Good news and bad news on cyber security