3 ms·

You can bet all you want. Your head will roll next, after Equifax and everyone else you decide to demonize. Once the avalanche starts, it won't stop. Know what

You can bet all you want. Your head will roll next, after Equifax and everyone else you decide to demonize. Once the avalanche starts, it won't stop. Know what happens when you demonize something? People stop reporting it. Look at the actual damage to actual people. You are arguing for prison time for the execs, if I remember correctly. Yet it's unclear that a single person has yet been materially damaged by these leaks. If you want to suck away N years of someone's life, you have a higher bar to clear.

js2 9y ago
(Meta: I think we edited our replies past each other.) I haven't commented on the Equifax incident, so you're confusing me for someone else. I don't have an opinion one way or the other on criminal negligence. How do we incentivize (or regulate?) companies to do a better job handling confidential data?
- sillysaurus3 9y ago
  Ah, gotcha. Isn't it a bit scary seeing people argue for prison time for this? It's pretty easy to imagine webdevs becoming the actual targets / scapegoats rather than the execs. A note of "Well, let's not be too hasty" would seem to be in order. Part of the problem is that security breaches matter, but they don't matter. It's like the negative externality of factory pollution. One day perhaps the effects will become visible, but this disaster is about as bad as you can get and it's still not obvious that a lot of people are going to lose anything significant from the breach. If someone wanted to impersonate you, they can usually find a way already. Of course, if the 140M SSNs become public, that will change the situation completely. Possibly even for the better: then we'd finally stop relying on them to be secret when they were never designed to be. Believe it or not, the situation now is drastically better than it was a decade ago. People care about getting pentests now. You can grudgingly force a company to fork over the money. One of the best ways to get companies to become more secure is to force them. Most of the companies who were being pentested didn't want to be; they were forced to, because some other business refused to do business with them until they produced a document stating they were reasonably secure. This special document is only obtainable from a security firm; hence, pentests happen, and the world is marginally more secure.
  - deleted 9y ago
    [deleted]
  - jonmb 9y ago
    From what I've seen people want jail time because of the insider stock trading, not because of the security problem itself. So a webdev wouldn't be responsible unless they also engaged in insider trading.

js2 9y ago

(Meta: I think we edited our replies past each other.) I haven't commented on the Equifax incident, so you're confusing me for someone else. I don't have an opinion one way or the other on criminal negligence. How do we incentivize (or regulate?) companies to do a better job handling confidential data?

sillysaurus3 9y ago
Ah, gotcha. Isn't it a bit scary seeing people argue for prison time for this? It's pretty easy to imagine webdevs becoming the actual targets / scapegoats rather than the execs. A note of "Well, let's not be too hasty" would seem to be in order. Part of the problem is that security breaches matter, but they don't matter. It's like the negative externality of factory pollution. One day perhaps the effects will become visible, but this disaster is about as bad as you can get and it's still not obvious that a lot of people are going to lose anything significant from the breach. If someone wanted to impersonate you, they can usually find a way already. Of course, if the 140M SSNs become public, that will change the situation completely. Possibly even for the better: then we'd finally stop relying on them to be secret when they were never designed to be. Believe it or not, the situation now is drastically better than it was a decade ago. People care about getting pentests now. You can grudgingly force a company to fork over the money. One of the best ways to get companies to become more secure is to force them. Most of the companies who were being pentested didn't want to be; they were forced to, because some other business refused to do business with them until they produced a document stating they were reasonably secure. This special document is only obtainable from a security firm; hence, pentests happen, and the world is marginally more secure.
- deleted 9y ago
  [deleted]
- jonmb 9y ago
  From what I've seen people want jail time because of the insider stock trading, not because of the security problem itself. So a webdev wouldn't be responsible unless they also engaged in insider trading.