The last thing any government will want to deal with is massive irretrievable data loss.

https://www.youtube.com/watch?v=K_FrQnQv0Vw

I had a copy of our code on media in my desk labeled “promotion” and updated it every month. In retrospect someone going through my desk would have assumed blackmail material and been disappointed to find only code.

So they rebuilt it first from first hand proof, then by testimonies, with a period of counter claims available IIRC. For sure there were some false claims, but given the magnitude of the disaster, this is the best solution within that context.

/joking, i'm sure this is not a happy time for whoever is trying to rebuild everything

If the hacker was targeting the erasure of a particular recent transaction, they may well have succeeded. And by deleting numerous others, they have plausible deniability in the subsequent dispute over the property. If you just wipe a record that is related to you, and the manipulation is discovered (which it will be, one way or another), you are part of a narrow circle of suspects.

The dumb thing was the bank was two blocks from the data center and less than eight (six?) from the office so catastrophic events might have hit both or all three. The owner kept a second copy at his house, and that was the only geographically separated copy.

It's even more funny on Reddit when you can see the person who is blaming cronies in his Romania but has posts of him doing some blue-collar work in the Midwest.

Moving from a paper registry at each county clerk (in the US) was a part of the 2008 financial meltdown.

    > backup the attacker can reach is not a backup

A close relative, government employee, was in charge of building a new application. They have nobody in that entire organization of several thousands people that know how to write specifications for an IT application, nobody that knows how to design, test and deploy it. This is because some government employees have decent salaries, but in IT the private sector is paying a lot more, so almost anyone remotely competent is going to the private sector. So in this case an organization of non-IT people had to deal with the contract and all the associated problems - there is no need to guess, it did not go well. That kind of project could have been done properly with ~ 10% of the budget in the same timeline.

I have a friend that worked as a developer in such a government IT project. The project cost was ~ 5-10 times what was worth, a chain of sub-contractors did the work, less than ten competent people doing the project, charged by the bid winner for over 100 people and actual staff was around 70 at most, for a short period of time.

Both projects above are in Romania. Lack of competent people in the projects, especially in decision roles, was the main problem.

Blizzard gave hardware tokens out to the entire convention one year. Smart phones became a variable not long after and then they didn’t make them mandatory but game guilds almost universally did. Especially for officers.

> Sources told Risky Business that the hacker entered using valid credentials

Permissions inside the database should be segregated. The credential used by the webserver should not have enough permissions to DROP DATABASE. Just the appropriate selects/updates/inserts.

Likewise, if you are storing backups on the same network (as opposed to a tape backup), network permissions should allow writes/creates but not deletes.

This proclamation, coming from a governmental organization, makes me afraid they are doomed. Effectively they are saying they are fixing the mistake by repeating it.

What they should do is admit fault. Freeze the system. Get independent expert help.

Best wishes, recent Romanian land buyers and sellers

Edit: thank you @cbg0 for giving us this update

It is a poor idea to use blockchain for government registries. If you want transparency, simply publish signed daily updates and that's enough. Just use simple DB with backups, and optionally, a printer printing changes on a paper.

What's wrong with paper records backup up a digital record and audit trail. This all seems like a solution for a non-problem to me.

Blockchain doesn't have anything esp. to do with data loss. It solves exactly one problem which is distributed double spending in accounting ledgers.

You know, it's not like people would come and steal your land overnight because you can't provide proof of ownership.

Like whenever someone gets caught in a compromising situation they say they "were hacked", as if saying that means anything.

In this case I expect an underpaid employee, and at most an incompetent nephew of someone. They had no reason to have an .authorized_keys file in the webroot of the website, and yet they did.

If you want to know what "dedicated contracts" look like in practice they are overly specific requirements than can only match a single business. The best example that comes to mind was when one county needed to buy busses (or vans) and the maximum length admitted was bellow the most common options, but as luck would have it a nephew of a cousing of someone with decision power (or something like that) just so happened to be the one importing cars that precisely matched the specs.

The whole country's real estate market was paralyzed for about a month. It took couple of months to restore everything from backups and paper agenda and resume normal operation of the land register office.

It was the largest cyber attack in Slovakia's history. The authorities to this day haven't provided any information on who might be behind it. The investigation is still ongoing. Several government figures including the PM were however very eager to immediately point on Ukraine, without any sort of proof.

It did help the West, and especially the UK, to get as immigrants very high good plumbers and handy men. The rest of us went into STEM and are now working for FAANGS.

All you need is an append only tape or even a printer.

Interestingly in the Bangladesh Central Bank hack they used a printer to print out any transactions, but the intruders disabled it or it was just malfunctioning because it's a printer.

But I doubt the Romanians actually had such a system.

"1T+ in assets are frozen as Slovakia's Land Registry faces ransomware attack" <https://spectator.sme.sk/politics-and-society/c/news-digest-...> (9 Jan 2025) HN discussion (1 comment): <https://news.ycombinator.com/item?id=42650343>

"Ransomware Attack Paralyzes Slovakian Land Registry, Souring Slovakia-Ukraine Relations" <https://dailysecurityreview.com/security-spotlight/slovakian...> (January 14, 2025)

"Slovakia Hit by Historic Cyber-Attack on Land Registry " <https://www.infosecurity-magazine.com/news/slovakia-hit-by-l...> (10 January 2025)

Apparently tied to Ukraine in this case.

Also, you still have paper documents, kept by parties to transaction, right?

Plus having most of your net worth locked up in something no sane person would consider buying off you because you can't prove you own it is ... suboptimal

At the same time they are working with authorities.

Not everything needs an external consultant.

- We have 2 sources of data that we must backup to continue existing as a business; our postgres and binary files in S3. Everything else is derivable (elasticsearch, so on).

- For postgres, we use barman. With the help of opus/fable, you can get a streaming replication backup working in no time. We have one into another server in the same datacenter (we use baremetal) and another one in another server in a different datacenter.

- We then have a last resort barman backup with bi-weekly base backups + WAL streaming to S3 (both the base backup and WALs). It sends these backups + wal segments into an specific S3 bucket that has object lock in compliance mode. This is a feature from AWS S3 that even the most privileged account credentials (super admin) can't turn off nor delete the files before the object lock, which is 10 days in our case. Object lock compliance mode can only be extended, never shortened.

- For S3, we store them into another versioned bucket, with lifecycle rules to also expire non current versions (== deleted objects) after 10 days. No point in object lock compliance here because it would only protect objects for the most recent 10 days, and you gain nothing. What we do instead: the app servers only have access to these bucket tru an IAM credential that can't delete old versions (so deleted objects have to expire manually via the lifecycle rule) AND this IAM credentials also can't change the object policy.

IMHO, this protects us enough so that even in the worst case scenario (ransomware) we have 10 days to sort everything out and recover our AWS access.

And yes, we test the S3 barman restoration and it works fine. Data loss is at max 5 minutes due to the archive_timeout=300s on the primary.

For the streaming replications in the two servers I mentioned, it's less <1ms, but those wouldn't protect us much in the case of the ransomware - even tough we use tailscale and one compromised server can't ssh into the other.

Here is one I learned recently - govt started issuing birth certificates online. Hopefully Less corruption, right? Officials made deliberate spelling mistakes in names etc, because you have to go in person for corrections. In person means bribe, which means back to same situation as before (almost)

Possibly since 1086

https://en.wikipedia.org/wiki/Domesday_Book

So all is not lost if the registry goes up in flames.

Just recently I've seen a 30 y.o. deed on some commercial property. Despite it was valid and predated the digital era, it had almost nothing common with the things on the ground.

A great-great grandfather of mine was mayor of a town through which the front passed twice during WWI. All that survived were basements. Your father's account more or less describes the process by which the land was reparceled.

Property that isn't registered can remain unregistered but must be registered before it is sold.

A blockchain is essentially that, just with the daily update that's being signed also including the signature and hash of the previous day.

Blockchain as a technology is actually useful here. It does not mean automatically that blocks have to be mined by third parties, although pseudocurrencies have gone that route for decentralization reasons.

Why does full access include the ability to delete read only data that should never ever be deleted for the rest of time?

It's like building a self destruct button that ignites the physical records. It's an unnecessary risk to make such a dangerous thing.

Now you may argue "that is a blockchain, not every blockchain is associated with a shitcoin" but to be frank that ship has sailed, if you wanted to defend that you'd have had to do a lot more work over the past decade.

https://www.bbc.com/news/technology-23588202

> Sources told Risky Business that the hacker entered using valid credentials

This is social engineering or corruption.

In a similar vein, I was once curious how you would prove your identity if ALL of your relevant documents (passport, driver's license, birth certificate etc) were lost in some kind of cataclysm e.g. a house fire pre-digital etc

Turns out there is actually a mechanism for this:

- get multiple people to sign sworn affidavits that you are who you say you are

- that begins the "paper trail" of evidence that allows you to start getting the rest of the document chain

- you rebuild from there.

If you're married, there is already a similar process for when a spouse takes the last name of the other spouse. The marriage certificate is the first step and then it goes from there for driver's license, passport, credit cards and so on.

When you buy property you get a deed for the land, but the details of a property can change after that. The deed also doesn't contain ownership, it just says what is on the land. It's common for land to have multiple owners (1/32 is not unheard of) due to inheritance.

I'm building a house, the land deed just has the land plot as we bought it, until the house is 100% finished (and registered) we will not get an updated deed, although the digital system has newer data (you need to register the construction progress).

Lord no! That accusation doesn't pass the sniff test.

Try looking further east for the real culprits.

The amount of times my SSN and correlated info has been leaked and I've been offered a free year or credit monitoring is depressing.

mirror that DB onto a server on the other side of the country, or continent, etc.

If you've specific information clearing or establishing the link, post it. I agree that hasty accusations are risky. The main point I was looking to establish was that the source wasn't indicated as Algerian, as with the Romanian incident.

Also, SQL database is much more convenient to use, it has query language and indices unlike a blockchain.

It's not. Blockchains are only eventually consistent among nodes. They're designed for synced backups among adversarial peers.

There's no reason for a government agency to use one internally. There are better ways to sync backups when the people with access to make updates are also authorized to do so.

The intent of abolishing private property would presumably be the latter.

What do you mean by "More Work" here?

There were plenty of tests and pilots of systems like that described. Dual goals of reducing the cost of transferring property and publicly attesting all current ownership. Real lawyers and real lawmakers developed proposals to integrate these sort of services with current public land registries.

The issue as far as I see it isnt the "work" its the "antiwork". If you want to learn about land sale nft pilots you literally have to put -metaverse into the google search to weed out the metaverse nonsense. Theres just too much noise around blockchain for even the best signal to penetrate. The stupid monkey nft guys really fucked the whole space. Probably take another decade to dig out all the toxic waste from blockchains reputation.

In Brazil the books are append-only, they have the whole history of thay piece of land since records began. If it was a bigger plot that was dismembered, it is there too. When ownership changes you have to register the contract/terms of transfer/sale separately in a different process, but that does not change legal ownership and you still must go to the registry and register that registered transfer/sale in the registry, and the paperwork you get is a new certificate of registration which is a new snapshot of the books and includes that whole history from the very beginning. There is no copy or certificate you can can get from the land registry without including that whole history.

That's... a curious thing to have in the body of laws. What's its purpose and who does it serve?

Registration is now compulsory on sales, but that only came in in 1990.

As to what I mean by binned, I mean literally binned, thrown away.

Of course, if you fall into a crack that is beyond their reach you will almost certainly have a more difficult time. For a variety of historical reasons, there has been relatively little reliable documentation of American citizenship so the system adapted to that reality.

[0]: https://youtu.be/7FeqF1-Z1g0

[1]: https://youtu.be/zXXmhxbQ-hk

Corruption and oppression are signaling and coordination problems. The illegitimate sovereign is exploiting informational assymmetry: they know your neighbors are just as angry as you, they know it because all the walls have ears.

They need to prevent you and your neighbors all knowing it at the same time. Your best play is to find some signal, something difficult to censure, hard for the goons to pick out in a crowd but legible to your neighbors. If you all knew that the first guy to shove back when the cop shoves you is going to be followed by a swarm of guys? Very easy to find the first guy in that case.

This is why shit like extremely high gas prices scares the shit out of illegitimate sovereigns: they're the ones posting pure data about why everyone should be that angry right now.

[1] https://community.apryse.com/t/jbig2-compression-issue/1814

[2] https://en.wikipedia.org/wiki/JBIG2#Character_substitution_e...

Everytime I get stuck with some kind of circular bureaucracy I shout "it's Banana Joe all over again!" and no one understands.

Oddly enough, if you legally change your name, they will send you a new one regardless of the limit.

I got my first passport at a formative period of my life (international travel does that). I looked nothing like the photo within aa year. It served as a passport until it expired but only created skeptisism as a photo ID.

I don't know how to drive, so do not possess a driver's licence. I am in a 35+ year relationship, but unmarried.

The only purchase I have made on finance was a bed that I immediately paid off because the the only reason I did it was to establish a record. This was surprisingly difficult to do because they were reluctant to let me have the bed on finance because I had no credit record.

I finally had to renew my passport when I bought a house. It was the only way I could meet the id requirements.

Prior to that I was leveraging non-photo id that could only be acquired with photo-id. It seen that will be accepted in lieu in many instances and allows you to get more similar forms of non-photo ID. All you need to get started is to find a staff member fed up with the ridiculous rules enough to click the checkbox to say that they saw a photo ID. It helps that many of the staff in these positions are more aware of security theater than the general public.

Being a land owner means a lot of those days are peassed, I can't really prove I am the person who is recorded as owning the land, but mostly organisatipns are happy that I am claiming to be someone they know exists.

Linkedin has stopped asking. I'm not sure if that means they think I am a lost cause or that anyone not on their books by now doesn't actually exist.

If stored properly.

So are digital copies, though. If stored properly.

depends on configuration, you can make any traditional web service replicated (replication is one and only thing that protects data in decentralized ledger, same as DNA is stored in every cell) using something like CometBFT on top. Mining/PoS or VM - all optional.

Yes, if you have a centralized model you don't need it. Just saying that this incident is the exact risk a blockchain is meant to mitigate through redundancy. You can say you don't care about this risk, but it doesn't change the truth of the statement.

If they are clearly misusing a system (SSN) never designed nor intended that way. And continue to do so even after being shown the facts.

And now I also know that he has a law degree, has several registered patents, and was a certified airline pilot. Pretty impressive.

Also, this sort of event should result in some hackers being found and jailed for life as well as their families being bankrupted permanently. Or, if they are being protected by their government, this should be considered an act of war and an appropriate military response should be delivered.

"Hold up in court" as in was it duly executed and filed by a certain date, regardless of the time and extra management required for the bank's performance? Yes, why not.

"Hold up in court" against someone claiming it was an unauthorized transfer? Even without the bug, that can be contested in many straightforward ways!

But unless there is a specific legal claim that hinges on the bug being significant, it's pretty irrelevant "in court". I knew about this precisely because the transfer failed to go through due to redundancy - one digit in account numbers is generally a check digit, plus account titles and whatnot.

In general you can always challenge the validity of scanned documents, regardless of known software bugs or not! Just like you can always challenge that a paper document is a forgery. You need a specific argument and some evidence though!

(And obviously has some doc to prove it)

Or did a joke about overbearing mother in laws just go right over my head.

"Oh volcano exploded, his home is under 5 ft of ash."

"Gotcha, mail him the copy"

If the you need to know if the fence is on your property or the neighbor’s, a title or deed won’t help you find that line.

So if the official survey is lost and you need to know where the land you own is, you will need a survey.

It is definitely a good idea to plan in advance and set up a recovery contact: https://support.apple.com/en-us/102641

It is very unlikely that you will be asked, even by a prospective employer, for your actual card, because let's face it: it doesn't even have a photo, or anything but that unique number on it. Anyone trying to authenticate your number should be satisfied if you can give them the correct number.

And just for review: SSNs are not a "national ID" and you're typically not required to divulge it to private parties, and they can make up some other unique ID for you in their database. It's usually just a shortcut for them to do a background or credit check on you. And that's not something for which they would need your physical card.

That being said, I've replaced my card about 3 times now, and it was comparatively difficult this time around. The first time, I did it all through the mail (the process of building up from no ID to get birth certificate from out-of-state, to the SSA card, to the in-state driver license.) and the second time it arrived by mail, no hassle.

But this time around, even though I applied online, I was directed to make an appointment at the field office and physically walk in there, to prove my humanity. I had never been to an SSA Field Office in my life! The experience was very chill, and there were a dozen windows serving people, while about 4 of us waited in the lobby, and I was in-and-out half an hour early. The civil servant was a lady in good spirits who was a military veteran. Big props to them!

No one thinks bills of attainder are a good idea.

The United States on the other hand has a massive title insurance industry, which wouldn't exist if this system was implemented. So you can make random handshake agreements all you'd like and sue over it.

[1] https://www.elra.eu/the-principles-underlying-the-land-regis...

But it's more difficult to imagine that 1000 years from now someone will be able to read from a PCI-E NVME drive if the specs get lost along the way (ignoring for a moment that flash storage most likely won't retain data that long).

"i paid for 30 acres here at $xx rate, and here is the mortgage docs from the bank dated March 19th that I signed, plus their valuation of the property and what went into it"

A survey is little more than marching out into the field and putting at the location where you believe the boundaries to be based on your review of the legal description.

Of course that’s not the end of the discussion as to boundaries for reasons like adverse possession or busted titles but on his own a surveyor is going to tell you basically nothing.

What you need is "pyroclastic event" insurance to cover you for ash and lahar.

/ It cost something like $15/year when I lived in Seattle.

// The macOS spell checker doesn't know "lahar."

I'm curious when this happened. The phrase "but this time around" makes it sound fairly recent. However, my wife had this very procedure required back in the 1990's.

She also had the same experience as you: Very friendly civil servants eager to help, and things were cleared up quickly once she understood the process.

In my state, it's one of the allowed document types for proof of social security number, required to get a real ID drivers license.

https://www.mass.gov/doc/ma-real-id-documents-checklist/down...

A git repo with cryptographically signed commits solves all the same problems without the headache.

That's not what they are, but that's what they've defacto become. I hate it.

Totally agree on accessing NVME example.

ADDED: We also had a bunch of easements and cooperative maintenance agreements that were only partially documented in the deed and mostly done via a handshake. So we got that all squared away in the expensive binder from the lawyer.

    - get insurance to cover you for X
    - get hit by X
    - realise you actually got hit by Y after reading the policy small print (or you really did get hit by X, but your policy only covers you for Y)

And both storage can be broken, needing reconstruction.

If I were to give you a 70y old book in English vs some 70y tape with data on - which one is easier to read?

In his thesis, this is the reason capitalism cannot work well in Latin America and other nations around the world. He says that registered land ownership is the foundation of capitalism. This is how one can borrow money against your land and invest it to make more capital. Very common for example with farmers in N. America to borrow against their farm, for machines, seeds and fertilizer.

(I am not an economist)

Except for certain industries where the government has a direct interest (banking, healthcare, real estate), I don't think anyone has asked for my SSN in at least a decade. It's not like the old days when you'd fork over your SSN to rent videos at Blockbuster.

Not sure if you're being deliberately obtuse here but this isn't an issue with the cadence of real estate transactions. Real estate ledgers do not need to support HFT.

That's still a massive dependance on "ID" for SS...? Blockbuster tho.. phew it's been a while.

If the medium isn't destroyed, it is directly readable if it's a book, but not necessarily so in digital because hardware and software is needed - just taking care of the original medium isn't enough in digital over centuries.

De Soto is talking about why it "cannot" get started in a place without government controlled land registry.

If your proposal is 'something like git, with a few modifications to make it suitable for this use case', then that's exactly what I'm proposing. What you will need, once you've considered all requirements to the best extent feasible, will be a blockchain. Eg you do need the ability to make protocol updates, no matter the time scale of transactions.

De Soto describes the exact opposite situation. Latin America inherited Napoleonic property law, which only recognized property ownership when formally registered, which required quite alot of red tape. It was impossible to transfer ownership without registration. Moreover, any defect in prior registration meant the lawful owner might be the heirs of someone generations ago. Most property "owned" by the peasantry usually had defective and incurable title, having changed hands in informal private agreements, which meant banks wouldn't accept it to secure a loan. This meant only the aristocracy could leverage the financial system, because they were accustomed to following all the formalities. What piece of real property someone thought they owned, even if occupied for generations, was often in the eyes of the law owned by some aristocratic family or the state.

He contrasted that system with the American common law system, where title could be legally transfered entirely privately. Disputes are handled by courts which look to the timing and substance of transfers. Moreover, adverse possession meant that after a number of years (well within one person's lifespan) nobody could come along and claim title because of a defective transfer (even if in principle they had a better claim originally), securing title in whomever held it, even if it had been transferred without even following the much looser requirements under the common law. A bank would issue a loan so long as you could prove you held an unchallenged title for a sufficient number of years. ("Title" was whatever piece of paper handed you by the previous possessors; no government stamp or recordation required.)

Registration systems in the US are a recent occurrence, and they overlay the traditional common law rules.

A gross generalization, but Napoleonic civil law systems emphasize formal transactions centrally administered by the state, while the common law emphasizes looking to the substance of private transactions, and usually only when a dispute arises (otherwise you just presume they're valid). Broadly speaking, De Soto argued the latter tended to favor the common man, because it was much less rigid.

De Soto also pointed out that US Federal Land Grants also did a decent job at distributing land among the people, unlike Latin America where mostly only the aristocracy held land under a good title.

"Cannot work well" and "cannot get started" are two different things. The whole of Latin America apart from Cuba is capitalist, for better or worse, regardless of how bad those countries keep their books.

Firstly, git does not use MD5. It uses SHA1.

Secondly, since 2017 git has shipped with an implementation of SHA1 (sha1dc) that detects the collision attack you describe, which for this use case renders it a non-issue.

Thirdly, git supports `git init --object-format=sha256` which removes the whole issue for anyone who cares to do so.

I think git as-is solves the problem nicely. The only additional value blockchain provides is the ability for someone to point at it and say "look! A use for blockchain exists!" which isn't worth the downsides it'll bring.

And yes I can see that we are at the end of an era. This may be more the end of the U.S. empire than the elimination of capitalism, but for sure a new 'ism" is going to be required soon. What that is will be interesting to see. It would be nice to see someone with imagination come along instead the bipolar options we are handed today.