Well, I don't want to get on the capital E - engineering tangent regarding software. But yeah, agreed on that. In most cases, we have been vibe engineering software this whole time.

Tangent aside, entropy favors the attacker even in the case of a building that has PE stamps on the plans and passes all codes at time of construction. Just leave it alone for a while with no maintenance, it will fall. Or, hire one man to correctly place charges. Far less work than what it took to build it.

edit: I want to make clear that what amazes me is how hard we fight entropy. We have built fragile societies, fragile technologies, we ourselves are fragile. And yet, humans are generally pretty cool and choose not to destroy all of these things, though we do have a few assholes amongst us.

In the physical sense, entropy favors the attacker because destroying something is just helping it along the path it wants to take. Everything wants to turn into dust, all the time. It takes energy to prevent it from happening. The attacker can use significantly less energy to get it moving.

Consider the energy requirements to construct a skyscraper compared to the energy requirements to demolish one.

“It’s easy to destroy a building than to build one” is still true, building codes or not.

I mean for just the EU you have:

Digital Operational Resilience Act (DORA) and Cyber Resilience Act (CRA) which enforce mandatory governance and processes like resilience testing and cybersecurity lifecycle requirements.

GDPR & Data Protection frameworks which requires architecture to support CRUD operations on all PII, data minimization, customer-managed encryption architectures and so forth.

...and the anti-vibe code framework aka the EU AI Act, which requires human oversight and data quality controls.

This is completely aside from any industry specific engineering codes like in Finance where you have to adhere to things like ISO 20022 or iXBRL/ESEF standards, user accessibility mandates, and PCI Compliance mandates for things like Security Architecture over and above the CRA.

> It is not a base truth.

When you operate in an environment where every "good boy" can be wiped by a single "oh shit", statistics are against you. That is a base truth. The failure can rest on negligence but negligence isn't a necessary component for failure. For attackers their failures are wiped by a single success, for defenders their successes are wiped by a single failure.

In a different life I worked on designing and implementing similar systems to the ones you described, except with even more money going through them. They can can still be hacked, at incredible expense. And the hackers could even make a huge profit with the treasure trove they have access to. But getting away with it is orders of magnitude more difficult than the hack. The money involved to make the hack profitable is impossible to hide on the world stage. It takes a lot of political capital and military to be able to steal billions+++ and get away with it (nation state attackers, not just a group of hackers). So hackers go for lower risk jobs where the payout can even be similar just because of the lower cost to succeed.

Per the IRA after an unsuccessful attempt to assassinate Thatcher, "Today we were unlucky, but remember we have only to be lucky once, you will have to be lucky always."

Yeah but you know there trade offs like free society, freedom of movement, privacy and stuff that you need to sacrifice to take advantage of home turf. And you need to do this everywhere. Attacker can pick his targets on his own schedule, you need to defend always.

One of the most spectacular pieces of self-own for the current administration. Restructuring/deleting the directorate for biodefense during the previous administration (of the same color) would be up there.

> 18F was completely eliminated

18F -> https://ndstudio.gov

As seen credited on recent publications like real realfood.gov.

ah. No idea.

> it seems they want criminals to make $0 so they stop doing that

And yet arguably the criminals are unwittingly performing a useful public service we might describe as involuntary pentesting with a financial penalty on failure. The ethical way to get rid of the criminals in this scenario is to institute competent regulation (ie not mindless box ticking) and enforcement.

Hypothetically we are all arguably better off with a ransomware attack if the alternative is a cyberattack by a geopolitical adversary at a later date.

Yeah but you're proposing a trolley problem where we kill the five people on the other track so the single guy on the track can't have nice clothes lol.

Or we pay the criminals, not let innocent people die because turbo nerds care about rewarding cyber criminals who will exist no matter what.

So I guess we should just let people die though, atleast the feds will have jobs and be able to go on vacation and not those damn criminals!! Although I fail to see much difference between US law enforcement and cyber criminals, both of their existence relies on the threat of violance and the extortion of the public with that violence.

Also I'm pretty sure the FBI gave birth to the shiny hunters if you look into it for more than 10 minutes. Its a bunch of kids they basically have chosen not to punish at various points in their criminal evolution. Its almost like they need these phenomenons to exist.

My ideal society is one without crooked cops, but alas I dont think that's likely either so in the meantime, until we can find a solution to that problem we probably shouldnt punish the innocent patients of hospitals.

It seems to me that money and the status of criminals is more important to you than human life, so we should probably deal with whatever brain worm has infected you too.

Alternately they may not believe starving out the criminals will actually work and so foresee different consequences. Like when Google penalized SEO, and so spammers used their networks for extortion instead of spam. Similarly if we killed ransomware, the machinery built to conduct these attacks would not just lie fallow. It's capital that will continue to be leveraged to generate returns. We may not like the next business model they come up with.

It's not a contest, we all can care and think deeply and still come to different conclusions.

Even if it was a loved one of yours who was in danger? You would rather your children, parents, or spouse die, instead of paying the kidnappers a ransom?

And a new method is invented in about 24 hrs.

Who cares if criminals have nice things, Id rather innocent people dont die. Most criminals tend to find ways to ruin their own lives at some point anyways. Peoples lives > pieces of paper.

Its like you're proposing a trolly problem where you choose the 5 people on a track to die because you don't want the single guy on a track to have nice clothes.