7 ms·

That's actually what Bruce wants - and he figures the only way to enforce it is through regulation. He's given up on the sensibilities of individual companies a

That's actually what Bruce wants - and he figures the only way to enforce it is through regulation. He's given up on the sensibilities of individual companies and programmers, and would instead like to rely on regulations to make some basic guarantees. You and I know the basics of computer security. We can take a crack at designing a secure system and maybe do okay. But the argument goes like this: Yes there are security conscous programmers, but there are also many which are not. And those people work on products which make it to market. How do we stop those products from making it to market? Government intervention. He's given up on education and relying on the informed developer, and would rather rely on public policy. I find it a bit sad.

qwertyuiop924 10y ago
It also won't work. The only solution to ignorance is education. Having "smart people" make all the decisions will only get you so far.
jlj 10y ago
The free market crowd would argue that the surviving companies will bake in the right security if consumers demand it. If companies don't take it seriously, either their customers aren't demanding it, or they will be replaced by companies that do a good job at it. The government has a proven conflict of interest and disincentive to harden the infrastructure. Vulnerabilities are valuable for espionage. And there are already regulations like HIPPA, PCI, etc, yet there are still breaches. Regulation will add complexity to business and will protect market share for the entrenched players who can afford to follow it. That will lead to further consolidation and reduced competition while I feel that the opposite is needed. The fiefdoms described in another post wouldn't be such a bad thing. At the nation state level, competition will also make for better security. Isolationism doesn't work out well in world history. Movement of goods and ideas does a better job at bringing countries together. I feel there's a pendulum swinging back towards isolationism but it goes back and forth over time.
- alexqgb 10y ago
  What the free-market crowd can never account for - here, or anywhere - is how the market is supposed to resolve issues that are not of direct, immediate interest to self-serving buyers or sellers, but which are of massive and justifiable interest to third parties outside the transaction. Case in point: If a seller in one country can lower the costs of a good shipped to another country by scrapping responsible waste management in favor of polluting the commons (i.e., places where individual property rights claims are difficult to press), then "the magic of the market" is likely to increase - not decrease - the amount of pollution generated by the trade. What libertarians don't like to admit is that they see free markets as more than ideal mechanisms for preserving efficient economies. They also see them as efficient sources of good and just governance. Like all belief systems, faith in the quality of governance supplied by free markets, while rational and well-supported to a point, can be taken to counter productive extremes where it maintenance stops operating like empiricism, and starts to function is ways indistinguishable from fundamentalists religions. Not sure how many sensible knowledgeable people want this to be the dominant force in guiding global network security.
  - CuriousSkeptic 10y ago
    As a nuance though. one could agree with the notion of negative externalities naturally occurring in a free market economy (perhaps in a total laissez faire environment the affected third parties could retaliate in kind though) but disagree with the form of policy to address it. In principle the market should be able to select appropriate fixes if the costs are internalized, but governments have a tendency to focus less on the internalize costs part, and more on selecting fixes. Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations and instead becomes a gamble that whatever fix is made policy actually do have an impact on the problem, and doesn't make things worse.
    - alexqgb 10y ago
      Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations This is a pretty good argument the absolute value of principle, tbh For what it's worth, I tend to see principles like map; useful - even indispensable - in many situations, that are nevertheless abstractions and therefor imperfect guides to actual reality. Use maps, yes, but avoid mistaking them - or any system of symbols - for the things they represent (i.e., the map is not the territory). Indeed, principle is a form of proxy wisdom for the young and inexperienced. It's better than nothing, but probably not enough to save you from at least a few episodes of hard reckoning. Assuming these don't get you killed, the places where principle doesn't serve are the ones where mature judgement develops. Granted, there's a point where this doesn't serve either, but that's okay too since mortality always wins in the end.
hash-set 10y ago
He's nuts. Elected officials don't get technology. Hillary Clinton had no idea what she was doing with a simple e-mail server. They. Don't. Get. It.
mreiland 10y ago
I disagree with the idea that the problem has to do with "non-security minded programmers". Certainly they exist, but the issue more often than not is that security is more expensive than non-security, so companies don't give their developers enough time to actually do security.

qwertyuiop924 10y ago

It also won't work. The only solution to ignorance is education. Having "smart people" make all the decisions will only get you so far.

jlj 10y ago

The free market crowd would argue that the surviving companies will bake in the right security if consumers demand it. If companies don't take it seriously, either their customers aren't demanding it, or they will be replaced by companies that do a good job at it. The government has a proven conflict of interest and disincentive to harden the infrastructure. Vulnerabilities are valuable for espionage. And there are already regulations like HIPPA, PCI, etc, yet there are still breaches. Regulation will add complexity to business and will protect market share for the entrenched players who can afford to follow it. That will lead to further consolidation and reduced competition while I feel that the opposite is needed. The fiefdoms described in another post wouldn't be such a bad thing. At the nation state level, competition will also make for better security. Isolationism doesn't work out well in world history. Movement of goods and ideas does a better job at bringing countries together. I feel there's a pendulum swinging back towards isolationism but it goes back and forth over time.

alexqgb 10y ago
What the free-market crowd can never account for - here, or anywhere - is how the market is supposed to resolve issues that are not of direct, immediate interest to self-serving buyers or sellers, but which are of massive and justifiable interest to third parties outside the transaction. Case in point: If a seller in one country can lower the costs of a good shipped to another country by scrapping responsible waste management in favor of polluting the commons (i.e., places where individual property rights claims are difficult to press), then "the magic of the market" is likely to increase - not decrease - the amount of pollution generated by the trade. What libertarians don't like to admit is that they see free markets as more than ideal mechanisms for preserving efficient economies. They also see them as efficient sources of good and just governance. Like all belief systems, faith in the quality of governance supplied by free markets, while rational and well-supported to a point, can be taken to counter productive extremes where it maintenance stops operating like empiricism, and starts to function is ways indistinguishable from fundamentalists religions. Not sure how many sensible knowledgeable people want this to be the dominant force in guiding global network security.
- CuriousSkeptic 10y ago
  As a nuance though. one could agree with the notion of negative externalities naturally occurring in a free market economy (perhaps in a total laissez faire environment the affected third parties could retaliate in kind though) but disagree with the form of policy to address it. In principle the market should be able to select appropriate fixes if the costs are internalized, but governments have a tendency to focus less on the internalize costs part, and more on selecting fixes. Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations and instead becomes a gamble that whatever fix is made policy actually do have an impact on the problem, and doesn't make things worse.
  - alexqgb 10y ago
    Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations This is a pretty good argument the absolute value of principle, tbh For what it's worth, I tend to see principles like map; useful - even indispensable - in many situations, that are nevertheless abstractions and therefor imperfect guides to actual reality. Use maps, yes, but avoid mistaking them - or any system of symbols - for the things they represent (i.e., the map is not the territory). Indeed, principle is a form of proxy wisdom for the young and inexperienced. It's better than nothing, but probably not enough to save you from at least a few episodes of hard reckoning. Assuming these don't get you killed, the places where principle doesn't serve are the ones where mature judgement develops. Granted, there's a point where this doesn't serve either, but that's okay too since mortality always wins in the end.

hash-set 10y ago

He's nuts. Elected officials don't get technology. Hillary Clinton had no idea what she was doing with a simple e-mail server. They. Don't. Get. It.

mreiland 10y ago

I disagree with the idea that the problem has to do with "non-security minded programmers". Certainly they exist, but the issue more often than not is that security is more expensive than non-security, so companies don't give their developers enough time to actually do security.