3 ms·

It might happen but I don't think it'll work. Codes work because they deal with known, predictable, and repeated problems. You can keep improving the fire code

by blfr 9y ago

It might happen but I don't think it'll work. Codes work because they deal with known, predictable, and repeated problems. You can keep improving the fire code with each disastrous fire and fire will not actively try to outsmart you next time. Security OTOH is anti-inductive because you're dealing with intelligent attackers adjusting their methods. In this environment, security code and certifications will just become another pile of papers for bureaucrats to verify after your data was leaked anyway. But maybe it will at least force manufacturers to make their products' software updateable.

romwell 9y ago
I disagree. The attackers can't get the data if you don't store that data to begin with. Voila! I think there should be legislation that simply restricts who can store which data, as well as legislation that forces open-sourcing of critical infrastructure software.
- thanksgiving 9y ago
  We can't even agree on a very weak version: if you store personally identifiable information about me, you MUST share it with me. It does not matter if you're a local corner store or the CIA. You may not store personally identifiable information about me without telling me all about what you're storing. I bring it up and conversation shuts down. Nobody likes it. Therefore, I submit that what you're saying won't happen either.
- stuaxo 9y ago
  I think it's predictable if certain data is stored that others will want it. Maybe this is extreme - but the rule should be not to store it at all if possible.
amelius 9y ago
> But maybe it will at least force manufacturers to make their products' software updateable. Hopefully, those updates will NOT be performed remotely by the manufacturers though. Imagine a self-driving car company rushing a quick-and-dirty fix to each of its cars remotely. I'm hoping that at least some certification institute will be sitting in between both parties to make sure everything is tested correctly before it's pushed to the consumer.
MR4D 9y ago
There are many ideas to make this workable. How about this: Did you test your code for buffer overflows? If not, you're negligent. Maybe you need to submit an affidavit that the code has ben tested, a log from an outside testing service (similar to a building inspector, but for code quality), or some other step to verify that something has been done. For the record, building inspections have flaws, too, but they sure help in spite of those issues! Many other ideas, but that one is simple to communicate.

by blfr 9y ago

romwell 9y ago

I disagree. The attackers can't get the data if you don't store that data to begin with. Voila! I think there should be legislation that simply restricts who can store which data, as well as legislation that forces open-sourcing of critical infrastructure software.

thanksgiving 9y ago
We can't even agree on a very weak version: if you store personally identifiable information about me, you MUST share it with me. It does not matter if you're a local corner store or the CIA. You may not store personally identifiable information about me without telling me all about what you're storing. I bring it up and conversation shuts down. Nobody likes it. Therefore, I submit that what you're saying won't happen either.
stuaxo 9y ago
I think it's predictable if certain data is stored that others will want it. Maybe this is extreme - but the rule should be not to store it at all if possible.

amelius 9y ago

> But maybe it will at least force manufacturers to make their products' software updateable. Hopefully, those updates will NOT be performed remotely by the manufacturers though. Imagine a self-driving car company rushing a quick-and-dirty fix to each of its cars remotely. I'm hoping that at least some certification institute will be sitting in between both parties to make sure everything is tested correctly before it's pushed to the consumer.

MR4D 9y ago

There are many ideas to make this workable. How about this: Did you test your code for buffer overflows? If not, you're negligent. Maybe you need to submit an affidavit that the code has ben tested, a log from an outside testing service (similar to a building inspector, but for code quality), or some other step to verify that something has been done. For the record, building inspections have flaws, too, but they sure help in spite of those issues! Many other ideas, but that one is simple to communicate.