Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 17 submissions in the queue.
posted by n1 on Tuesday June 02 2015, @04:04AM   Printer-friendly
from the dr.-spin dept.

Cindy Cohn writes at EFF that when a criminal started lacing Tylenol capsules with cyanide in 1982, Johnson & Johnson quickly sprang into action to ensure consumer safety. It increased its internal production controls, recalled the capsules, offered an exchange for tablets, and within two months started using triple-seal tamper-resistant packaging. Congress ultimately passed an anti-tampering law but the focus of the response from both the private and the public sector was on ensuring that consumers remained safe and secure, rather than on catching the perpetrator. Indeed, the person who did the tampering was never caught.

According to Cohn the story of the Tylenol murders comes to mind as Congress considers the latest cybersecurity and data breach bills. To folks who understand computer security and networks, it's plain that the key problem are our vulnerable infrastructure and weak computer security, much like the vulnerabilities in Johnson & Johnson's supply chain in the 1980s. As then, the failure to secure our networks, the services we rely upon, and our individual computers makes it easy for bad actors to step in and "poison" our information. The way forward is clear: We need better incentives for companies who store our data to keep it secure. "Yet none of the proposals now in Congress are aimed at actually increasing the safety of our data. Instead, the focus is on "information sharing," a euphemism for more surveillance of users and networks," writes Cohn. "These bills are not only wrongheaded, they seem to be a cynical ploy to use the very real problems of cybersecurity to advance a surveillance agenda, rather than to actually take steps to make people safer." Congress could step in and encourage real security for users—by creating incentives for greater security, a greater downside for companies that fail to do so and by rewarding those companies who make the effort to develop stronger security. "It's as if the answer for Americans after the Tylenol incident was not to put on tamper-evident seals, or increase the security of the supply chain, but only to require Tylenol to "share" its customer lists with the government and with the folks over at Bayer aspirin," concludes Cohn. "We wouldn't have stood for such a wrongheaded response in 1982, and we shouldn't do so now."


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by MichaelDavidCrawford on Tuesday June 02 2015, @04:39AM

    by MichaelDavidCrawford (2339) Subscriber Badge <mdcrawford@gmail.com> on Tuesday June 02 2015, @04:39AM (#191026) Homepage Journal

    Canada does. A computer science degree doesn't suffice; one requires a software engineering degree. That's quite a different thing.

    I was once employed by HMI/SCADA vendor Trihedral Engineering. Despite that my job title was "Computer Programmer" I repeatedly referred to my team as "the engineers". That caused lots of confusion as only the industrial control systems engineers were known as "the engineers". My point was that if we were developing HMI/SCADA code then we were engineers, even if we didn't want to be.

    From time to time the requirement for an engineering license is floated in some US state then quickly shot down, because that would prevent high school kids from calling themselves software engineers just because they happened to read Learn Java in 21 Days. I agreed with that at first but then came to realize the considerable economic loss of faulty software - not just security holes but also poor usability, loss of end-user data and so on - and now strongly support licensing.

    On my own website I call myself a "Consulting Software Engineer". While I don't have a license I regard myself as being just as qualified as someone who does have a license.

    --
    Yes I Have No Bananas. [gofundme.com]
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 0) by Anonymous Coward on Tuesday June 02 2015, @04:57AM

    by Anonymous Coward on Tuesday June 02 2015, @04:57AM (#191034)

    Anyone who has at any time been diagnosed with a mental illness of any kind shall have their computer operators revoked permanently. Bye bye now Michael. You are gone forever.

    See the trouble with advocating raising the bar for entry is someone will eventually raise it higher than you can reach.

    • (Score: 3, Funny) by MichaelDavidCrawford on Tuesday June 02 2015, @05:32AM

      by MichaelDavidCrawford (2339) Subscriber Badge <mdcrawford@gmail.com> on Tuesday June 02 2015, @05:32AM (#191040) Homepage Journal

      I have a close friend who has a professional civil engineering license. While he has to work hard to stay current on his license, the requirements are quite reasonable considering the loss of life that would result were he to screw up. But the bar is not raised so high he cannot reach it.

      It's quite difficult to get a medical license but even so it is not impossible.

      I've met numerous mentally ill mental health professionals.

      --
      Yes I Have No Bananas. [gofundme.com]
      • (Score: 1, Troll) by frojack on Tuesday June 02 2015, @05:53AM

        by frojack (1554) on Tuesday June 02 2015, @05:53AM (#191048) Journal

        I've met numerous mentally ill mental health professionals.

        And they all seem to be with you posting in this thread.....!

        Quick, Michael, back on your meds before the place is overrun!

        --
        No, you are mistaken. I've always had this sig.
        • (Score: 0) by Anonymous Coward on Tuesday June 02 2015, @06:00AM

          by Anonymous Coward on Tuesday June 02 2015, @06:00AM (#191050)

          Oh no I mixed too much homemade laxative. Don't make me spam the shit onto your fucking precious thread.

        • (Score: 2) by MichaelDavidCrawford on Wednesday June 03 2015, @01:13AM

          by MichaelDavidCrawford (2339) Subscriber Badge <mdcrawford@gmail.com> on Wednesday June 03 2015, @01:13AM (#191367) Homepage Journal

          this has been well-documented for decades. The easy way to demonstrate this is to look at the incidence of suicide by profession; psychologists commit suicide far out of proportion to the general public.

          I've met two psychiatric hospital patients who were also practicing psychotherapists - that I know about. Perhaps there were others who didn't tell me the nature of their jobs.

          The reasons behind this phenomenon were first elucidated by Swiss Child Psychologist Alice Miller in The Drama of the Gifted Child. I once mentioned the book to a therapist; she replied "I cried all the way through it".

          tl;dr: The best shrink are commonly the survivors of profound child abuse.

          --
          Yes I Have No Bananas. [gofundme.com]
          • (Score: 2) by frojack on Wednesday June 03 2015, @08:01PM

            by frojack (1554) on Wednesday June 03 2015, @08:01PM (#191753) Journal

            Dentists have one of the highest suicide rate of any profession.
            No doubt due to childhood cavities.

            --
            No, you are mistaken. I've always had this sig.
      • (Score: 0) by Anonymous Coward on Tuesday June 02 2015, @05:53AM

        by Anonymous Coward on Tuesday June 02 2015, @05:53AM (#191049)

        I've met numerous mentally ill mental health professionals.

        Jesus Christ! "Thou hypocrite, first cast out the beam out of thine own eye; and then shalt thou see clearly to cast out the mote out of thy brother's eye."

      • (Score: 4, Funny) by tibman on Tuesday June 02 2015, @06:05AM

        by tibman (134) Subscriber Badge on Tuesday June 02 2015, @06:05AM (#191053)

        I've met numerous mentally ill mental health professionals.

        Sounds contagious.

        --
        SN won't survive on lurkers alone. Write comments.
        • (Score: 3, Informative) by MichaelDavidCrawford on Wednesday June 03 2015, @01:24AM

          by MichaelDavidCrawford (2339) Subscriber Badge <mdcrawford@gmail.com> on Wednesday June 03 2015, @01:24AM (#191374) Homepage Journal

          not by spreading germs through the air. Ever heard the expression "break the cycle"? It is quite common for mental illnesses to run in families, for the most part due to the children of child abusers going on the abuse their own children.

          It's also well documented that some mental illnesses are genetically inherited; this can be shown from studies of twins who have been adopted to different families.

          There is a correllation between adult schizophrenia and exposure to cats as a child. While not proven this is thought to be due to the same cat feces parasite as causes toxoplasmosis among pregnant women. there is also some reason to believe that adult schizophrenia can result from one's mother contracting influenza during one's gestation.

          --
          Yes I Have No Bananas. [gofundme.com]
  • (Score: 0) by Anonymous Coward on Tuesday June 02 2015, @05:11AM

    by Anonymous Coward on Tuesday June 02 2015, @05:11AM (#191037)

    Dan would later learn that there was a time when anyone could have debugging tools. There were even free debugging tools available on CD or downloadable over the net. But ordinary users started using them to bypass copyright monitors, and eventually a judge ruled that this had become their principal use in actual practice. This meant they were illegal; the debuggers' developers were sent to prison.

    Programmers still needed debugging tools, of course, but debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers. The debugger Dan used in software class was kept behind a special firewall so that it could be used only for class exercises.

    It was also possible to bypass the copyright monitors by installing a modified system kernel. Dan would eventually find out about the free kernels, even entire free operating systems, that had existed around the turn of the century. But not only were they illegal, like debuggers—you could not install one if you had one, without knowing your computer's root password. And neither the FBI nor Microsoft Support would tell you that.

    The Right to Read [gnu.org]

    Why do you hate freedom, MichaelDavidHitler?

    • (Score: 0) by Anonymous Coward on Tuesday June 02 2015, @05:17AM

      by Anonymous Coward on Tuesday June 02 2015, @05:17AM (#191039)

      I'm gonna invade my own Pole-Land with Blackjack and Hookers!

    • (Score: 2) by MichaelDavidCrawford on Tuesday June 02 2015, @05:34AM

      by MichaelDavidCrawford (2339) Subscriber Badge <mdcrawford@gmail.com> on Tuesday June 02 2015, @05:34AM (#191042) Homepage Journal

      I assert that software engineering should require licensing. While closely related computer programming and software engineering are distinctly different practices.

      --
      Yes I Have No Bananas. [gofundme.com]
      • (Score: 2) by c0lo on Tuesday June 02 2015, @06:33AM

        by c0lo (156) Subscriber Badge on Tuesday June 02 2015, @06:33AM (#191055) Journal

        I assert that software engineering should require licensing.

        I tend to agree.

        The tertiary education in country I came from used to have 3 degrees that closely relate to computers:

        1. computer science - taught in Uni, Maths faculty. You'll know structures/parsing-lexing/complexity/type theory/symbolic calculus/algo decidability/etc inside out. If you want a master, prepare yourself to dig some obscure theorems of formal equivalence of quantum computing algos, but they'd make the worst hires if you wanted to develop a business app/system
        2. computer engineering - a degree in engineering schools, starts with formal logic implemented on gates, passes through data structures with a bit of complexity sprinkled around, some deeper touches on programming languages (procedural, OO, functional, low level such as MIX/ASM/Forth), a good chunk of operating systems/DBMS and related problems (handling concurrency is a deliciously hard course), then you choose to major either toward the electrical part of it (system engineering/automation/CAD/CAM) or software practice (development life cycles, quality systems, maybe a bit of project management)
        3. cyber-economics - business schools degree, all that touches business optimisation (minmax, linear/nonlinear/discrete optimisation, floor planning, financial planning, risk modelling, etc)

        Slipping through the fingers would have been the numerical methods (e.g. ODE, physics modelling), each of the above + physics would scratch the surface, but only just.

        --
        https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
        • (Score: 2) by MichaelDavidCrawford on Wednesday June 03 2015, @01:20AM

          by MichaelDavidCrawford (2339) Subscriber Badge <mdcrawford@gmail.com> on Wednesday June 03 2015, @01:20AM (#191373) Homepage Journal

          UCSC offers both CS and CE degrees. The Computer Engineers learn stuff like how to write a mouse driver. The CS majors do stuff like learn how to prove that you can't do any better than O(n lg(n) ) when sorting. (Well sorta - there are special cases in which you can do better.)

          I don't know either way whether UCSC offers software engineering, but carnegie mellon sure does. Watts Humphrey got a medal from Dubya for his contributions to the profession. I find the SEI's methods a little too tedious for my personal style but I can see the point of it when bugs lead to things exploding.

          There are lots of places where CS students can learn stuff like operating system development. However the way I usually explain the difference is that a Computer Scientist will figure out how to make something work, while a Software Engineer will create something that works correctly.

          It upsets me profoundly that the term "complexity" is commonly taken to mean the asymptotic growth in runtime for an algorithm, sometimes the algorithmic growth in complexity.

          IMHO the term "complexity" should denote the probability that an average coder will implement the algorithm correctly.

          --
          Yes I Have No Bananas. [gofundme.com]
    • (Score: 2) by MichaelDavidCrawford on Tuesday June 02 2015, @05:48AM

      by MichaelDavidCrawford (2339) Subscriber Badge <mdcrawford@gmail.com> on Tuesday June 02 2015, @05:48AM (#191046) Homepage Journal

      I actually worked in a shop like that once. It was originally set up to keep the internet out but then the company owner realized it would keep his employees from stealing the source.

      We each had two windows boxen. One was connected to the internet, the other was inside a locked rackmount, with ethernet kvm units.

      I worked remotely for most of that contract, when I delivered my source the head programmer had to unlock one of the cabinets then copy my source onto the secured box I used. When I returned home he had to copy my source back onto my floppy.

      I wouldn't dream of working full-time in such an environment, but actually they are quite common.

      --
      Yes I Have No Bananas. [gofundme.com]
  • (Score: 0) by Anonymous Coward on Tuesday June 02 2015, @01:11PM

    by Anonymous Coward on Tuesday June 02 2015, @01:11PM (#191123)

    Meaning what? People wouldn't be able to get a programming job without a degree? What actual impact would this have besides what someone is allowed to call themselves?