We have to turn off the internet until we can figure this out. Seriously. No. Seriously.
Incredibly, included in this giant index of U.S. Internet customer emails were the internal messages for every current and former employee of U.S. Internet (USI).
KrebsOnSecurity forwarded one of (USI CEO) Mr. Carter’s own recent emails to him, along with a request to understand how exactly the company managed to screw things up so spectacularly.
#infosec #fubar
https://krebsonsecurity.com/2024/02/u-s-internet-leaked-years-of-internal-customer-emails/
Let's be clear that "US Internet", a nickel-and-dime ISP in the Midwest, is not "the Internet".
@mcfate It's bad enough. 6500+ businesses and: "Securence counts among its customers dozens of state and local governments, including: nc.gov — the official website of North Carolina; stillwatermn.gov, the website for the city of Stillwater, Minn.; and cityoffrederickmd.gov, the website for the government of Frederick, Md."
Krebs notes the list changes/d on reloads, so they can't get an accurate tally. I think the main point is the existing regulation and oversight (if any?) needs an overhaul.
To be totally honest, I'm not really aware that ISPs are subject to ANY specific "regulation" or "oversight".
Last time I checked, pretty much anyone with the cash could buy a big pipe and call themselves an "ISP".
@mcfate Yeah, I agree; about the most ISPs have to do is retain some logs for LE.
If USI can't manage their ansible playbooks -- might have been the problem -- how's Comcast doing? How do we _know_?
All my ISP needs to know how to do is to connect me to what I tell it do. They don't do my email, they don't do my cloud, all they do is be a dumb, fat pipe.
I PAY for that. It works reliably. Every connection I make is secured, what are they going to "do"?
I don't buy my appliances from my electrician, either.
@mcfate Same. But corporations and local government bean counters do like service bundles.
They should stop liking them and get smarter. Start by paying their IT people better, they'll attract a higher class of drones.
If you pay your own IT people less than your ISP pays theirs, you're asking for trouble, IMO.
@b4cks4w
My point here is that there's no need to "shut down the Internet".
Shut down "US Internet", sure, although I suspect that'll take care of itself.
Yeah, it's bad, for some finite number of customers of this organization. They "chose poorly". It's not an "Internet issue", it's a "crappy company" issue.