5 ms·

On the surface, I agree with this. In practice I expect it to result in fewer products on the market that are more expensive and no more secure as this sort of

On the surface, I agree with this. In practice I expect it to result in fewer products on the market that are more expensive and no more secure as this sort of regulation will simply select for large companies who are experts at paperwork and soft bribes. I wish I had a better idea.

5706906c06c 9y ago
Agree, regulations could deter entrepreneurs from trying since the barrier to entry could be high. Then again, regulations like HIPAA haven't really stopped a slew of Digital Health shops from trying, so it might not be as bad.
tehlike 9y ago
Utopia, but marketplaces selling only the ones they consider secure would work maybe. Similar to costco - sometimes they do not sell products that they believe don't have the quality their customers deserve.
joe_the_user 9y ago
...this sort of regulation will simply select for large companies who are experts at paperwork and soft bribes What do you mean "this sort?" Schneier just says "we need regulation", that's pretty definitely all the article says.
- wmf 9y ago
  Any regulation tends to select for companies that can appear to comply at the lowest cost.
rogerbinns 9y ago
> I wish I had a better idea Something that already works are various forms of certification. Examples are: * "Norton protected" on websites * Underwriters Laboratories on US products * US DOD Trusted Computer System Evaluation Critera for how the US military checks the security of a product * ISO 9001 for quality management * Oregon Tilth for certifying organic products Some of these are more valuable than others, but are at least a separate stamp of approval. With my magic wand I'd have a group come together to form such a certifying organisation and provide it with a marketing budget. The marketing would mirror the success of "check for a green padlock on a website to know it is secure" - look for the stamp on a product box. If that doesn't happen and there are more serious incidents is that consumers would look to Google, Apple, Amazon etc. eg if the proposed device doesn't work with the Apple hub and been vetted by Apple, then they wouldn't buy it.
- zatkin 9y ago
  What about VW though? They got around regulation.
  - csydas 9y ago
    The expectation isn't that such regulation will prevent violations of the regulation from ever happening, but instead that there is a legal mechanism by which appropriate punishment can be administered. Laws and regulations don't in-and-of themselves prevent bad behavior from happening, they just grant entities permission to apply force as a response; the force can be jail time, fines, sanctions, etc, but it's granting an entity permission to apply force if the law or regulation isn't adhered to. So yes, regulations are circumvented or ignored intentionally, but that doesn't mean that it's somehow a bad idea; the idea is to enforce positive behavior by attaching an undesirable response to not doing the positive behavior. It's meant to shape behavior in the long run, and it's why pulling funding and reach from regulatory agencies is usually shitty, as more than anything, it's meant to induce a scenario where one can say "look, we have these regulations, but X, Y, and Z continue to do the bad behavior! The regulation is senseless!"; in reality, X Y and Z have just run the costs and determined that it's cheaper to fight the regulation than to adhere to it.
- mnw21cam 9y ago
  The problem with certifying a device (presumably as secure) is that security is a process, and a device that is secure now may not be tomorrow. For a device to remain secure requires regular updates.
  - rogerbinns 9y ago
    ISO 9001 for example does certify process. I'm sure organic does too.
- porfirium 9y ago
  Do you think end consumers care at all about certifications?
disconnected 9y ago
How does regulation work in the aviation industry? The impression I have is that regulation in that space is pretty effective. Without effective regulation I imagine you'd see aircraft falling out of the sky left and right because - and let's be honest here - safety is probably at the bottom of the priorities, both for manufacturers and airline operators. Most people don't believe that accidents can happen to them. People rationalize the risk away, so they skimp on security to save a buck. So, operators don't have incentive to maintain and upgrade their aircraft because that has only a negligible effect on performance, but costs a ton and the perceived risk is low. Manufacturers, likewise, have no incentive to produce safer airplanes because safety doesn't sell: range, capacity and fuel efficiency do. Yet, air travel as never been safer. Seems to me like regulation works ok in this case.
- bschwindHN 9y ago
  > and let's be honest here - safety is probably at the bottom of the priorities, both for manufacturers and airline operators The bottom, really? That's a pretty bold statement to make, and a disservice to the work those have done to ensure we have thousands of safe flights every single day. I'm certainly not arguing against airline regulation, but I don't believe that's the only thing holding them back from crashing planes on the regular.
- icebraining 9y ago
  Seems like you just decided that the airlines would "obviously" be unsafe if not for regulation, and therefore regulation is working great. I could also say that killing your clients and crew "left and right" would be terrible for business, and that therefore regulation is useless. Neither argument seems particularly persuasive without being falsifiable.
flashman 9y ago
> this sort of regulation will simply select for large companies who are experts at paperwork and soft bribes. Which are exactly the kind of companies who can do good engineering, so why wouldn't they do that instead?

5706906c06c 9y ago

Agree, regulations could deter entrepreneurs from trying since the barrier to entry could be high. Then again, regulations like HIPAA haven't really stopped a slew of Digital Health shops from trying, so it might not be as bad.

tehlike 9y ago

Utopia, but marketplaces selling only the ones they consider secure would work maybe. Similar to costco - sometimes they do not sell products that they believe don't have the quality their customers deserve.

joe_the_user 9y ago

...this sort of regulation will simply select for large companies who are experts at paperwork and soft bribes What do you mean "this sort?" Schneier just says "we need regulation", that's pretty definitely all the article says.

wmf 9y ago
Any regulation tends to select for companies that can appear to comply at the lowest cost.

rogerbinns 9y ago

> I wish I had a better idea Something that already works are various forms of certification. Examples are: * "Norton protected" on websites * Underwriters Laboratories on US products * US DOD Trusted Computer System Evaluation Critera for how the US military checks the security of a product * ISO 9001 for quality management * Oregon Tilth for certifying organic products Some of these are more valuable than others, but are at least a separate stamp of approval. With my magic wand I'd have a group come together to form such a certifying organisation and provide it with a marketing budget. The marketing would mirror the success of "check for a green padlock on a website to know it is secure" - look for the stamp on a product box. If that doesn't happen and there are more serious incidents is that consumers would look to Google, Apple, Amazon etc. eg if the proposed device doesn't work with the Apple hub and been vetted by Apple, then they wouldn't buy it.

zatkin 9y ago
What about VW though? They got around regulation.
- csydas 9y ago
  The expectation isn't that such regulation will prevent violations of the regulation from ever happening, but instead that there is a legal mechanism by which appropriate punishment can be administered. Laws and regulations don't in-and-of themselves prevent bad behavior from happening, they just grant entities permission to apply force as a response; the force can be jail time, fines, sanctions, etc, but it's granting an entity permission to apply force if the law or regulation isn't adhered to. So yes, regulations are circumvented or ignored intentionally, but that doesn't mean that it's somehow a bad idea; the idea is to enforce positive behavior by attaching an undesirable response to not doing the positive behavior. It's meant to shape behavior in the long run, and it's why pulling funding and reach from regulatory agencies is usually shitty, as more than anything, it's meant to induce a scenario where one can say "look, we have these regulations, but X, Y, and Z continue to do the bad behavior! The regulation is senseless!"; in reality, X Y and Z have just run the costs and determined that it's cheaper to fight the regulation than to adhere to it.
mnw21cam 9y ago
The problem with certifying a device (presumably as secure) is that security is a process, and a device that is secure now may not be tomorrow. For a device to remain secure requires regular updates.
- rogerbinns 9y ago
  ISO 9001 for example does certify process. I'm sure organic does too.
porfirium 9y ago
Do you think end consumers care at all about certifications?

disconnected 9y ago

How does regulation work in the aviation industry? The impression I have is that regulation in that space is pretty effective. Without effective regulation I imagine you'd see aircraft falling out of the sky left and right because - and let's be honest here - safety is probably at the bottom of the priorities, both for manufacturers and airline operators. Most people don't believe that accidents can happen to them. People rationalize the risk away, so they skimp on security to save a buck. So, operators don't have incentive to maintain and upgrade their aircraft because that has only a negligible effect on performance, but costs a ton and the perceived risk is low. Manufacturers, likewise, have no incentive to produce safer airplanes because safety doesn't sell: range, capacity and fuel efficiency do. Yet, air travel as never been safer. Seems to me like regulation works ok in this case.

bschwindHN 9y ago
> and let's be honest here - safety is probably at the bottom of the priorities, both for manufacturers and airline operators The bottom, really? That's a pretty bold statement to make, and a disservice to the work those have done to ensure we have thousands of safe flights every single day. I'm certainly not arguing against airline regulation, but I don't believe that's the only thing holding them back from crashing planes on the regular.
icebraining 9y ago
Seems like you just decided that the airlines would "obviously" be unsafe if not for regulation, and therefore regulation is working great. I could also say that killing your clients and crew "left and right" would be terrible for business, and that therefore regulation is useless. Neither argument seems particularly persuasive without being falsifiable.

flashman 9y ago

> this sort of regulation will simply select for large companies who are experts at paperwork and soft bribes. Which are exactly the kind of companies who can do good engineering, so why wouldn't they do that instead?