing it for money.
And, frankly, anyone who feels the urge to brag about something like that usually only can land that "professionally" too: With women doing it for money.
The point is, what is "good" behaviour that should be copied by the sex not doing it, and what is "bad" behaviour that should be stopped by the sex doing it.
A studio is afraid to try something new because a movie costs millions, often hundreds of millions, to make. So they are afraid to try something out of the ordinary and instead rehash the same stuff that once managed to get people into the cinemas, we get reboot after reboot, relaunch after relaunch.
And going to see a movie costs between 10 and 20 bucks a person. So we're afraid to try something that we don't know anything about, fearing that we're going to waste 20 bucks on something we are not going to enjoy.
It's a matter of money. People don't want to waste it on something that's not going to perform the way they would like it to.
Wait 'til I hold my fingers under your nose after wiping my little darling's ass and ask you whether you think that smells more like the results of milk or the oatmeal.
Tobacco is legal because there are already too many addicts to simply outlaw it right away without serious repercussions. I.e. criminalizing a sizable portion of the population with the ensuing social problems. If you want to know which, look no further back than prohibition times.
When everyone breaks the law, the law becomes meaningless.
Nazi Germany didn't consider the Jews "their" subjects. Soviet Russia and Pol Pots Cambodia didn't do it secretly but instead very openly and publicly to instill fear.
Slashdot Mirror
Yes, yes it is.
I would consider this a reason to not want to work there. Mostly because I don't want to work with people who're even more childish than me.
Same way that they do it now with bank phising: Hire some bum off the street to go into the Western Union to cash in the money from the transaction slip you give him. He gets to keep a few pennies and hands you the rest of the dough.
Erh... no. Allow me to shed some light onto this.
I've been in IT security for about 10 years now. For most of this time, security was but an afterthought. Security is the equivalent of insurance or military: Expensive and utterly useless unless you really, really need it. Be honest, do you need fire insurance? As long as it doesn't burn anywhere, it's just a waste of money. And for the longest time, there was no fire anywhere in IT. Yes, from time to time there was a bit of a problem. A worm that dug into millions of computers. Or some big company was hit by a hack that did minimal damage.
The problem here is that the damage was simply not high enough to warrant employing people who cost 6 figures a year and can't even guarantee you to be protected against anything that may come your way. Take this highly simplified risk calculation: If your potential damage in case the risk manifests isn't higher than the chance of it manifesting times the cost to mitigate it, it is more sensible to just carry the risk.
And for the longest time, this was the case. Imagine a potential damage of a million bucks per incident. If that happens once every ten years in your company, your annual cost to mitigate must not be higher than 100k. And 100k isn't really much money in ITsec.
If it costs more, you're better off just taking the hit once a decade.
For the longest time this was actually a sensible way to operate. Financially sensible. We've been warning about something like this for years. It was pointless, because the risk never manifested as incidents.
Now the incidents happen.
And now it is too late. We're in too deep to recover. Most of the software and hardware we use cannot be sensibly secured, because, as noted before, security is an afterthought and was not part of the fundamental design. Take HTTPS of all the things. What is it, essentially, but a thin security fig leaf on top of http? And we're still dealing with crucial infrastructure like DNS and DHCP that are by no means secure (not only because they still use a protocol where you can't even sensibly find out who the hell sent the packet in the first place), and while secure replacements exist, their implementation cost too much. Not only because we'd need new hardware.
More importantly, we'd need better trained administrators. Wait, more precisely: We'd need administrators that get at least basic security training. When you see people shrug at you when you tell them that using self signed certs is not ok and you get back a "what's your problem, it IS encrypted, what else do you want?", you know that the person does not even understand what he is doing here. We are critically underprepared for what's coming our way, what we see here is the tip of the spear that's going to hit us right into the chest.
And we will not have the time left to don armor.
Last time they pulled that stunt I think the bid went up to 3 or even 5 bitcoins.
It sounds more like the working title of a Michael Bay movie.
Actually most of the time. Which makes a lot of sense. You get to see the interesting parts of the movie in the trailer so you are excited about it and want to see it.
Unfortunately, and this is why the trailers become spoilers more and more, the interesting parts are also the parts that resolve issues. Movies, especially today, follow a certain logic, a pattern. In the penultimate act, the resolution happens. And this resolution is of course also the culmination, the climax of the whole show. Here, everything happens. And of course this is also the most action-loaded and fastest paced part of the movie.
Prime trailer material.
No! It is not! The perfect trailer material is the act preceding it. The one where the conflict looks like it is heading for a negative resolution, where the villain triumphs. The infamous "night is darkest before the dawn" moment of the movie. THAT is where you have to take the trailer from. It leaves the audience wondering how the hero will turn it around and makes them interested in seeing the resolution.
Remember the cheesy 60s Batman series? The cliffhanger was always them being trapped by the villain-of-the-week. Say what you want about that show, but this was done right!
Take your average movie. Say, anything Michael Bay did lately.
Now spoiler it in any meaningful way. I dare you.
Nearly all mass appeal movies of today are so formulaic and predictable that "spoiler" doesn't really describe the problem. The problem is more that it's "seen one, seen 'em all".
Big explosions and tits.
Come to think of it, why not simply name a movie that way? No trailer needed.
Yes, I would tell you exactly the same. If for no other reason than you hating me for telling you otherwise.
Is it my fault that the robber came in and shot the guy? It's not like I hired him or told him it's a good idea. There's even a sign in the window that it's pointless to rob the store because the clerk can't access the big bucks, they're in a steel box (mostly so the little asshole can't steal from me... I mean, for the cashier's safety, of course).
Lenin was a dilettante, a theoretician without any idea how to handle people. Stalin knew how to handle people and he knew that it's easier to be feared than to be loved.
Both of them wanted power. Killing people was a means to the end, and they didn't care that it happened, for the most part. Stalin's train of reason was that he can either kill these people and be feared for it, or let them starve and be hated for it. Which would you choose?
Then he's an ass that I don't want to work for me. That still makes him someone doing it for money.
And, frankly, anyone who feels the urge to brag about something like that usually only can land that "professionally" too: With women doing it for money.
The point is, what is "good" behaviour that should be copied by the sex not doing it, and what is "bad" behaviour that should be stopped by the sex doing it.
And who gets to set the standard?
A studio is afraid to try something new because a movie costs millions, often hundreds of millions, to make. So they are afraid to try something out of the ordinary and instead rehash the same stuff that once managed to get people into the cinemas, we get reboot after reboot, relaunch after relaunch.
And going to see a movie costs between 10 and 20 bucks a person. So we're afraid to try something that we don't know anything about, fearing that we're going to waste 20 bucks on something we are not going to enjoy.
It's a matter of money. People don't want to waste it on something that's not going to perform the way they would like it to.
'I am not a pleasure unit'
Umm... considering how most of them look, I wholeheartedly agree!
So... women should also not become engineers but men should stop being engineers?
Is there some sort of road map what should be copied and what should be avoided, or is it arbitrary and depending on feelings?
"Professional" only means "doing it for money". Nothing else.
Wait 'til I hold my fingers under your nose after wiping my little darling's ass and ask you whether you think that smells more like the results of milk or the oatmeal.
Hey! When you call me and force me to get to work at 7am, you get what you get!
So, in other words, the opportunity to grab someone by the pussy makes you less likely to talk about it?
If only the prez had known...
The difference is that you don't need to shake it, you'll acquire the shakes after a while anyway.
So... we get exciting news every day now?
Tobacco is legal because there are already too many addicts to simply outlaw it right away without serious repercussions. I.e. criminalizing a sizable portion of the population with the ensuing social problems. If you want to know which, look no further back than prohibition times.
When everyone breaks the law, the law becomes meaningless.
Nazi Germany didn't consider the Jews "their" subjects. Soviet Russia and Pol Pots Cambodia didn't do it secretly but instead very openly and publicly to instill fear.
How expensive is it to replace the cashier?
Exactly.