Ok, thanks for that info!Lucane said:
Playstation's Cell processor is a great thing and a powerfull tool. Sony offered it at a very, very cheap price. I was thinking of explaining to you what you can do with Linux + PS3 architecture, but I doubt you'll understand. Let's just say that the people who bought Playstation 3 for the Linux weren't interested in video games.gphjr14 said:
And you do? LOLOLOLOLOLpokepuke said:
From where are you getting that Sony didn't have the proper dedicated staff for security? From the Escapist? That story was debunked. I should know. I debunked it myself. http://www.escapistmagazine.com/news/view/109747-Sony-Sought-Security-Staff-Shortly-After-Shutdownpokepuke said:
If they had proper dedicated security staff, why would they look to bring someone in? Think about it.JDKJ said:
um... touché? No, not really.gphjr14 said:
Yet Sony is on the defensive. The ultimate lesson is for Sony. Hackers doing whatever they want to don't need to learn anything when they can do it so well. That is, unless you think the lesson is that corporations can do whatever the fuck they want, to the detriment of their own customers.
More non-sequitur. It's mostly irrelevant, other than bad business to attack those people and remove features they paid for.
I thought I said to think about it.JDKJ said:
And you think the one position of "Senior Application Security Analyst" they were looking to fill comprised their entire IT security staff? And wasn't but one position among many positions in their IT security team? And the fact that the position's title includes the word "Senior" doesn't suggest to you that it isn't the only Application Security Analyst on staff? And that they, like every other business, don't experience employee turnover and have to refill vacated positions from time to time? And what makes you think that they didn't have to consult extensively with the outside vendor who provided them with what I have to assume is a fairly large IT system?pokepuke said:
That was what your post indicated, not mine.JDKJ said:
Again, refer to your post. You brought up the classified article as if it was evidence of something. Did you happen to forget why you posted it?
No. It doesn't have to mean that at all. It can simply mean a level of experience.
Irrelevant to me. You brought that up, and it's not clear why.
Did you even read my posts? It seems you didn't really understand anything I said. I basically pointed out at they needed outside help and that it is a major issue, and you're here asking why I might think they didn't. And if you're trying to say that the IT setup was given to Sony so it must be completely foreign to them, just where is that angle coming from?
That you think when a position is advertised as "Senior Application Security Analyst," the "Senior" refers not to the position relative to other Application Security Analysts but, rather, "can simply mean a level of experience," tells me that further discussion with you is a waste of my time.pokepuke said:
Except what I said meant it does mean it is relative, just not necessarily to the people already hired by Sony. Duh...JDKJ said:
Okay, I get it. You actually read my post again, for real this time, and realized that almost everything you said was practically in response to your own post, not mine. Now you've ignored every point made and singled out the most useless tidbit from a tangential thing you brought up.
The problem wasn't the security staff or the Apache version. The problem was that PSN was programmed in such a way as to divulge personal information upon a certain set of credentials. There are any number of safeguards Sony could have put in place to deny or limit the damage, such as blocking off IP's demanding more than a few sets of information.JDKJ said:
I can't argue if what Sony did or didn't do was reasonably sufficient to avoid data loss. I don't think anyone can because the totality of what Sony did or didn't do isn't at all clear or of general public knowledge. Moreover, I don't think there's any way to absolutely guarantee that data will be immune to a determined hacker or that it's fair to say that a network doesn't get hacked unless there's "something wrong" with it. There are always going to be vulnerable spots in a system and it is these vulnerabilities that are always going to be subject to exploitation. No security is hack-proof. For example, encryption isn't a guarantee against loss of personal data in a usable form. Encryption merely adds another layer of difficulty to a successful theft of the data. But if the encrypted data can be stolen, it's not a far reach from that point to stealing the means of decrypting the data. Or, alternatively, once having stole it, forcing it through rainbow tables that will eventually decrypt it. But we do know, according to Sony, that the most sensitive data (i.e., the credit card information) was encrypted. All data isn't of equal importance or sensitivity. If my name and birth date are stolen in an uncrypted form, I don't think a thief's doing much damage with that information alone. And encrypting data so as to make theft more difficult also tends to make authorized use to the data more difficult. There's a point at which making the data difficult to access by a hacker creates access and use difficulties for the authorized user. A bank could cement your money in a concrete casing thereby making theft difficult. But doing so will also make it difficult for you to withdraw that money with ease.Veylon said:
