Cyber Security: A pre-war reality check

Original Article ↗ Hacker News Discussion ↗

Growing reliance on centralized, networked systems—from public clouds and GPS to outsourced telecom and rail control—has left critical infrastructure fragile in the face of state-level cyber threats. Commenters argue that Western governments and large firms have optimized for cost and convenience over resilience, creating “insecurity industries” that sell protection rather than true robustness. Drawing lessons from Ukraine, aviation, healthcare, and energy, they call for simpler, more redundant designs, local control of key systems, and long‑term political will rather than reactive regulation or faith in tech giants.

Security vs. Protection & Resilience

  • Several comments stress a distinction between:
    • Security as robustness, graceful degradation, and “carefree ease” from practice.
    • Protection as products and services that create dependency and a feeling of safety without real resilience.
  • The current “insecurity industry” is criticized as selling protection layers instead of addressing root causes or simplifying systems.

Centralization, Outsourcing, and Cloud

  • Heavy outsourcing (India, China, big US clouds) is seen as hollowing out local operational competence and creating single points of failure.
  • Others argue outsourcing and centralization follow comparative advantage and often improve average security and uptime, though they increase blast radius when failures occur.
  • There is support for more regional or “friendly” cloud providers and data sovereignty, especially in Europe.

Critical Infrastructure & GPS Dependence

  • Multiple examples of fragile dependencies:
    • Trains and aviation increasingly relying on GPS; rail projects aiming to replace trackside equipment with GNSS.
    • Farmers and hospitals disrupted when GPS or IT systems fail.
    • Attacks on pipelines, healthcare providers, and telcos showing real-world impact.
  • Counterpoint: sectors like aviation and rail still maintain legacy systems (VOR, DME, track circuits, tokens) and are adding hybrid solutions, not pure GPS.

War, Ukraine, and “Pre‑War Era” Framing

  • Some see Ukraine as proof that cyberwar has been less catastrophic than feared; infrastructure largely functions.
  • Others note:
    • Prior Russian cyberattacks (e.g., NotPetya) caused global collateral damage.
    • Ukraine’s resilience rests on years of hardening and extremely risky repair work.
  • Debate over how much Western policy (NATO expansion, intelligence integration) contributed to the current war climate; views are sharply divided.

Complexity, Simplicity, and Secure Design

  • Strong agreement that complexity is the enemy of both reliability and security.
  • Suggestions:
    • Smaller, simpler stacks (e.g., minimalist OSes, simple databases).
    • Defense in depth, offline fallbacks, and independent local controls.
  • Skepticism that “just rewrite it smaller” works: even small C++ projects quickly accumulate serious bugs; patching and user updates remain hard.

Deterrence, Offensive Cyber, and MAD

  • Some speculate major powers hold large stocks of zero‑days and that there is a de facto “mutually assured destruction” in cyber.
  • Others question this, pointing out limited destructive cyber use in Ukraine if such capabilities truly existed.
  • A few suggest Western offensive capability is likely strong but deliberately under‑discussed.

Economics, Regulation, and Incentives

  • Core problem framed as misaligned incentives:
    • Security spending seen as a cost center; retrofitting is very expensive.
    • Cloud and centralization optimize short‑term cost and convenience.
  • Ideas floated:
    • Hefty fines for breaches and critical 0‑days to change vendor behavior.
    • Education and autonomous systems complementing, not replacing, regulation.

Personal and Organizational Experiences

  • Several anecdotes describe:
    • Soul‑crushing experiences in highly outsourced “nationally important” companies.
    • Being sidelined or pushed out after raising security concerns.
    • Difficulty finding security‑conscious work, and worries this might push some toward “black hat” paths.
  • Broad frustration that organizations optimize for quarterly costs and visible features, not long‑term resilience.