3 ms·

> I wish I had a better idea Something that already works are various forms of certification. Examples are: * "Norton protected" on websites * Underwriters

> I wish I had a better idea Something that already works are various forms of certification. Examples are: * "Norton protected" on websites * Underwriters Laboratories on US products * US DOD Trusted Computer System Evaluation Critera for how the US military checks the security of a product * ISO 9001 for quality management * Oregon Tilth for certifying organic products Some of these are more valuable than others, but are at least a separate stamp of approval. With my magic wand I'd have a group come together to form such a certifying organisation and provide it with a marketing budget. The marketing would mirror the success of "check for a green padlock on a website to know it is secure" - look for the stamp on a product box. If that doesn't happen and there are more serious incidents is that consumers would look to Google, Apple, Amazon etc. eg if the proposed device doesn't work with the Apple hub and been vetted by Apple, then they wouldn't buy it.

zatkin 9y ago
What about VW though? They got around regulation.
- csydas 9y ago
  The expectation isn't that such regulation will prevent violations of the regulation from ever happening, but instead that there is a legal mechanism by which appropriate punishment can be administered. Laws and regulations don't in-and-of themselves prevent bad behavior from happening, they just grant entities permission to apply force as a response; the force can be jail time, fines, sanctions, etc, but it's granting an entity permission to apply force if the law or regulation isn't adhered to. So yes, regulations are circumvented or ignored intentionally, but that doesn't mean that it's somehow a bad idea; the idea is to enforce positive behavior by attaching an undesirable response to not doing the positive behavior. It's meant to shape behavior in the long run, and it's why pulling funding and reach from regulatory agencies is usually shitty, as more than anything, it's meant to induce a scenario where one can say "look, we have these regulations, but X, Y, and Z continue to do the bad behavior! The regulation is senseless!"; in reality, X Y and Z have just run the costs and determined that it's cheaper to fight the regulation than to adhere to it.
mnw21cam 9y ago
The problem with certifying a device (presumably as secure) is that security is a process, and a device that is secure now may not be tomorrow. For a device to remain secure requires regular updates.
- rogerbinns 9y ago
  ISO 9001 for example does certify process. I'm sure organic does too.
porfirium 9y ago
Do you think end consumers care at all about certifications?
- rogerbinns 9y ago
  Consumers certainly can't evaluate each product individually, and that is where certification is a simpler form of evaluation. It also isn't necessary for every consumer to care about certification. All it takes is a minority to do so - enough to tip sales away from the competition. Certification is also easy to mention in reviews and product feature lists.

zatkin 9y ago

What about VW though? They got around regulation.

csydas 9y ago
The expectation isn't that such regulation will prevent violations of the regulation from ever happening, but instead that there is a legal mechanism by which appropriate punishment can be administered. Laws and regulations don't in-and-of themselves prevent bad behavior from happening, they just grant entities permission to apply force as a response; the force can be jail time, fines, sanctions, etc, but it's granting an entity permission to apply force if the law or regulation isn't adhered to. So yes, regulations are circumvented or ignored intentionally, but that doesn't mean that it's somehow a bad idea; the idea is to enforce positive behavior by attaching an undesirable response to not doing the positive behavior. It's meant to shape behavior in the long run, and it's why pulling funding and reach from regulatory agencies is usually shitty, as more than anything, it's meant to induce a scenario where one can say "look, we have these regulations, but X, Y, and Z continue to do the bad behavior! The regulation is senseless!"; in reality, X Y and Z have just run the costs and determined that it's cheaper to fight the regulation than to adhere to it.

mnw21cam 9y ago

The problem with certifying a device (presumably as secure) is that security is a process, and a device that is secure now may not be tomorrow. For a device to remain secure requires regular updates.

rogerbinns 9y ago
ISO 9001 for example does certify process. I'm sure organic does too.

porfirium 9y ago

Do you think end consumers care at all about certifications?

rogerbinns 9y ago
Consumers certainly can't evaluate each product individually, and that is where certification is a simpler form of evaluation. It also isn't necessary for every consumer to care about certification. All it takes is a minority to do so - enough to tip sales away from the competition. Certification is also easy to mention in reviews and product feature lists.