4 ms·

This is a false dichotomy. Just because the regulations we imposed in the past made things burdensome, doesn't mean that regulations we impose in the future hav

by jbob2000 9y ago

This is a false dichotomy. Just because the regulations we imposed in the past made things burdensome, doesn't mean that regulations we impose in the future have to be burdensome. I'd want to understand why they're burdensome. Give me some concrete examples. Everybody talks about how regulations are burdensome but nobody actually mentions the specific things that are a burden.

ehmish 9y ago
You're required by to set up systems to ensure accounting information can not be tampered with, even if people tampering with accounting information isn't considered to be a high risk. To make it more concrete, it means you can't push to master any more in a git repository to fix some botched merge because, it happens to deal with revenue in some tiny corner of it's functionality and every change has to be approved by multiple people
- jjoonathan 9y ago
  In light of git's enforced immutability constraints and the fact that multiple approval for merges is SOP at many large companies, I suspect that isn't a very good analogy.
  - jogjayr 9y ago
    I thought they meant that literally, and not as an analogy. At my company, developers can't do production deployments for, I've been told, "SOX compliance".
commandlinefan 9y ago
I've never dealt with SOX compliance personally, but I did deal with PCI compliance. Now, PCI compliance isn't government-mandated, but since the penalty for non-compliance is that they take away your ability to take credit cards, it's treated as though it were a government mandate in a corporate setting. My observation about PCI compliance was the regulations themselves were clear, helpful, and well thought out. The burden was the months upon months spent arguing about who interpreted which regulation which way (and God forbid you just ask the regulators!), and an apparently certifiably insane executive board that would rather spend $1000 avoiding each individual regulation than spend $10 adhering to it.

ehmish 9y ago

You're required by to set up systems to ensure accounting information can not be tampered with, even if people tampering with accounting information isn't considered to be a high risk. To make it more concrete, it means you can't push to master any more in a git repository to fix some botched merge because, it happens to deal with revenue in some tiny corner of it's functionality and every change has to be approved by multiple people

jjoonathan 9y ago
In light of git's enforced immutability constraints and the fact that multiple approval for merges is SOP at many large companies, I suspect that isn't a very good analogy.
- jogjayr 9y ago
  I thought they meant that literally, and not as an analogy. At my company, developers can't do production deployments for, I've been told, "SOX compliance".

commandlinefan 9y ago

I've never dealt with SOX compliance personally, but I did deal with PCI compliance. Now, PCI compliance isn't government-mandated, but since the penalty for non-compliance is that they take away your ability to take credit cards, it's treated as though it were a government mandate in a corporate setting. My observation about PCI compliance was the regulations themselves were clear, helpful, and well thought out. The burden was the months upon months spent arguing about who interpreted which regulation which way (and God forbid you just ask the regulators!), and an apparently certifiably insane executive board that would rather spend $1000 avoiding each individual regulation than spend $10 adhering to it.