3 ms·

CTO is criminally liable for technical breaches involving their company. They're supposed to be responsible for this anyway, but given that at worst they receiv

CTO is criminally liable for technical breaches involving their company. They're supposed to be responsible for this anyway, but given that at worst they receive a slap on the wrist and their company gets fined, clearly more needs to be done. You might counter: well no one will be willing to be CTO if it involves such personal risk. I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough, or they can show sufficient due diligence that they won't end up in jail. I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure and not a minimum viable product full of holes like this.

jacquesm 9y ago
> well no one will be willing to be CTO if it involves such personal risk. Of course they would. Compensation would go up and the good ones would be readily employed. The hard part would be to make such liability stick.
smsm42 9y ago
> CTO is criminally liable for technical breaches involving their company Which means CTOs would have huge incentive to conceal such breaches and persecute anybody who would report them. Also, CTOs would require huge money to cover the risks, and probably wide insurance coverage like medical malpractice insurance. Which is five-figure number at least. I wonder which startup could afford that. > I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough They surely can spend money on lawyers writing tricky contracts and acquiring various expensive certifications. As for whether it'd make their software any more secure - this is much more doubtful. > I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure That implicitly assumes right now the problem in software being insecure is because not enough money is spent on it, and if software would be more expensive, it would be more secure. This assumption does not seem to be true.

jacquesm 9y ago

> well no one will be willing to be CTO if it involves such personal risk. Of course they would. Compensation would go up and the good ones would be readily employed. The hard part would be to make such liability stick.

smsm42 9y ago

> CTO is criminally liable for technical breaches involving their company Which means CTOs would have huge incentive to conceal such breaches and persecute anybody who would report them. Also, CTOs would require huge money to cover the risks, and probably wide insurance coverage like medical malpractice insurance. Which is five-figure number at least. I wonder which startup could afford that. > I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough They surely can spend money on lawyers writing tricky contracts and acquiring various expensive certifications. As for whether it'd make their software any more secure - this is much more doubtful. > I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure That implicitly assumes right now the problem in software being insecure is because not enough money is spent on it, and if software would be more expensive, it would be more secure. This assumption does not seem to be true.