4 ms·

"This could go really wrong if we let non-tech savvy regulators dictate tech stacks, specific hashing/encryption tools. Could work well, but just has a lot of p

"This could go really wrong if we let non-tech savvy regulators dictate tech stacks, specific hashing/encryption tools. Could work well, but just has a lot of potential to go very wrong." Engineers, capitalism, private business have utterly, completely, fully and in totality failed. This is not a little failure. Not a medium one. Not a large one. This is a foundational, cataclysmic failure of the most epic proportion. I think the time for voluntary private action has passed. If developers, their managers, their stakeholders, and their shareholders took security and privacy remotely seriously, we would not be here. We are here. It is time to admit the full and complete failure of private software companies to protect data and privacy, and time for government to create a criminal schedule for management and developers who perpetuate criminal negligence. I believe only 2 things will solve this: 1) Massive financial loss for shareholders -- they speak 1 language, US Dollars. If we say a US Citizens data is worth $100,000, then the fines would be large enough to literally destroy any firm who dared play loose with security. If there is no existential risk, there is zero motivation for compliancy. Only existential risk matters to shareholders. The rest is Cost of Doing Business. 2) Criminal liability for management and developers of products which violate security and privacy due to criminal negligence Without this, you can all but guarantee that your full identity is kept in plain-text and has already been stolen.

rm_-rf_ 9y ago
I agree that we should work to determine if there was criminal negligence and prosecute to the highest degree possible, but I find it laughable that you talk about how engineers, capitalism, and private business have completely failed. The DNC was hacked. The FBI and CIA have had their web sites hacked. The OPM had >22 million people's personal info stolen by Chinese hackers. The NSA itself has had major incidents where essentially cyber weapons were leaked. Those are just SOME of the ones we know about. Let's stop pretending like government is any more capable, or even as capable, of protecting data than competent corporations. When was the last time Facebook or Google had massive data breach? It's not about 'the corporations maaan' it's about competency and the limited consequences of screwing up so bad.
- antimatter 9y ago
  Exactly this. I don't know where people get the idea that government would do this any better. I think the best regulators could do is make SSNs obsolete. A solution where knowing every possible private data point about a person is useless when attempting to steal someone's identity.
- ams6110 9y ago
  Indeed, I have had my personal data compromised more by government agencies than private (at least, as far as I've been officially/personally notified).
ams6110 9y ago
Problem is, on what basis is a person's "private data" worth $100,000, or will the exposure thereof cause damages of $100,000? The average person's entire net worth is only a fraction of that. There is such a thing as punitive damages but in most civil cases a company or individual is not going to be held liable for more than actual damages.
- noncoml 9y ago
  > The average person's entire net worth is only a fraction of that Banks are usually happy to provide you with a credit line many times your net worth if you have a reasonable credit score.

rm_-rf_ 9y ago

I agree that we should work to determine if there was criminal negligence and prosecute to the highest degree possible, but I find it laughable that you talk about how engineers, capitalism, and private business have completely failed. The DNC was hacked. The FBI and CIA have had their web sites hacked. The OPM had >22 million people's personal info stolen by Chinese hackers. The NSA itself has had major incidents where essentially cyber weapons were leaked. Those are just SOME of the ones we know about. Let's stop pretending like government is any more capable, or even as capable, of protecting data than competent corporations. When was the last time Facebook or Google had massive data breach? It's not about 'the corporations maaan' it's about competency and the limited consequences of screwing up so bad.

antimatter 9y ago
Exactly this. I don't know where people get the idea that government would do this any better. I think the best regulators could do is make SSNs obsolete. A solution where knowing every possible private data point about a person is useless when attempting to steal someone's identity.
ams6110 9y ago
Indeed, I have had my personal data compromised more by government agencies than private (at least, as far as I've been officially/personally notified).

ams6110 9y ago

Problem is, on what basis is a person's "private data" worth $100,000, or will the exposure thereof cause damages of $100,000? The average person's entire net worth is only a fraction of that. There is such a thing as punitive damages but in most civil cases a company or individual is not going to be held liable for more than actual damages.

noncoml 9y ago
> The average person's entire net worth is only a fraction of that Banks are usually happy to provide you with a credit line many times your net worth if you have a reasonable credit score.