General Politics Thread

Status
Not open for further replies.
I do not get how this happens these days. Spinning rust is really cheap, and file systems that do not overwrite stuff, just mark it as old exist (journaling file systems, but there is a special word for the correct ones). If your data has any value it should be on something like that, and it is just a case of reverting to an old version and go from there.

That might be useful for getting back accounts and correspondence.
Settings for valves, pressure vessels, pipes, cooling systems etc etc is not something that you can get from a backup. :)

Zero-day exploits that are known by US 3LA organizations and used against their "targets" is a hazard that's not easily overcome.

And my favourite...
Despite the concerns of some engineers, SMCS-NG was created as a port to Microsoft Windows of the SMCS infrastructure and applications, a move which some commentators have termed "Windows for Warships".
https://en.wikipedia.org/wiki/Submarine_Command_System
 
That might be useful for getting back accounts and correspondence.
Settings for valves, pressure vessels, pipes, cooling systems etc etc is not something that you can get from a backup. :)

Zero-day exploits that are known by US 3LA organizations and used against their "targets" is a hazard that's not easily overcome.

And my favourite...
Despite the concerns of some engineers, SMCS-NG was created as a port to Microsoft Windows of the SMCS infrastructure and applications, a move which some commentators have termed "Windows for Warships".
https://en.wikipedia.org/wiki/Submarine_Command_System
I am no expert, but you totally can get anything that was ever written to the drive. You can revert the state of the storage to any point in the past, and the disk looks exactly like it did then to any operating system accessing the storage. If the ransomware could encrypt it, the storage system can get it back.
 
I am no expert, but you totally can get anything that was ever written to the drive. You can revert the state of the storage to any point in the past, and the disk looks exactly like it did then to any operating system accessing the storage. If the ransomware could encrypt it, the storage system can get it back.
Yep, you can get the data back, but it doesn't necessarily apply to the current state of a complex system like a chemical plant, oil refinery, sewage works, etc.
 
I do not get how this happens these days. Spinning rust is really cheap, and file systems that do not overwrite stuff, just mark it as old exist (journaling file systems, but there is a special word for the correct ones). If your data has any value it should be on something like that, and it is just a case of reverting to an old version and go from there.
As I understand it (no links on me, I came across them a coupla days ago on social media unfortunately) the company was relying on its own backups. Apparently even once they'd paid the ransom they were still relying on their own backups as the decryption provided by the hackers wasn't good enough? Or something like that.

The problem is the cost in time more than anything else. I can understand that. If we had to take a production database down for even half an hour, for any reason, that would be significant regional / global disruption to our product. Anything that impacts a live service is costing the company in its bottom line regardless of how well backed-up the instance is.
 
As I understand it (no links on me, I came across them a coupla days ago on social media unfortunately) the company was relying on its own backups. Apparently even once they'd paid the ransom they were still relying on their own backups as the decryption provided by the hackers wasn't good enough? Or something like that.

The problem is the cost in time more than anything else. I can understand that. If we had to take a production database down for even half an hour, for any reason, that would be significant regional / global disruption to our product. Anything that impacts a live service is costing the company in its bottom line regardless of how well backed-up the instance is.
I get this, but at some point, presumably in the last decade, that had to make a decision about the storage solution to buy. They must have had a journaling solution on the list of possibilities. They must have rejected it (or they would not have paid the ransom). Why would anyone make that decision in this day and age?
 
I get this, but at some point, presumably in the last decade, that had to make a decision about the storage solution to buy. They must have had a journaling solution on the list of possibilities. They must have rejected it (or they would not have paid the ransom). Why would anyone make that decision in this day and age?

You've almost got it, Samson. So close!

You cannot buy security. And definitely not at the price MBA's advise their companies, or by hiring recent graduates from overseas because they're cheap.
You get security.
 
I get this, but at some point, presumably in the last decade, that had to make a decision about the storage solution to buy. They must have had a journaling solution on the list of possibilities. They must have rejected it (or they would not have paid the ransom). Why would anyone make that decision in this day and age?
They could have whatever solution or backup strategy they want. The problem is from the time of ransom to the restoration of any service, via any backup strategy or solution. That's the cost.

Of course, this doesn't mean companies make the best decisions with the money they have. Frequently when it comes to infosec they don't :D

That said, journaling in of itself isn't a catch-all. And if you're rolling a known vendor (say, O365 for email), you're susceptible to the limits and drawbacks of that vendor. This is a pretty technical read from Microsoft that mostly goes over my head, but explains how journaled emails still come with dangers r.e. malware (separate to the ransomware discussion for a second, more to demonstrate the complexity in layering solutions on top of each other to present a coherent and cohesive security system).
 
They could have whatever solution or backup strategy they want. The problem is from the time of ransom to the restoration of any service, via any backup strategy or solution. That's the cost.

Of course, this doesn't mean companies make the best decisions with the money they have. Frequently when it comes to infosec they don't :D

That said, journaling in of itself isn't a catch-all. And if you're rolling a known vendor (say, O365 for email), you're susceptible to the limits and drawbacks of that vendor. This is a pretty technical read from Microsoft that mostly goes over my head, but explains how journaled emails still come with dangers r.e. malware (separate to the ransomware discussion for a second, more to demonstrate the complexity in layering solutions on top of each other to present a coherent and cohesive security system).
Yeah. I guess my point is that if everyone who had valuable data used a journaling filesystem ransomware would not exist, as no one would have any reason to pay the ransom. It would not solve all security related problems, that is for sure.
 
Yeah. I guess my point is that if everyone who had valuable data used a journaling filesystem ransomware would not exist, as no one would have any reason to pay the ransom. It would not solve all security related problems, that is for sure.
I don't think that's enough, unfortunately. You could bring the system back online quicker, but it may also be beneficial (especially politically within a company) to pay the ransom to get access back via decryption.

I also believe ransomware intentionally doesn't try and target behemoths like Google, or whomever. Looking at a brief history of attacks they tangled with Greek banks, for example. These kinds of targets are less likely to be capable of having robust solutions in place in the first place.

Maybe we'll see this change going forwards.
 
some blog has people who comment that the pipeline was always fit to work but the company would not be paid money for a while , so that's why they stopped , and probably paid for the ransom for money flow because going for the pipeline would naturally justify America to do the same to Russian pipelines .
 
Mississippi, USA: Article 15, Section 273 of the state constitution establishes that, "The people reserve unto themselves the power to propose and enact constitutional amendments by initiative. An initiative to amend the Constitution may be proposed by a petition signed over a twelve-month period by qualified electors[...]"

Now here's the important part: "The signatures of the qualified electors from any congressional district shall not exceed one-fifth (1/5) of the total number of signatures required to qualify an initiative petition for placement upon the ballot."

Stick with me here, because this is really mind-bendingly stupid: Since 2000, there are only four congressional districts in Mississippi.

An amendment that passed with 60% of the vote last Fall is being struck down by the state's Supreme Court for not following procedure in gathering the signatures needed to get on the ballot. American democracy in action, folks. :thumbsup:
 
Now you‘re making us do maths.... Having gone through it, yes, that‘s very stupid. And what‘s the reasoning behind regulating where in the state the signatures come from? In the end, it‘s the whole electorate anyways that decides upon it. Just being on the ballot doesn‘t give an advantage. That‘s just not a good faith rule, but one of suppression. And rules like that are what endanger democracy as they remove the level-playing field, the idea of „all citizens are treated equally“.
 
I kind of see some logic in the principle of having the signatures "balanced" when it applies to an amendment that would apply across the whole state; yes, people do vote up-or-down at the ballot box but you're not going to have turnout that always reflects the public at large. Neither here nor there stuff.

Reading up on Mississippi's referendum-amendment process, the state court doesn't have appeared to overturn either of the amendments passed by referendum since redistricting eliminated the fifth House district. Furthermore, the American Medical Association filed an amicus brief in support of the lawsuit that led to the overturning of the referendum's legality. Interesting to me, I thought they'd be against woo and nonsense.
 
I kind of see some logic in the principle of having the signatures "balanced" when it applies to an amendment that would apply across the whole state; yes, people do vote up-or-down at the ballot box but you're not going to have turnout that always reflects the public at large. Neither here nor there stuff.

Voting is a right, not a duty. If you apply your thought for example also to elections, then who is really legitimised by the voters? You can always say: "Only xy % voted". The idea behind representation is a myth, (specific group) mobilization will always matter. You can make voting mandatory, but then you will have many "random" votes ("I just want to get this over with so that I can go back to partying"). Also, isn't the trend in the US to make it more difficult to vote? So... ;-)

Lastly, the electorate always will have to decide for the non-electorate (basically people under 18, non citizen inhabitants and for some reason in the US people in prison), so why do the inhabitants of other districts get that special veto protection - while the youth for example doesn't?

I could understand if you'd have a minimum requirement (say of 40k needed signatures over 4 districts, every district must provide at least 4k), but equal distribution? Very hard to do, it's as if they don't want those initiatives to succeed. ;-)
 
Voting is a right, not a duty. If you apply your thought for example also to elections, then who is really legitimised by the voters? You can always say: "Only xy % voted". The idea behind representation is a myth, (specific group) mobilization will always matter. You can make voting mandatory, but then you will have many "random" votes ("I just want to get this over with so that I can go back to partying"). Also, isn't the trend in the US to make it more difficult to vote? So... ;-)

Lastly, the electorate always will have to decide for the non-electorate (basically people under 18, non citizen inhabitants and for some reason in the US people in prison), so why do the inhabitants of other districts get that special veto protection - while the youth for example doesn't?

I could understand if you'd have a minimum requirement (say of 40k needed signatures over 4 districts, every district must provide at least 4k), but equal distribution? Very hard to do, it's as if they don't want those initiatives to succeed. ;-)
I may well be naive, but I assumed the rule was put in place many years ago, when there were enough districts that it would amount to something like your last sentence. But this is Mississippi, so perhaps it was always designed to block these initiatives.
 
@mitsho I was thinking just that one heavily-populated area of a state can't force referenda as an intended consequence of the law, which seems fair to me within a single state. The Mississippi Constitution also states that a sponsor of a referendum needs to submit petitions "signed over a twelve-month period by qualified electors equal in number to at least twelve percent (12%) of the votes for all candidates for Governor in the last gubernatorial election."

Reading further into the Constitution, I found that in 1978 there was a referendum that repealed Mississippi's constitutional ban on dueling. The measure to repeal passed 219,196 to 71,194.
 
The amount of signatures needed is a clever way of making it correspond to the population size without having to rely on the population statistics that you Americans so dislike. :)

Yeah, I get it and it's okay, I'm just saying you can put in these kinds of geographical requirements in the vote itself, not in what gets on the ballot. The difference is about gatekeeping and reduces the amount of topics that are discussed publically (which is good for the tradition-minded people) whereas for me, it would be important to discuss these proposals. If they don't want them - fine, but you have to admit it (f.e. that you are against abortion rights). Again, I am not too passionate about that - it just was a good distraction right now.
 
The difference is about gatekeeping and reduces the amount of topics that are discussed publically
It furthermore states in the amendment that up to five referenda may be submitted, and the first five that meet the limits set by the state and are respectively certified appear on the ballot. I think it's wholly reasonable to have some requirements so that frivolous amendments aren't added to the state's ballot.
 
The Great Firewall of . . . Canada?

By Ian Cooper
Toronto

Prime Minister Justin Trudeau has a plan to regulate speech on the internet by placing it under the control of the Canadian Radio-television and Telecommunications Commission. His bill is so awful that Peter Menzies, a former vice chairman of the commission, said it “doesn’t just infringe on free expression, it constitutes a full-blown assault upon it and, through it, the foundations of democracy.”

Mr. Trudeau’s Liberals claim they merely want to level the playing field between traditional broadcasters and online players such as Netflix and Spotify. Yet on its face the bill goes much further.

To begin with, anyone who makes programs available over the internet would be treated as a broadcaster and under the thumb of the CRTC. While websites wouldn’t need a formal license to operate in Canada, the commission would have open-ended power to impose conditions and require them to “make expenditures to support the Canadian broadcasting system.” Who has to do this and how much do they have to spend? They’ll tell us later.

The legislation also vaguely alludes to the need for the Canadian broadcasting system to “serve the interests of Canadians of diverse ethnocultural backgrounds.” Again, who’d have to do this and what they’d have to do is anyone’s guess.

Steven Guilbeault, whose Ministry of Canadian Heritage oversees the CRTC, has struggled to shed any light on how the measure would work. For a time the bill included specific exemptions for user-generated content. But then this provision was scrapped—a move that was considered essential to capture sites like YouTube, but also because the government claimed the exemption was already addressed elsewhere. It wasn’t.

Then it was only “professional” content that would be regulated; users themselves would be exempt. Except users with a large following who were acting like broadcasters. Or, as Mr. Guilbeault later clarified, not “an individual—a person— who uses social media.” If you have trouble following that, you’re not alone. Before entering politics in 2019, Mr. Guilbeault spent his entire career as an environmental activist. Like many members of the Trudeau cabinet, he has no prior experience in the area of government he oversees. What he lacks in expertise, however, he makes up for in enthusiasm. Having concluded that Trudeau’s government has a sweeping plan to control the internet.

Canada’s hate speech laws aren’t doing a good enough job to police “hurtful” comments online, for instance, he is working on another bill setting up yet another regulator to tackle online harms.

Granting bureaucrats the power, for example, to require YouTube to silence Jordan Peterson, fine Spotify for something Joe Rogan says on a podcast, or impose on independent podcasters such as Sam Harris an obligation to contribute to the production of Canadian content is as dangerous as it is absurd. More likely, harassed independent voices would simply geoblock their content to avoid the headache of dealing with Canada at all—a way for the government to set up a Chinese- style firewall without having to go to the trouble itself.

Mr. Cooper is a Toronto based media lawyer.
 
I think when Canadians fully realize the implications of this, Mr Trudeau might have a riot on his hands. In addition to the opposition parties forcing an election that may very well topple his minority government.
 
Status
Not open for further replies.
Top Bottom