5 ms·

We already have a taste of these rules and regulations, for example HIPAA, PCI, and FIPS-140. I'm not saying I disagree with you, but keep in mind that those ar

We already have a taste of these rules and regulations, for example HIPAA, PCI, and FIPS-140. I'm not saying I disagree with you, but keep in mind that those are all considered quite burdensome, and it's hard to see how that could be different. Also FIPS-140 is a good example of a standard that names specific technologies and so is doomed to lag behind the state of the art. Just be careful what you wish for! But as you say, it seems inevitable for more rules to be imposed eventually, one way or another, so perhaps we should think about how we might write better ones.

djsumdog 10y ago
There are also terrible project management standards like CMMI, which a lot of agencies try to adopt to get government grants. Standards that were designed to increase quality by clearly defining the work, ended up doing neither. The trouble with comparing it to Civil Engineering is you have a bridge. The bridge has plans and you can have other engineers and physicists look at it, do the maths, and figure out if it is sound. You can have independent auditing, and you have do, because if a bridge fails, people die. In software, we don't often feel that same burden. Also, unlike the bridge, software doesn't wear out over time. It may increase load, to the point where even with more hardware it won't scale. It may also become difficult to maintain due to old/unmaintained libraries, older language that are difficult to find developers for, or just that it was badly written and bandages together -- all of which is what we often called "Technical Debt". We do have life critical software, such as the software in a pacemaker, in your cars ECU, in airplane navigation and control systems. The industry holds themselves to a high standard, and some of those companies may do independent auditing (if for liability than anything else). But even then, we see things get through as there are talks at hackcons at hacking things like cars, airplanes and biomedical devices. In this article, we have a piece of software that seems like it's just data entry software. From the limited amount of information, it seems to have been poorly designed and buggy. If this was for the inventory at a retailer, yea who cares. Some grocery stories or gas station chains now lose a ton of time and money because they made a bad decision. If prices go up because of that, you just go to another one, or they just eat those costs. When this deals with government information about people, you get into a whole different area. Another case that's similar: Novapay in New Zealand. A terribly designed education payroll system caused thousands of teachers to not be paid for months. That affects peoples' lives.
- heartbreak 10y ago
  > But even then, we see things get through as there are talks at hackcons at hacking things like cars, airplanes and biomedical devices. Food for thought: imagine open-air discussions with proofs of concept of "cracking" critical infrastructure like bridges and dams.
robryk 10y ago
I find it weird that all the standards in the privacy space (that I know about) seem to me to be much more about checkbox-checking compliance (ie. following their letter doesn't help much or at all) as opposed to standards in reliability space.
clifanatic 10y ago
> those are all considered quite burdensome Not to mention ambiguous. I've never found two people who can agree on the proper interpretation of even one of the guidelines in HIPAA or PCI. My experience with both has been managers who would rather spend a week trying to get out of having to be compliant than spend a day just complying.

djsumdog 10y ago

There are also terrible project management standards like CMMI, which a lot of agencies try to adopt to get government grants. Standards that were designed to increase quality by clearly defining the work, ended up doing neither. The trouble with comparing it to Civil Engineering is you have a bridge. The bridge has plans and you can have other engineers and physicists look at it, do the maths, and figure out if it is sound. You can have independent auditing, and you have do, because if a bridge fails, people die. In software, we don't often feel that same burden. Also, unlike the bridge, software doesn't wear out over time. It may increase load, to the point where even with more hardware it won't scale. It may also become difficult to maintain due to old/unmaintained libraries, older language that are difficult to find developers for, or just that it was badly written and bandages together -- all of which is what we often called "Technical Debt". We do have life critical software, such as the software in a pacemaker, in your cars ECU, in airplane navigation and control systems. The industry holds themselves to a high standard, and some of those companies may do independent auditing (if for liability than anything else). But even then, we see things get through as there are talks at hackcons at hacking things like cars, airplanes and biomedical devices. In this article, we have a piece of software that seems like it's just data entry software. From the limited amount of information, it seems to have been poorly designed and buggy. If this was for the inventory at a retailer, yea who cares. Some grocery stories or gas station chains now lose a ton of time and money because they made a bad decision. If prices go up because of that, you just go to another one, or they just eat those costs. When this deals with government information about people, you get into a whole different area. Another case that's similar: Novapay in New Zealand. A terribly designed education payroll system caused thousands of teachers to not be paid for months. That affects peoples' lives.

heartbreak 10y ago
> But even then, we see things get through as there are talks at hackcons at hacking things like cars, airplanes and biomedical devices. Food for thought: imagine open-air discussions with proofs of concept of "cracking" critical infrastructure like bridges and dams.

robryk 10y ago

I find it weird that all the standards in the privacy space (that I know about) seem to me to be much more about checkbox-checking compliance (ie. following their letter doesn't help much or at all) as opposed to standards in reliability space.

clifanatic 10y ago

> those are all considered quite burdensome Not to mention ambiguous. I've never found two people who can agree on the proper interpretation of even one of the guidelines in HIPAA or PCI. My experience with both has been managers who would rather spend a week trying to get out of having to be compliant than spend a day just complying.