4 ms·

OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from fr

by cmurf 10y ago

OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from free market types that 100% of phishing victims are ignorant and basically deserve what happens to them, if they can't learn that they're being duped they deserve to be duped, they somehow think wholesale loss of trust ends up being focused only on specific companies rather than entire technologies. And so on. So how are these externalities dealt with where there is no such thing as insurance for this type of breach? There's no way to put the toothpaste (my private information in the form of answers to personal "security questions") back into the tube (only my brain or nearby sphere of influence). And this goes along with IoT devices that aren't having their known exploits patched by their manufacturers. Similar problem different details. So without broad laws that say this is wrong and here is a mechanism to attach a tangible cost to this information so a proper risk assessment is done, I imagine we keep seeing this happen with essentially no punishment beyond what Yahoo already is getting punished for.

droopyEyelids 10y ago
You're demanding accountability from insane people. I learned long ago, never to wrestle with a pig. You get dirty, and besides, the pig likes it. Read more at: https://www.brainyquote.com/quotes/quotes/g/georgebern137450.html https://www.brainyquote.com/quotes/quotes/g/georgebern137450...
- dmix 10y ago
  Ironically, you're quoting George Bernard Shaw who believed in eugenics, anti-vaccination, and "expressed admiration for both Mussolini and Stalin". I'd be sufficiently curious to find a single person who fits the profile of the ideologue the OP is referring to. I'm afraid such a person doesn't exist.
Canada 10y ago
> including no lawsuits Are there are "free market types" who actually believe there shouldn't be any form of sanctions whatsoever for causing harm? I've talked to quite a few hardcore libertarians, and I've yet to encounter anyone who takes it that far.
- fullshark 10y ago
  Yeah if anything lawsuits/courts are central to their argument, that the owners of property will use legal recourse to settle damages to them, and that mechanism serves most of the functions of gov't regulation.
- vel0city 10y ago
  In Robert Nozick's Anarchy, State, and Utopia he argues the minimal state would be "limited to the narrow functions of protection against force, theft, fraud, enforcement of contracts, and so on." I'd imagine most libertarians would agree basic contract laws and some level of lawsuits should be acceptable to a functioning society.
- dmix 10y ago
  Even anarcho-capitalists, the most hardcore libertarians, believe heavily in the court system. So I'm not sure what the OP means "without lawsuits". Because lawsuits would most likely be their answer here. Also maybe competition from other email vendors who take your security seriously and doesn't leak 1 billion emails? Or pressure from investors not to create that type of liability? Pretty obviously a strawman, it's far easier to win such an argument with silly caricatures of libertarians as an opponent... someone who believes that all companies should be able to do whatever they want, without any consequence! Only the most extreme niche of the already niche group of anarcho-capitalists believe in private courts or private law enforcement. Which does not at all reflect mainstream libertarian thought. Who instead wish for a "minimal" state, which at a very minimum means centralized courts. I've heard economists argue that economies and societies do not exist without some form of a legal system (chiefs, kings, courts, etc). It's the very core of human co-existence to be able to resolve disputes in a fair and just way.
  - cmurf 10y ago
    Seems that anarchy is contrary to government, and out of necessity a government is needed to have a court. Those pure free market types I'm referring to self describe exactly as anarcho capitalists and say all disputes are resolved by insurance, exactly zero government. If there's a court, maybe that's a venue the insurance companies all agree upon. But if you don't have insurance or don't have good enough insurance you don't get as much representation or as much of a payout and that's your choice, sometimes life is unfair and you get screwed over. And as it's describe to me I almost immediately start thinking of Gangs of New York and axes. It's such a total departure from anything remotely civil I can only imagine this leading to a bunch of heads being chopped off. But hey, there's insurance for that too I guess.
rukittenme 10y ago
You're building a straw-man. Before trying to argue against a position you should try to understand it.
- csallen 10y ago
  On a similar note, if you're going to tell someone they're wrong about something, you owe it to them to explain why. Otherwise they won't (nor should they) take your feedback seriously.
  - rukittenme 10y ago
    I did. I said the person was building a straw-man and can solve it by understanding the topic more. That means research free market capitalism then present an argument.
    - csallen 10y ago
      IMO if you're going to tell someone they're attacking a strawman, you should point out specifically what they've got wrong about their opponent's argument. Otherwise any random person in the world can simply say, "Strawman, read more plz".
flukus 10y ago
Devils advocate because I'm not a free market type: Can we sue companies for data breaches? This could solve the issue with large companies but not fly by night operations.
zzzcpan 10y ago
> this gets fixed This being what exactly? What is a threat model you are talking about? Because it sounds like you think that a typical user account used for porn, social sites and hobby is worth protecting somehow to the extent of government involvement.
grandalf 10y ago
> there is no such thing as insurance for this type of breach There is insurance. Some of the breached accounts likely contained credit card info, and any exploits are covered by existing insurance. Some of the accounts might contain embarrassing emails, but few people have insurance against hacked disclosure of that sort. Things like this happen because the public doesn't care. Most people who use Yahoo for email are computer illiterate and are more likely to do things that lead to a breach. They are also more likely to quit using the service if things like 2FA are required. So in a sense, the invisible hand delivered the service that was demanded, and now the market can correct. Some percentage of the users impacted will learn from the experience and demand higher quality email hosting in the future.
unpwn 10y ago
Well maybe you can tell me how you get phished without being retarded? In all my experiences phishing schemes are like bit.ly links that have a form that requires the user to enter in all their data. If you fall for something like that, i don't have much sympathy tbh
trevyn 10y ago
I think "free market types" understand and accept that the world is a messy place, and that human organizations cannot generally be trusted to consistently do what they claim. ("Your information is safe with us", etc.) I believe that this is due to fundamental properties of human nature and group psychology. I believe that there is no general way to create near-perfect accountability for the statements of people, and that the second-best option is to embrace the uncertainty and develop a finely-honed sense of risk assessment. It sounds like this is the underlying concern -- if you are unable to appropriately assess risk, and you place your trust in an organization that then betrays your trust, you feel violated and want to work toward preventing that sense of violation in the future. You could do that by working to hold organizations accountable through regulation or other means. Or you could improve your ability to assess risk, and consciously and deliberately accept risks as they come. When the inevitable adverse event happens, you understand that you consciously accepted a risk in the past, and appreciate the opportunity to refine your own personal ability to evaluate risk. So, I don't agree that this is something that needs to "get fixed". I fully expect that my basic personal information is poorly secured, and I consciously accept that in exchange for the benefits of participating in our current society and using the current services offered. It's easy to say that "we need better information security", but every decision has a tradeoff. Increasing security fundamentally increases costs, slows the flow of information, and creates less nimble organizations. Many of the services you expect to be available -- Uber, cheap IoT devices, whatever -- may simply not exist in a world where a "proper risk assessment" and "tangible cost" of information breaches are applied. You, of course, are free to spend your time educating the public about information security, or how corporations can't be trusted, or even lobbying for information security regulation. That's what makes Earth fun and interesting -- everyone's following their own passions!

by cmurf 10y ago

droopyEyelids 10y ago

You're demanding accountability from insane people. I learned long ago, never to wrestle with a pig. You get dirty, and besides, the pig likes it. Read more at: https://www.brainyquote.com/quotes/quotes/g/georgebern137450.html https://www.brainyquote.com/quotes/quotes/g/georgebern137450...

dmix 10y ago
Ironically, you're quoting George Bernard Shaw who believed in eugenics, anti-vaccination, and "expressed admiration for both Mussolini and Stalin". I'd be sufficiently curious to find a single person who fits the profile of the ideologue the OP is referring to. I'm afraid such a person doesn't exist.

Canada 10y ago

> including no lawsuits Are there are "free market types" who actually believe there shouldn't be any form of sanctions whatsoever for causing harm? I've talked to quite a few hardcore libertarians, and I've yet to encounter anyone who takes it that far.

fullshark 10y ago
Yeah if anything lawsuits/courts are central to their argument, that the owners of property will use legal recourse to settle damages to them, and that mechanism serves most of the functions of gov't regulation.
vel0city 10y ago
In Robert Nozick's Anarchy, State, and Utopia he argues the minimal state would be "limited to the narrow functions of protection against force, theft, fraud, enforcement of contracts, and so on." I'd imagine most libertarians would agree basic contract laws and some level of lawsuits should be acceptable to a functioning society.
dmix 10y ago
Even anarcho-capitalists, the most hardcore libertarians, believe heavily in the court system. So I'm not sure what the OP means "without lawsuits". Because lawsuits would most likely be their answer here. Also maybe competition from other email vendors who take your security seriously and doesn't leak 1 billion emails? Or pressure from investors not to create that type of liability? Pretty obviously a strawman, it's far easier to win such an argument with silly caricatures of libertarians as an opponent... someone who believes that all companies should be able to do whatever they want, without any consequence! Only the most extreme niche of the already niche group of anarcho-capitalists believe in private courts or private law enforcement. Which does not at all reflect mainstream libertarian thought. Who instead wish for a "minimal" state, which at a very minimum means centralized courts. I've heard economists argue that economies and societies do not exist without some form of a legal system (chiefs, kings, courts, etc). It's the very core of human co-existence to be able to resolve disputes in a fair and just way.
- cmurf 10y ago
  Seems that anarchy is contrary to government, and out of necessity a government is needed to have a court. Those pure free market types I'm referring to self describe exactly as anarcho capitalists and say all disputes are resolved by insurance, exactly zero government. If there's a court, maybe that's a venue the insurance companies all agree upon. But if you don't have insurance or don't have good enough insurance you don't get as much representation or as much of a payout and that's your choice, sometimes life is unfair and you get screwed over. And as it's describe to me I almost immediately start thinking of Gangs of New York and axes. It's such a total departure from anything remotely civil I can only imagine this leading to a bunch of heads being chopped off. But hey, there's insurance for that too I guess.

rukittenme 10y ago

You're building a straw-man. Before trying to argue against a position you should try to understand it.

csallen 10y ago
On a similar note, if you're going to tell someone they're wrong about something, you owe it to them to explain why. Otherwise they won't (nor should they) take your feedback seriously.
- rukittenme 10y ago
  I did. I said the person was building a straw-man and can solve it by understanding the topic more. That means research free market capitalism then present an argument.
  - csallen 10y ago
    IMO if you're going to tell someone they're attacking a strawman, you should point out specifically what they've got wrong about their opponent's argument. Otherwise any random person in the world can simply say, "Strawman, read more plz".

flukus 10y ago

Devils advocate because I'm not a free market type: Can we sue companies for data breaches? This could solve the issue with large companies but not fly by night operations.

zzzcpan 10y ago

> this gets fixed This being what exactly? What is a threat model you are talking about? Because it sounds like you think that a typical user account used for porn, social sites and hobby is worth protecting somehow to the extent of government involvement.

grandalf 10y ago

> there is no such thing as insurance for this type of breach There is insurance. Some of the breached accounts likely contained credit card info, and any exploits are covered by existing insurance. Some of the accounts might contain embarrassing emails, but few people have insurance against hacked disclosure of that sort. Things like this happen because the public doesn't care. Most people who use Yahoo for email are computer illiterate and are more likely to do things that lead to a breach. They are also more likely to quit using the service if things like 2FA are required. So in a sense, the invisible hand delivered the service that was demanded, and now the market can correct. Some percentage of the users impacted will learn from the experience and demand higher quality email hosting in the future.

unpwn 10y ago

Well maybe you can tell me how you get phished without being retarded? In all my experiences phishing schemes are like bit.ly links that have a form that requires the user to enter in all their data. If you fall for something like that, i don't have much sympathy tbh

trevyn 10y ago

I think "free market types" understand and accept that the world is a messy place, and that human organizations cannot generally be trusted to consistently do what they claim. ("Your information is safe with us", etc.) I believe that this is due to fundamental properties of human nature and group psychology. I believe that there is no general way to create near-perfect accountability for the statements of people, and that the second-best option is to embrace the uncertainty and develop a finely-honed sense of risk assessment. It sounds like this is the underlying concern -- if you are unable to appropriately assess risk, and you place your trust in an organization that then betrays your trust, you feel violated and want to work toward preventing that sense of violation in the future. You could do that by working to hold organizations accountable through regulation or other means. Or you could improve your ability to assess risk, and consciously and deliberately accept risks as they come. When the inevitable adverse event happens, you understand that you consciously accepted a risk in the past, and appreciate the opportunity to refine your own personal ability to evaluate risk. So, I don't agree that this is something that needs to "get fixed". I fully expect that my basic personal information is poorly secured, and I consciously accept that in exchange for the benefits of participating in our current society and using the current services offered. It's easy to say that "we need better information security", but every decision has a tradeoff. Increasing security fundamentally increases costs, slows the flow of information, and creates less nimble organizations. Many of the services you expect to be available -- Uber, cheap IoT devices, whatever -- may simply not exist in a world where a "proper risk assessment" and "tangible cost" of information breaches are applied. You, of course, are free to spend your time educating the public about information security, or how corporations can't be trusted, or even lobbying for information security regulation. That's what makes Earth fun and interesting -- everyone's following their own passions!