tacosaretasty

You can create a Bitcoin address simply with random data, and since you can transfer Bitcoin without an intermediary it’s trivial to bypass any list of suspect addresses.

Further, you don’t throw a party with a list of people not invited. It’s super ineffective to try to globally block an infinite list of bad.

Fungibility of a currency is actually important for it to be effective as a store of value. If my 1 USD is somehow worth more at the supermarket because it previously was owned by Elon Musk.

That said it’s not entirely impossible to track the source of origin of a Bitcoin transaction. It’s just computationally very expensive. Since you can programmatically create wallets and transactions that can obfuscate the origin of transactions. So by the time the funds reach any exchange the money has changed hands too many times for them to reasonably be able know if the origins of digital coin came from illegal activity. Then, by the time they do know it was stolen the funds are gone.

Here’s the punchline though, since most exchanges do in fact keep records and the blockchain is an immutable list it’s only a matter of time till the software/computing resources adapt.

As someone who works specifically in this subgenera of computer security (ir) I can say a few things that might add to conversation in a meaningful way.

1.) There is a cottage industry in this space that sells kits for these randomware compromises. Everything provided is off the shelf, this is why you’re seeing such an emergence in this space. It’s not that the barrier to exit from a ransomware attack cost decreased (cryptocurrency). The barrier to entry lowered, any jerk can pay a small amount of funds to buy a software kit and instructions on how to do it.

Furthermore this is also why you’re seeing so many public defacement go politically neutral (ironic given the times). It’s simply a relatively lucrative, with a low amount of risk, and only requires the technical aptitude of someone capable of using BitTorrent/Tor/Warez.

2.) Hiring / Managing security teams - unless you’re in technology or selling security as a part of a product you can’t afford a quality team/tools. Most business are trying to optimize their cost centers to maximize their profits. As such most of the time that means it’s a race to the bottom to get them to be “insurable”. Salary + Software is expensive. 500k minimum investment for an meat processing company or whatever is not the easiest pill to swallow.

3.) companies that pay this are not good judges of security talent. They don’t know if the herjavec group really is an effective detection company. They judge almost entirely on feeling. Same with that one fast talking hoodie wearing self proclaimed hacker talking out of their ass.

Not understanding what you’re hiring for also creates friction, since any deviation from the fantasy security hire they imagined will be met with extreme resistance. “I thought they were going to sure up our servers, why do we have to log in on our email every 8 hours now”. Often times when an executive leader does not understand why security trade offs are made they just make the decision themselves (pro tip they’ll accept the risk) and you’ve failed regardless as an employer and employee.

4.) the industry does very little in a practical sense in preparing people for these job functions (with a few exceptions). Security engineers often have technical skills in spades.However, if they don’t understand anything outside of security they are going to fail. Civil Communication/ debate, the ability to navigate political issues, understanding the business etc are actually super important. The biggest tragedy was that someone internally probably saw this coming but couldn’t actually get the messaging across.

When you combine all of these elements you have a confluence of shit. It’s once again getting less expensive to perform a wide attack with little know how intersecting an industry that has yet to course correct.

Do you at least have plans to expose audit and access logs to customers yet?

I’d be sold on their product if they had better security implementation. Company wiki’s are troves of sensitive information and I’m uncomfortable that I have yet to find any central logging on the product.

I wish these things were also taken into account

“Citizens of a particular country who make money are required to pay taxes. News at 11”

Really though are you implying that these employees are all unscrupulously avoiding taxes and trying to use remote work and cryptocurrency to relive their tax burden?

Maybe some people enjoy the space as it’s bleeding edge, fully remote supported and well funded.

I really appreciate your comment, can you tell me how a multi billion dollar publicly traded company is trying to pull an exit scam?

I know HN does not like the crypto community but at a minimum try to follow the community guidelines of productive conversation.

The hypocrisy from Google here is palpable. First this content creator got a strike for showing users how GPG works and now for linking to academic research. On the other hand you have Google project zero who openly publish vulnerability research to the detriment of some software vendors.

You can’t have it both ways and as someone who works in this space I’m pretty upset by this ham fisted approach to censoring content.

I look forward to google becoming the next AOL.

Awesome concept, I’d love to be able to look up a zip code or location to see what performers are being requested where. You then kind of have a backdoor discovery function for both potential fans and artists.

I’d also suggest showcasing a few artists on the homepage so you naturally start diving into the site.

I agree with the top comment mentioning the big challenge will be getting to critical mass as a platform to be really interesting. NGL it’ll probably take a lot of capital. That said it’s a cool project and I wish you success!