6 ms·

> That's the current mindset of the technological world, estimating whether the cost of atoning for the problem is lower than the cost of securing the systems.

by imagist 10y ago

> That's the current mindset of the technological world, estimating whether the cost of atoning for the problem is lower than the cost of securing the systems. And for the record, this will always be the mindset of corporations whose only concern is the bottom line. Until we as a culture accept that the market does not solve all problems, we're not going to solve these kinds of problems.

dev1n 10y ago
And until we figure out how to incentivize this behavior (or discourage malicious behavior), corporations won't be willing to solve these kinds of problems.
- Pharylon 10y ago
  If only we had some sort of structure in our society that could solve the problem but wan't profit-driven. Maybe something that could oversee these corporations. We could call it "government" or something.
  - dev1n 10y ago
    If only Hobbes, Locke, Rousseau et al. were around today..
    - grp 10y ago
      Maybe you can try Bernard Stiegler. His english wikipedia page is a little poor in information, so I put a link about his last book (not yet translated). https://en.wikipedia.org/wiki/Bernard_Stiegler https://en.wikipedia.org/wiki/Bernard_Stiegler http://www.samkinsley.com/2016/06/28/how-to-survive-disruption-interview-with-bernard-stiegler-translation/ http://www.samkinsley.com/2016/06/28/how-to-survive-disrupti...
      - dev1n 10y ago
        bookmarked this interview link for later. Thanks!
  - deleted 10y ago
    [deleted]
  - icebraining 10y ago
    Pretty sure the US has one of those, doesn't seem to be working. In fact, it often acts against that (preventing sharing of encryption algorithms, trying to force inclusion of backdoors..).
- s3r3nity 10y ago
  Not sure why you're getting down-voted - if the market is set up to incentivize a certain behavior, then someone will do it eventually. People can get mad all they want, but they should be furious that the government has laws in place to incentivize that type of behavior (or at least allow it to happen.)
- imagist 10y ago
  Well, there are a few possible solutions, and they don't all involve corporate incentives: 1. Government regulation 2. Technical solutions (alternatives to communication that have end-to-end encryption, for example) 3. Eschew corporations entirely when it comes to our data and communications (i.e. open source and personal hardware solutions) Personally, I think some combination of 2 and 3 is my ideal endgame, but we aren't there technically yet. 1 isn't really a great option either, because government is so controlled by corporate interests, and corporations will never vote to regulate themselves. But we can at least make some short term partial solutions with option 1 until technology enables 2 and 3. However, none of these options will happen while people hold onto the naive idealism that the free market will solve all our problems.
jerf 10y ago
But what's the concrete proposal? The default "better idea" seems to be "let the government do it", but if you've been keeping up with the news in the past few years, "the government" doesn't exactly have a stellar track record either. Where a corporation may prioritize making money over security, government prioritize politics over security, wanting to spend money on things that visibly win them political points or power, not on preventing things that don't happen, which aren't visible to anyone. It's the same problem in a lot of ways. And both corporations and governments have the problems that specific individuals can be empowered to make very bad security decisions because nobody has the power to tell them that their personal convenience must take a back seat to basic operational security. Even the intelligence agencies have experienced some fairly major breaches, which count against them even if they are inside jobs. "The market screws this up!" isn't a particularly relevant criticism if there isn't something out there that doesn't screw this up.
- SomeStupidPoint 10y ago
  > "The market screws this up!" isn't a particularly relevant criticism if there isn't something out there that doesn't screw this up. My usual reply to this is that we use government to nudge market incentives, which is also what I think would be reasonable here: simply create a class of records related to PII, and create HIPPA like laws regarding those records that certain kinds of information brokers keep on people. You then provide a corrective force to the market by providing penalties to violations, which raises the costs of breaches, and shifts the focus of the corporation towards security. HIPPA or financial systems aren't perfect, it's true, but they're at a standard above what most of our extremely personal data is stored at, so we know we can do better, if we choose to as a society.
  - kajecounterhack 10y ago
    s/HIPPA/HIPAA/rg
  - cmdrfred 10y ago
    These laws would also be a lot more effective if you held the executive staff accountable as opposed to the shareholders. The model that corporations seek profit doesn't work in some cases, it's a group of individuals all seeking personal profit.
roadnottaken 10y ago
The market seems to be solving the problem just fine: nobody uses Yahoo anymore and companies with solid security practices (e.g. Google, Apple, Facebook) are thriving. If Google had a serious security breach, you can bet the market would respond to it and Google knows it.
rmc 10y ago
With legisilation, we can change the market. In the Fight Club example legislation can make C be ten times as big, and change the equation. For Yahoo, legally mandated fines, or restrictions on what they can do in future[1] could make them wake up. [1] Maybe if you run email and you get hacked, you're not allowed to run email again for a few years? That'd've have woken them up.
basseq 10y ago
> > That's the current mindset of the technological world, > > estimating whether the cost of atoning for the problem > > is lower than the cost of securing the systems. > > And for the record, this will always be the mindset of > corporations whose only concern is the bottom line. > Until we as a culture accept that the market does not > solve all problems, we're not going to solve these > kinds of problems. My immediate reaction is "Of course". A return on investment or risk analysis should drive activities on both the corporate and the government level. This is particularly true in the security space, because no system is 100% secure. And since resources aren't infinite, where do you stop? 90%? 99%? 99.9%? What if addressing that incremental 0.9% costs as much as the rest of the security apparatus combined? As much as the rest of the product combined? As much as your total revenue? What's the other option? It can't be "not release anything", so a middle ground is found. We're arguing about shades of grey. And sure, the government can help. Either by bearing some of the cost (e.g., investment, tax breaks, etc.) or increasing the impact of an incident (e.g., penalties, etc.). But this isn't a big, bad, greedy corporate problem. This is a broader issue about how much risk we're willing or unwilling to absorb, and how efficiently we can address that risk.
- imagist 10y ago
  > My immediate reaction is "Of course". A return on investment or risk analysis should drive activities on both the corporate and the government level. You're looking at this in only monetary terms, or at least Yahoo is. But frankly, I don't give a fuck about whether Yahoo succeeds financially--I want my life and the lives of other people to be better. And I want that to be the goal of my government. > But this isn't a big, bad, greedy corporate problem. Of course it's a big, bad, greedy corporate problem. The reason "return on investment" matters in a financial sense is because big, bad, greedy corporations only care about their bottom line. And quite frequently Yahoo's bottom line is in direct opposition to improving my life and the lives of other people.
  - navbaker 10y ago
    >The reason "return on investment" matters in a financial sense is because big, bad, greedy corporations only care about their bottom line. I would argue that it's ALL corporations that only care about their bottom line. The entire reason a corporation exists is to make money, any other considerations like employee well-being, care for the environment, etc are driven entirely by either legal requirements or a need to retain talent in order to make that money. Any corporation who successfully projects an image of being "different" just has a good marketing team.

by imagist 10y ago

dev1n 10y ago

And until we figure out how to incentivize this behavior (or discourage malicious behavior), corporations won't be willing to solve these kinds of problems.

Pharylon 10y ago
If only we had some sort of structure in our society that could solve the problem but wan't profit-driven. Maybe something that could oversee these corporations. We could call it "government" or something.
- dev1n 10y ago
  If only Hobbes, Locke, Rousseau et al. were around today..
  - grp 10y ago
    Maybe you can try Bernard Stiegler. His english wikipedia page is a little poor in information, so I put a link about his last book (not yet translated). https://en.wikipedia.org/wiki/Bernard_Stiegler https://en.wikipedia.org/wiki/Bernard_Stiegler http://www.samkinsley.com/2016/06/28/how-to-survive-disruption-interview-with-bernard-stiegler-translation/ http://www.samkinsley.com/2016/06/28/how-to-survive-disrupti...
    - dev1n 10y ago
      bookmarked this interview link for later. Thanks!
- deleted 10y ago
  [deleted]
- icebraining 10y ago
  Pretty sure the US has one of those, doesn't seem to be working. In fact, it often acts against that (preventing sharing of encryption algorithms, trying to force inclusion of backdoors..).
s3r3nity 10y ago
Not sure why you're getting down-voted - if the market is set up to incentivize a certain behavior, then someone will do it eventually. People can get mad all they want, but they should be furious that the government has laws in place to incentivize that type of behavior (or at least allow it to happen.)
imagist 10y ago
Well, there are a few possible solutions, and they don't all involve corporate incentives: 1. Government regulation 2. Technical solutions (alternatives to communication that have end-to-end encryption, for example) 3. Eschew corporations entirely when it comes to our data and communications (i.e. open source and personal hardware solutions) Personally, I think some combination of 2 and 3 is my ideal endgame, but we aren't there technically yet. 1 isn't really a great option either, because government is so controlled by corporate interests, and corporations will never vote to regulate themselves. But we can at least make some short term partial solutions with option 1 until technology enables 2 and 3. However, none of these options will happen while people hold onto the naive idealism that the free market will solve all our problems.

jerf 10y ago

But what's the concrete proposal? The default "better idea" seems to be "let the government do it", but if you've been keeping up with the news in the past few years, "the government" doesn't exactly have a stellar track record either. Where a corporation may prioritize making money over security, government prioritize politics over security, wanting to spend money on things that visibly win them political points or power, not on preventing things that don't happen, which aren't visible to anyone. It's the same problem in a lot of ways. And both corporations and governments have the problems that specific individuals can be empowered to make very bad security decisions because nobody has the power to tell them that their personal convenience must take a back seat to basic operational security. Even the intelligence agencies have experienced some fairly major breaches, which count against them even if they are inside jobs. "The market screws this up!" isn't a particularly relevant criticism if there isn't something out there that doesn't screw this up.

SomeStupidPoint 10y ago
> "The market screws this up!" isn't a particularly relevant criticism if there isn't something out there that doesn't screw this up. My usual reply to this is that we use government to nudge market incentives, which is also what I think would be reasonable here: simply create a class of records related to PII, and create HIPPA like laws regarding those records that certain kinds of information brokers keep on people. You then provide a corrective force to the market by providing penalties to violations, which raises the costs of breaches, and shifts the focus of the corporation towards security. HIPPA or financial systems aren't perfect, it's true, but they're at a standard above what most of our extremely personal data is stored at, so we know we can do better, if we choose to as a society.
- kajecounterhack 10y ago
  s/HIPPA/HIPAA/rg
- cmdrfred 10y ago
  These laws would also be a lot more effective if you held the executive staff accountable as opposed to the shareholders. The model that corporations seek profit doesn't work in some cases, it's a group of individuals all seeking personal profit.

roadnottaken 10y ago

The market seems to be solving the problem just fine: nobody uses Yahoo anymore and companies with solid security practices (e.g. Google, Apple, Facebook) are thriving. If Google had a serious security breach, you can bet the market would respond to it and Google knows it.

rmc 10y ago

With legisilation, we can change the market. In the Fight Club example legislation can make C be ten times as big, and change the equation. For Yahoo, legally mandated fines, or restrictions on what they can do in future[1] could make them wake up. [1] Maybe if you run email and you get hacked, you're not allowed to run email again for a few years? That'd've have woken them up.

basseq 10y ago

> > That's the current mindset of the technological world, > > estimating whether the cost of atoning for the problem > > is lower than the cost of securing the systems. > > And for the record, this will always be the mindset of > corporations whose only concern is the bottom line. > Until we as a culture accept that the market does not > solve all problems, we're not going to solve these > kinds of problems. My immediate reaction is "Of course". A return on investment or risk analysis should drive activities on both the corporate and the government level. This is particularly true in the security space, because no system is 100% secure. And since resources aren't infinite, where do you stop? 90%? 99%? 99.9%? What if addressing that incremental 0.9% costs as much as the rest of the security apparatus combined? As much as the rest of the product combined? As much as your total revenue? What's the other option? It can't be "not release anything", so a middle ground is found. We're arguing about shades of grey. And sure, the government can help. Either by bearing some of the cost (e.g., investment, tax breaks, etc.) or increasing the impact of an incident (e.g., penalties, etc.). But this isn't a big, bad, greedy corporate problem. This is a broader issue about how much risk we're willing or unwilling to absorb, and how efficiently we can address that risk.

imagist 10y ago
> My immediate reaction is "Of course". A return on investment or risk analysis should drive activities on both the corporate and the government level. You're looking at this in only monetary terms, or at least Yahoo is. But frankly, I don't give a fuck about whether Yahoo succeeds financially--I want my life and the lives of other people to be better. And I want that to be the goal of my government. > But this isn't a big, bad, greedy corporate problem. Of course it's a big, bad, greedy corporate problem. The reason "return on investment" matters in a financial sense is because big, bad, greedy corporations only care about their bottom line. And quite frequently Yahoo's bottom line is in direct opposition to improving my life and the lives of other people.
- navbaker 10y ago
  >The reason "return on investment" matters in a financial sense is because big, bad, greedy corporations only care about their bottom line. I would argue that it's ALL corporations that only care about their bottom line. The entire reason a corporation exists is to make money, any other considerations like employee well-being, care for the environment, etc are driven entirely by either legal requirements or a need to retain talent in order to make that money. Any corporation who successfully projects an image of being "different" just has a good marketing team.