15 ms·

We can no longer leave online security to the market

215 points by jaredwiener 8y ago

pg_bot 8y ago
I disagree with Bruce's assessment that government regulation is the best solution to this problem. As someone who has read a lot of government regulations regarding technology, I have often found existing regulations to be unsatisfactory when it comes to actually protecting consumers. (recommending old and broken encryption schemes, arbitrary/nonsensical password requirements, etc.) The speed at which the industry moves far outpaces the ability to regulate effectively. I would much rather see software engineers follow the lead of electrical engineers and embrace non-profit (or even for profit) certification companies à la underwriters laboratories. It would be easier for consumers as the could just see a seal of approval and know they are getting a quality product. (Think LEED certification for buildings) If anyone is interested in starting such and organization let me know as I do think it could do a lot of good in the world.
- tareqak 8y ago
  For profit certification companies can be bought out e.g. the bond ratings agencies in 2008. I think government regulations can work if they have a mandatory review every X years or self-destruct clause such that forces lawmakers to update the laws.
  - Nasrudith 8y ago
    Really it is a problem of short-term greed. An impartial and accurate one has an inherit long term value that can't be beaten except by their own failure. The odd thing is that the big three responsible for lousy ratings didn't wind up supplanted by rivals after that debacle - perhaps I am missing something.
- koolba 8y ago
  Having the government outline minimum penalties for data breaches would go a long way toward fixing the problem. It’s much easier to justify fixing a known issue or dedicating time to updating dependencies if you know there’s a defined cost (per customer!) of failing to do so.
  - SteveNuts 8y ago
    This is how I feel also. Businesses will always weigh the potential costs of a breach vs cost for proper security methods. Until you can quantify that with hard numbers for a breach, they will not take it seriously.
  - freedomben 8y ago
    I don't disagree, but it's really really hard to determine what proper liability should be. It's easy with things like "Company X left their S3 bucket publicly accessible then put PII in it." It's much less easy when "Company Y got hacked because of a 0-day in their OS kernel, or in their web server that is an open-source project, or even a 0-day in a codebase that they own but have generally very good practices on (stuff happens, even very good devs write bugs sometimes)." Does the Linux Foundation or a group of random devs on github that gave their code away for free get handed a massive and possibly bankrupting fine for that? And if so, why would anybody release code for free? If not, and you say that "GPL/MIT/etc. warrants no serviceability so it's on the adopter," then why would anybody use open source and open themselves up to the liability when they have zero control over the project and its associated quality control and process? For this reason I don't think governments can do a good job at making fair regulation that doesn't have severe unintended consequences. Something that might help tho, is providing easier civil recourse for those affected. For example, if Equifax gets hacked and leaks my identity and somebody buys a car in my name, it should be very easy for me to sue them to make it right. That's something that is clearly broken with our current system.
    - sopooneo 8y ago
      I say companies should pay a painful fine for all data breaches no matter what. They'll have to buy insurance against it, and the insurers will eventually learn to price the risk properly. And it will also be in the insurers' interest to learn how to audit their client companies.
      - TeMPOraL 8y ago
        Yup. Take GDPR. It doesn't try to price user data. If you screw up real bad, it just says, "up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher".
- zarriak 8y ago
  I think this works as long as the companies face proper financial punishment for data leaks. The reason that UL works is because it is required by insurance. This insurance would probably only exist if data leaks were expensive to deal with.
- Nasrudith 8y ago
  I think you are both right as odd as it sounds. Their regulations are terrible, every time they have been asked to come up with an algorithm it involves a backdoor that comes to bite everyone. Meanwhile security and data usage has been a blindly obvious externality and impossible to ignore externality as of Equifax. Arguably it goes back to identity theft being the consumer's problem in the first place and not the merchant who didn't properly validate. Since if Alice were to say that Bob the car dealer that Carol was the one paying for her brand new car when she wasn't even there it isn't Carol's responsibility. Alice would be the one guilty of fraud and Bob robbed - Carol isn't even a party to the transaction.
- tomc1985 8y ago
  Mandatory ethics/competency training on the engineering side (like ASE cert but for sw peeps) and quality certification on the product side, would go a long way
- nickpsecurity 8y ago
  "I disagree with Bruce's assessment that government regulation is the best solution to this problem. As someone who has read a lot of government regulations regarding technology" I pointed out it worked in the past for security and is working right now for safety: https://news.ycombinator.com/item?id=16618846 https://news.ycombinator.com/item?id=16618846 For some reason, word about the successes never gets out. It should since their defect rates are super low.
- ssss11 8y ago
  I’ve been thinking the same recently. Regulation doesn’t keep up. An industry standard code of conduct or framework, with certification and a seal to show your software adheres to the certification may be the best approach. perhaps source code or data handling processes could be audited in the scheme.
  - rickycook 8y ago
    like a certified organic seal? (which are meaningless at this point) you regulate the effect; don’t dictate a solution.
- Arn_Thor 8y ago
  The govt shouldn't mandate what exact steps companies must take to be secure, because as you say it's woefully behind the time usually. But it should heavily punish security failures. Companies can choose whatever method they want to keep customer data safe, but if they fail there will be hell to pay. That would be the ideal system as far as I can see
- jillesvangurp 8y ago
  Bruce Schneier's point is that this stuff needs to stop being optional and there needs to be accountability and liability. There currently is none. This is not true for other domains. If your car crashes because of some systematic defect that might result in expensive recalls and liability suits where the manufacturer might end up having to pay damages. Electrical engineers have a legal responsibility and certification is not optional for them. If it is optional and just a nice to have feature for which you charge extra, there will be companies not bothering. And there will be companies offering cheaper certificates and confusing customers with important looking but utterly meaningless certificates. Our industry is already full of snake oil sellers offering meaningless certificates and guarantees. This type of ass coverage only works when there's a legal stick that makes companies make sure they qualify for the right certificates. Currently companies get away with really bad stuff. There's no liability. This needs to change. Liability leads automatically to people covering their ass to avoid ending up paying damages or ending up having to do expensive product recalls. E.g. router manufacturers stop shipping updates as soon as they can get away with it; typically when they have a new model they want to sell. If the old one gets hacked their solution is selling you a new one. Not their problem. That's what needs to change. If it has a network connection, it has to be able to receive updates and those updates need to be for the lifetime of the product, not the warranty or the calendar year. Failing to ship critical updates for known vulnerabilities needs to have consequences. Google currently believes it is totally acceptable to stop shipping security updates for their phones after 3 years. Not their problem if you get hacked apparently. They don't care. The only responsible alternative (from a security point of view) for them to do would be to effectively brick phones when they stop supporting them so that users are not able to get into trouble. That would obviously be unacceptable but somehow leaving your users exposed to known security vulnerabilities is perfectly OK, perfectly legal, and completely without consequences when the obvious things happen. When bad stuff happens, there needs to be positive proof from all parties involved that they did their legally required best to prevent things. If it's a zero day bug, fine, you had no way of knowing. Shit happens. But if it then goes unpatched for 6 months because you can't be bothered to do anything about it, that's different matter. If it is a bug that was reported and fixed years ago and you product gets hacked because you couldn't be bothered to update your products that needs to have consequences.
tptacek 8y ago
One thing I've learned in ~25 years of working in what the NYT would now call "cybersecurity": Internet hacking is always "about to get much worse".
- InitialLastName 8y ago
  I mean, are they wrong? It sure appears to have been getting progressively worse. Granted, some chunk of that is from an expanding surface area vulnerable to attack, and an expanding amount of valuable data available for the taking.
  - tptacek 8y ago
    They are wrong (so far), and it is not getting progressively worse. In the 1990s, it was realistic for an amateur hacker to aim at owning up a whole backbone network. You broke into computers by running "showmount -e" and looking to see which ones were exporting their root filesystems r/w to the entire Internet. In the early 2000s, worms targeting Win32 vulnerabilities were so effective there was almost legislation. Nothing was sandboxed (except for, ironically, Java applets), and virtually every web application on the Internet was riddled with SQL injection. The first time I ever did a professional consulting application penetration test, I logged in as "admin" with 'OR''='. It's a lot more fun to be an attacker today (I mean, if you dig computer science), but I don't know a lot of people in this field who think it's gotten less challenging.
    - InitialLastName 8y ago
      Sure, perhaps hackers can do less damage than they used to be able to do. On the other hand, there appears to be a lot more damage for them to do, and a lot more data that's been lost/leaked recently. I'd call that "worse".
    - bmays 8y ago
      I think you can agree that _worse_ doesn't necessarily imply _harder_. More critical systems are online, software is more complex, more actors are in the mix, etc. Feels like semantics, anyway.
softwaredoug 8y ago
Authentication is the real issue. We treat SSNs as a lifelong shared “secret” - shared with just about everyone. When so many need to have this “secret”, trying to hide SSNs is futile. Someone should be able to steal a database of my info and whatever the shared secret is should only be tied to that org, and of course not stored in plain text.
- Covzire 8y ago
  How will everyone keep their dozens or hundreds of shared secrets safe?
  - paulryanrogers 8y ago
    Password managers appear to be growing into this role. As secret questions become increasingly ineffective better answers are random and unique. It quickly reaches the point that human memory and paper can not accommodate. EDIT: forgot 'not'
  - ehnto 8y ago
    Perhaps the consumer wouldn't have to, and what the consumer gives out is a public key that lets the org request a unique to them access key. The consumer then gets a notification that Org X has requested an SSN access key and the user confirms or denies they get access. If a company is breached they get their keys revoked. A customer can log into a gov site to manage them.
- tomjen3 8y ago
  We should publish all ssn and then move to a smartcard model where you have a government certificate and can sign things safely.
sigsergv 8y ago
Such gorvernment certfification organization (or something like that) will harm local firms and benefit chinese, because chinese companies will ignore all those regulations and flood market with cheap devices. Honestly, I cannot see any solution other than mass education system that teach people what security is and how to use it. Every consumer MUST clearly undestand what exactly he/she is going to lose when using insecure appliance.
- mr_toad 8y ago
  > flood market with cheap devices To some extent that already happens with safety regulations, & imports/sales of these products are illegal. That doesn’t mean that you should just give up.
  - craftyguy 8y ago
    Exactly. It's trivial today to purchase electronics without any required certifications (UL, FCC, etc) from aliexpress, etc. However, those certification programs are still alive and well, and knowledgable consumers can still seek them out.
ballenf 8y ago
There’s a YouTube talk from Uncle Bob where he foretells a future in which software kills some people and then regulations are put into place governing software development. I think he was close in his vision. It will be Facebook and Google and millions of IOT devices that push us to that future. Big companies won’t be hurt, but your startup better be able to afford the certs or too bad. https://youtu.be/ecIWPzGEbFc https://youtu.be/ecIWPzGEbFc
ilovecaching 8y ago
Here’s a hard reality: The people who can fix the security problem are the ones who are already working on it. There’s no magic dust or elite squad of cyber security professionals that are going to walk through the doors of a FAANG and turn things around. Security is hard, and security at global scale is still an unsolved problem that no one has the answer for. What I do know from working in the valley is that neither the government nor the media has the damndest idea of what they’re talking about when it comes to technology, and they certainly wouldn’t know how to secure Google let alone keep search running globally for a night.
- fulafel 8y ago
  Most people working on security don't have much power, and are reduced to tinkering with small incremental improvements that don't break anything. case in point: If you look at the history of malware infactions in organisations, one vector historically stands out since the early 2000's: office/pdf attachments in emails. It's been obviously a catastrophic combination to feed untrusted, unauthenticated complex office formats to insecure productivity applications, but nothing was done about it despite weekly new public vulnerabilities and pwnage continuing over 20 years.
nineteen999 8y ago
From the tone of articles like these sometimes I feel like I must be the only person left in the world without an internet connected refrigerator or robot vacuum cleaner.
- village-idiot 8y ago
  You’re not alone! I had to go with the monoprice Sous Vide cooker, since it was the only one that could be operated without a smart phone. It was also cheaper, which is nice.
  - craftyguy 8y ago
    I just ended up building a sous vide cooker with a dumb thermostat, heating element, water pump, and waterproof container. Cheap, and won't be subjected to the 'security' whims of any Internet of Trash manufacturers.
  - jmulho 8y ago
    That was a good choice. There is a nasty worm going around that will turn your water up from 55 degrees Celsius to 56 for 15 minutes ruining any chance of perfect 48 hour short ribs. It hit a lot of Michelin star restaurants in Iran really hard back in 2010.
    - ardy42 8y ago
      You jest, but sillier things have been exploited to mine bitcoin or conduct DDOS attacks before.
    - village-idiot 8y ago
      I’m more interested in having my Sous Vide cooker continuing to work after the company goes under or Google buys them and cancels support.
    - dstick 8y ago
      Pretty sure it was a lettuce centrifuge.
jumelles 8y ago
I think he's right - the line between regular hacks and cyber warfare has been blurred to invisibility, and defending the nation is one of the most basic of governmental responsibilities.
- apetrov 8y ago
  that’s a really interesting point. A good example is cops patrolling streets. But if these cops force their way into your house to “protect” you without your consent it’s not protection anymore, so voluntary consent is neccesary to make it protection and not a regulation.
  - youdontknowtho 8y ago
    Cops have always been able to force their way into your house to protect society. They aren't just protecting you, they are protecting you as part of a larger group that employs them.
jkingsbery 8y ago
"The National Institute of Standards and Technology’s Cybersecurity Framework is an excellent example of this... The Cybersecurity Framework — which contains guidance on how to identify, prevent, recover, and respond to security risks — is voluntary at this point, which means nobody follows it." How "excellent" of an example could it be if no one follows it? If he's worried about low-cost devices today that don't have security teams, it seems that fining companies for having security issues could lead to some percentage of them going bankrupt, which in turn would lead to more devices that are abandoned by their manufacturer post-launch. I also think it would, to some degree, stifle innovation. Even if what's involved is paying some fee for some new security technology or license, that's still less money that a startup can spend on the part of the product that customers are paying for. I wouldn't say we shouldn't have any sort of regulation whatsoever, I'm just skeptical that the government could do a good job of it.
- ardy42 8y ago
  >> We also need our standards to be flexible and easy to adapt to the needs of various companies, organizations, and industries. The National Institute of Standards and Technology’s Cybersecurity Framework is an excellent example of this, because its recommendations can be tailored to suit the individual needs and risks of organizations. The Cybersecurity Framework — which contains guidance on how to identify, prevent, recover, and respond to security risks — is voluntary at this point, which means nobody follows it. Making it mandatory for critical industries would be a great first step. An appropriate next step would be to implement more specific standards for industries like automobiles, medical devices, consumer goods, and critical infrastructure. > How "excellent" of an example could it be if no one follows it? I can be very excellent indeed, from the computer security perspective. The problem of why it's not followed is probably twofold: 1) organizations don't know about it (and aren't motivated to find out) and 2) business leaders don't want to spend the money to implement it if they do know. Making it mandatory nicely solves both of those issues. > If he's worried about low-cost devices today that don't have security teams, it seems that fining companies for having security issues could lead to some percentage of them going bankrupt, which in turn would lead to more devices that are abandoned by their manufacturer post-launch. That's no big loss, because those devices are inevitably abandoned today. > I wouldn't say we shouldn't have any sort of regulation whatsoever, I'm just skeptical that the government could do a good job of it. The government will do a better job at regulating in this area than anyone has ever done before, because no one has ever tried.
LeicaLatte 8y ago
At best, we will end up like China.
marnett 8y ago
The market won't solve it. Regulations won't solve it. Why can't we just have meaningful legal frameworks where impacted parties can sue these negligent corporations?
GreenToad5 8y ago
Government regulation? They can't keep themselves secure. There was just a post here a couple of days ago saying how vulnerable the DOD's systems are. How are they going to police others when they can't police themselves? I work in the banking industry where security IS regulated (by the FDIC). We have government auditors come and review our technology once a year. These guys don't know what the hell they are doing. We have had blatant security problems (now addressed) that they couldn't see right in front of their nose. Community banks have terrible security. Larger ones are better, but still rife with problems. I fail to see how government regulation and intervention has helped in my industry, or how it would help in any. If by regulations, you mean that we would get fined if some data got compromised, that already happens through negligence lawsuits. It is not an effective motivator though. In my experience, the threat/worry of bad publicity is actually the best motivator in a company getting their security up to par.
- kartan 8y ago
  > In my experience, the threat/worry of bad publicity is actually the best motivator in a company getting their security up to par. If that were just true Facebook will not exist. > I work in the banking industry where security IS regulated. We have auditors come and review our technology once a year. These guys don't know what the hell they are doing. Regulations do not make problems disappear but make the situation better. If you vote for politicians that want to improve it, instead of politicians that are paid by lobbyists to free companies of their responsibilities.
  - roms 8y ago
    > Regulations do not make problems disappear but make the situation better. I also work in banking (major financial hub in Europe). Regulation is the bane of security and data management because it adds several layers of complexity on top of already complex processes. It leads to people performing repetitive tasks to comply with regulation, leaving no time for in-depth analyses, process reviews and enhancements, and the clean-up of sensitive data. You provide a baseless assertion shoehorned with a comparison to lobbyists nobody ever brought up. I can't prove a negative but you sure didn't prove your positive.
tribby 8y ago
online security will always be cat and mouse. that has nothing to do with the market. if you get the government to step in, then it will just be the government that fails instead of the market.
- westpfelia 8y ago
  Its not entirely cat and mouse. Especially in some older banks. There is a local home town bank whose online banking only works in IE6. Its a joke.
  - tribby 8y ago
    the bank example is interesting because I do think banks might belong to a special class of institution that deserves to be regulated, but I think most other businesses really don't need it.
JoshuaAshton 8y ago
Why? Incompetence will always exist. Now youre just wanting to stifle the free internet.
deleted 8y ago
[deleted]
Kaotique 8y ago
There are already a lot of safety regulatory agencies in the world. These government sponsored organisations managed to make food and other consumer products a lot safer. These type of discussions often end up with mass control by the government versus free market will solve it by itself. The sweet spot is somewhere in the middle, like many of these agencies have proven for decades.
netcan 8y ago
"The primary reason computers are insecure is that most buyers aren’t willing to pay — in money, features, or time to market" Im not sure this is true. That the market is not producing adequately secured stuff is fact, but... It strikes me as similar to "journalism is broken because people aren't willing to pay for good journalism anymore". Maybe be it's true in a sense, but I don't think it's a useful sense. It's not like computers come in regular or secure, with a 20% discount on regular. Money is not always a direct lever on things. Some software has crappy UI. This does not generally correlate to UI spending. A much bigger influence is the type of market that software is in. "Enterprise" will likely be much worse than consumer stuff, because of market structure, incentives and hard feedback loops. Bureaucracy/rules come with costs that can't be easily priced too. For example, gdpr... The writer complains that current laws are written from a naive perspective, as if the internet existed within its jurisdiction. That nativity is inherent in regulatory/rule-based systems. GDPR was written as if it will be written by a person writing software. It's not. It is written by lawyers, hired by companies to "do gdpr." Mostly, lawyers reduced this to paperwork. Policies that must be meticulously written. Checkbox software that must be installed. Agreements with vendors that must be updated. ..All things that cost money, put lawyers and compliance officers in more powerful positions, and do very little to improve user privacy and agency over their data. If you want to start a company in a regulated market, your first hire is a compliance expert, preferably one with a personal relationship with that specific regulator. Regulators are process oriented, not results oriented. For example, let's say some drug is overprescribed. Regulators respond with new small print that must be included in ads. They will meticulously measure "compliance," but may not even take an interest in results. Ie, they may not even check to see if sale/consumption of the overprescribed drug have gone down. Anyway... Whether through regulation or whatever, security is hard. It is almost always reactive, responding to past crisis. Personally, I'd start with laws (not regulators) targeting after-the-fact disclosure. I think self reporting is the most useful/successful part of gdpr, for example. Light helps. It can also create the pressures, incentives and information required for change.
JDEW 8y ago
If anything should be regulated it's ethical hacking and security research. Having a bug bounty program that is accountable to some government agency should be mandatory for every single enterprise that does some form of development and the prizes/awards should be some function of the revenue and the severity of the vulnerability.
deleted 8y ago
[deleted]
sanchitasaha 8y ago
Absolutely should be regulated. We;ve seen so many breaches including the latest news about Google+ hiding info about their latest data breach that we need a layer on top to avoid this happening again.
dkrich 8y ago
I don’t get the premise of this. On the one hand he’s making the assertion that government regulation is needed because consumers won’t pay for added security. He then immediately goes on to say that in the past security breaches weren’t life threatening but now they are because refrigerators and cars are connected to the network. Okay so people won’t pay more for security when it’s not life threatening but this time the threats are different, but people still won’t pay more. How does he know this if the threats are different this time? Tbh though he lost me when he advocated for government regulation as the fail safe solution.
coretx 8y ago
The #1 risk are nation states. They became a threat by means of convincing politicians of "cybercrime" being ordinary violence. Violence is something the state has a monopoly thus the idea is easy to sell. However, online security should be left to the market otherwise we'll only see more "violence". Vulnerabilities kept secret and online targets being compromised.
OliverJones 8y ago
As an alternative to government regulation, how about an approach like Underwriters' Laboratories? Those guys got their start around 130 years ago with regulations about fire doors in factories. Now they have standards for all sorts of EGoT (Electric Grid of Things) devices, from lamps to toasters. They get their teeth from the fire-insurance companies who back them. If you have non-UL junk in your office, an insurance risk-manager inspector will instruct you to change it. If you have that kind of junk in your apartment, heaven help you if you have a fire and make a claim. Industrial shops have Factory Mutual filling the same role. One place I worked required Factory Mutual certification. Those guys are not fooling around; they improved our products. If Walmart and Best Buy discontinued selling uncertified IoT products it would help the cause. Even MicroCenter and Fry's could help get the ball rolling. But they can't do that until a certification process is workable. A UL or FM approach is more workable with USA attitudes toward government regulation. And workable is what we need.
- wongarsu 8y ago
  Fires are incredibly expensive, which makes everyone buy fire insurance and incentivizes fire insurances to push fire safety on their customers. In contrast, most data breaches are very cheap. In most industries the market doesn't seem to punish breaches at all, so there's only the unquantifyable cost of that data benefiting your competitors. If there was a multi-million-dollar fine on data breaches regardless of fault and countermeasures, we would get exactly what you describe: the market working to reduce risk and average insurance payouts, making everyone's life better in the process.
- kevin_b_er 8y ago
  This is a "cost for screwing up" approach. The best way to do that is to charge or fine them for such screwups. But, an under-regulated capitalism ideology stands in the way.
rexgallorum2 8y ago
I don't buy the regulation argument. Regulators will not have a sufficient understanding of the systems they are regulating, and of course regulation is too slow to react to a dynamic phenomenon. Perhaps more basic regulation stipulating liability if something goes wrong would be of use. I suggest we apply some lateral thinking to the underlying problem and approach it from another perspective entirely. Over the last 30 years or so, really since the end of the Cold War, high on idealism and technological utopianism, we've built a whole new high tech infrastructure to replace the low-tech infrastructure that preceded it. In so doing, we have invariably embraced technologies that we did not and do not understand, technologies that have never really been tested (as in been subjected to the test of time). Was this wise? Should we be using new, unproven technologies for security critical systems? These new systems have untold vulnerabilities, and their often centralised structure makes them very susceptible to disruptions. Should we not be building robust, decentralised, low tech solutions instead? Could something as fundamentally vulnerable as modern undersea cables have survived a cataclysm like the Second World War? I anticipate that any valuable data sitting on a networked device anywhere is at risk of eventually being lost, leaked, or stolen. Any networked safety critical system will be hacked or otherwise exploited (or fail catastrophically). It is only a matter of time. So much of modern (hybrid) warfare hinges on sowing discord, confusion, using disinformation and misinformation to cripple adversaries--and we have collectively built an infrastructure that is tailor made for this kind of disruption. What I mean is virtually everything that has come into being in the last 30 or so years, from complex global supply chains to modern banking. What that exists now would survive a SHTF scenario (not hard to imagine)? Again, we should be designing systems to be robust, decentralised, secure, and wherever possible, totally independent of high tech gadgetry. What use would 'identity theft' have been in the 1970s? Exactly.
hamilyon2 8y ago
Continuous security upgrades means byers no longer buy a device. They buy service and should be charged for one
- deleted 8y ago
  [deleted]
nsarafa 8y ago
We should fine companies for data breaches.
craig_peacock 8y ago
I would rather take any insecure device over any regulation from any government, particularly the US. Your government has no business interfering in what hardware I decide I should run and from who. You are a muppet.
craig_peacock 8y ago
We can no longer leave article writing to Muppets. All journalists should be HIGHLY regulated, certified and only licensed journalists are legally allowed to write articles for the public.
dustfinger 8y ago
Governments are not neutral parties. They have interest in mass surveillance. Moreover, I don't believe a neutral party is possible. Organized groups with enough motivation and resources will find a way to influence neutral parties. Just take a look at journalism, or even education, today. Both of those groups were intended to be neutral, but they are not because they are heavily influenced from outside. I know education in regulated, but it shouldn't be. I don't believe the original intention was for heavy handed political parties to use education to meld young influential minds to their liking. On a side note: companies and governments alike believe that a single security audit before each release is sufficient (many don't even do that much). They are wrong. Instead, they should be hiring a team of full-time penetration testers that work in parallel with standard quality control testers. Now back to my original train of thought. I believe the solution is exactly what we have -- natural selection. When the financial loss exceeds the executives tolerance threshold they will either fold, or adapt. The organizations that are better at adapting will survive. It will take time, but as long as the losses are great enough natural selection will affect the course of things to come.

215 points by jaredwiener 8y ago

I disagree with Bruce's assessment that government regulation is the best solution to this problem. As someone who has read a lot of government regulations regarding technology, I have often found existing regulations to be unsatisfactory when it comes to actually protecting consumers. (recommending old and broken encryption schemes, arbitrary/nonsensical password requirements, etc.) The speed at which the industry moves far outpaces the ability to regulate effectively. I would much rather see software engineers follow the lead of electrical engineers and embrace non-profit (or even for profit) certification companies à la underwriters laboratories. It would be easier for consumers as the could just see a seal of approval and know they are getting a quality product. (Think LEED certification for buildings) If anyone is interested in starting such and organization let me know as I do think it could do a lot of good in the world.

tareqak 8y ago
For profit certification companies can be bought out e.g. the bond ratings agencies in 2008. I think government regulations can work if they have a mandatory review every X years or self-destruct clause such that forces lawmakers to update the laws.
- Nasrudith 8y ago
  Really it is a problem of short-term greed. An impartial and accurate one has an inherit long term value that can't be beaten except by their own failure. The odd thing is that the big three responsible for lousy ratings didn't wind up supplanted by rivals after that debacle - perhaps I am missing something.
koolba 8y ago
Having the government outline minimum penalties for data breaches would go a long way toward fixing the problem. It’s much easier to justify fixing a known issue or dedicating time to updating dependencies if you know there’s a defined cost (per customer!) of failing to do so.
- SteveNuts 8y ago
  This is how I feel also. Businesses will always weigh the potential costs of a breach vs cost for proper security methods. Until you can quantify that with hard numbers for a breach, they will not take it seriously.
- freedomben 8y ago
  I don't disagree, but it's really really hard to determine what proper liability should be. It's easy with things like "Company X left their S3 bucket publicly accessible then put PII in it." It's much less easy when "Company Y got hacked because of a 0-day in their OS kernel, or in their web server that is an open-source project, or even a 0-day in a codebase that they own but have generally very good practices on (stuff happens, even very good devs write bugs sometimes)." Does the Linux Foundation or a group of random devs on github that gave their code away for free get handed a massive and possibly bankrupting fine for that? And if so, why would anybody release code for free? If not, and you say that "GPL/MIT/etc. warrants no serviceability so it's on the adopter," then why would anybody use open source and open themselves up to the liability when they have zero control over the project and its associated quality control and process? For this reason I don't think governments can do a good job at making fair regulation that doesn't have severe unintended consequences. Something that might help tho, is providing easier civil recourse for those affected. For example, if Equifax gets hacked and leaks my identity and somebody buys a car in my name, it should be very easy for me to sue them to make it right. That's something that is clearly broken with our current system.
  - sopooneo 8y ago
    I say companies should pay a painful fine for all data breaches no matter what. They'll have to buy insurance against it, and the insurers will eventually learn to price the risk properly. And it will also be in the insurers' interest to learn how to audit their client companies.
    - TeMPOraL 8y ago
      Yup. Take GDPR. It doesn't try to price user data. If you screw up real bad, it just says, "up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher".
zarriak 8y ago
I think this works as long as the companies face proper financial punishment for data leaks. The reason that UL works is because it is required by insurance. This insurance would probably only exist if data leaks were expensive to deal with.
Nasrudith 8y ago
I think you are both right as odd as it sounds. Their regulations are terrible, every time they have been asked to come up with an algorithm it involves a backdoor that comes to bite everyone. Meanwhile security and data usage has been a blindly obvious externality and impossible to ignore externality as of Equifax. Arguably it goes back to identity theft being the consumer's problem in the first place and not the merchant who didn't properly validate. Since if Alice were to say that Bob the car dealer that Carol was the one paying for her brand new car when she wasn't even there it isn't Carol's responsibility. Alice would be the one guilty of fraud and Bob robbed - Carol isn't even a party to the transaction.
tomc1985 8y ago
Mandatory ethics/competency training on the engineering side (like ASE cert but for sw peeps) and quality certification on the product side, would go a long way
nickpsecurity 8y ago
"I disagree with Bruce's assessment that government regulation is the best solution to this problem. As someone who has read a lot of government regulations regarding technology" I pointed out it worked in the past for security and is working right now for safety: https://news.ycombinator.com/item?id=16618846 https://news.ycombinator.com/item?id=16618846 For some reason, word about the successes never gets out. It should since their defect rates are super low.
ssss11 8y ago
I’ve been thinking the same recently. Regulation doesn’t keep up. An industry standard code of conduct or framework, with certification and a seal to show your software adheres to the certification may be the best approach. perhaps source code or data handling processes could be audited in the scheme.
- rickycook 8y ago
  like a certified organic seal? (which are meaningless at this point) you regulate the effect; don’t dictate a solution.
Arn_Thor 8y ago
The govt shouldn't mandate what exact steps companies must take to be secure, because as you say it's woefully behind the time usually. But it should heavily punish security failures. Companies can choose whatever method they want to keep customer data safe, but if they fail there will be hell to pay. That would be the ideal system as far as I can see
jillesvangurp 8y ago
Bruce Schneier's point is that this stuff needs to stop being optional and there needs to be accountability and liability. There currently is none. This is not true for other domains. If your car crashes because of some systematic defect that might result in expensive recalls and liability suits where the manufacturer might end up having to pay damages. Electrical engineers have a legal responsibility and certification is not optional for them. If it is optional and just a nice to have feature for which you charge extra, there will be companies not bothering. And there will be companies offering cheaper certificates and confusing customers with important looking but utterly meaningless certificates. Our industry is already full of snake oil sellers offering meaningless certificates and guarantees. This type of ass coverage only works when there's a legal stick that makes companies make sure they qualify for the right certificates. Currently companies get away with really bad stuff. There's no liability. This needs to change. Liability leads automatically to people covering their ass to avoid ending up paying damages or ending up having to do expensive product recalls. E.g. router manufacturers stop shipping updates as soon as they can get away with it; typically when they have a new model they want to sell. If the old one gets hacked their solution is selling you a new one. Not their problem. That's what needs to change. If it has a network connection, it has to be able to receive updates and those updates need to be for the lifetime of the product, not the warranty or the calendar year. Failing to ship critical updates for known vulnerabilities needs to have consequences. Google currently believes it is totally acceptable to stop shipping security updates for their phones after 3 years. Not their problem if you get hacked apparently. They don't care. The only responsible alternative (from a security point of view) for them to do would be to effectively brick phones when they stop supporting them so that users are not able to get into trouble. That would obviously be unacceptable but somehow leaving your users exposed to known security vulnerabilities is perfectly OK, perfectly legal, and completely without consequences when the obvious things happen. When bad stuff happens, there needs to be positive proof from all parties involved that they did their legally required best to prevent things. If it's a zero day bug, fine, you had no way of knowing. Shit happens. But if it then goes unpatched for 6 months because you can't be bothered to do anything about it, that's different matter. If it is a bug that was reported and fixed years ago and you product gets hacked because you couldn't be bothered to update your products that needs to have consequences.

tptacek 8y ago

One thing I've learned in ~25 years of working in what the NYT would now call "cybersecurity": Internet hacking is always "about to get much worse".

InitialLastName 8y ago
I mean, are they wrong? It sure appears to have been getting progressively worse. Granted, some chunk of that is from an expanding surface area vulnerable to attack, and an expanding amount of valuable data available for the taking.
- tptacek 8y ago
  They are wrong (so far), and it is not getting progressively worse. In the 1990s, it was realistic for an amateur hacker to aim at owning up a whole backbone network. You broke into computers by running "showmount -e" and looking to see which ones were exporting their root filesystems r/w to the entire Internet. In the early 2000s, worms targeting Win32 vulnerabilities were so effective there was almost legislation. Nothing was sandboxed (except for, ironically, Java applets), and virtually every web application on the Internet was riddled with SQL injection. The first time I ever did a professional consulting application penetration test, I logged in as "admin" with 'OR''='. It's a lot more fun to be an attacker today (I mean, if you dig computer science), but I don't know a lot of people in this field who think it's gotten less challenging.
  - InitialLastName 8y ago
    Sure, perhaps hackers can do less damage than they used to be able to do. On the other hand, there appears to be a lot more damage for them to do, and a lot more data that's been lost/leaked recently. I'd call that "worse".
  - bmays 8y ago
    I think you can agree that _worse_ doesn't necessarily imply _harder_. More critical systems are online, software is more complex, more actors are in the mix, etc. Feels like semantics, anyway.

softwaredoug 8y ago

Authentication is the real issue. We treat SSNs as a lifelong shared “secret” - shared with just about everyone. When so many need to have this “secret”, trying to hide SSNs is futile. Someone should be able to steal a database of my info and whatever the shared secret is should only be tied to that org, and of course not stored in plain text.

Covzire 8y ago
How will everyone keep their dozens or hundreds of shared secrets safe?
- paulryanrogers 8y ago
  Password managers appear to be growing into this role. As secret questions become increasingly ineffective better answers are random and unique. It quickly reaches the point that human memory and paper can not accommodate. EDIT: forgot 'not'
- ehnto 8y ago
  Perhaps the consumer wouldn't have to, and what the consumer gives out is a public key that lets the org request a unique to them access key. The consumer then gets a notification that Org X has requested an SSN access key and the user confirms or denies they get access. If a company is breached they get their keys revoked. A customer can log into a gov site to manage them.
tomjen3 8y ago
We should publish all ssn and then move to a smartcard model where you have a government certificate and can sign things safely.

sigsergv 8y ago

Such gorvernment certfification organization (or something like that) will harm local firms and benefit chinese, because chinese companies will ignore all those regulations and flood market with cheap devices. Honestly, I cannot see any solution other than mass education system that teach people what security is and how to use it. Every consumer MUST clearly undestand what exactly he/she is going to lose when using insecure appliance.

mr_toad 8y ago
> flood market with cheap devices To some extent that already happens with safety regulations, & imports/sales of these products are illegal. That doesn’t mean that you should just give up.
- craftyguy 8y ago
  Exactly. It's trivial today to purchase electronics without any required certifications (UL, FCC, etc) from aliexpress, etc. However, those certification programs are still alive and well, and knowledgable consumers can still seek them out.

ballenf 8y ago

There’s a YouTube talk from Uncle Bob where he foretells a future in which software kills some people and then regulations are put into place governing software development. I think he was close in his vision. It will be Facebook and Google and millions of IOT devices that push us to that future. Big companies won’t be hurt, but your startup better be able to afford the certs or too bad. https://youtu.be/ecIWPzGEbFc https://youtu.be/ecIWPzGEbFc

ilovecaching 8y ago

Here’s a hard reality: The people who can fix the security problem are the ones who are already working on it. There’s no magic dust or elite squad of cyber security professionals that are going to walk through the doors of a FAANG and turn things around. Security is hard, and security at global scale is still an unsolved problem that no one has the answer for. What I do know from working in the valley is that neither the government nor the media has the damndest idea of what they’re talking about when it comes to technology, and they certainly wouldn’t know how to secure Google let alone keep search running globally for a night.

fulafel 8y ago
Most people working on security don't have much power, and are reduced to tinkering with small incremental improvements that don't break anything. case in point: If you look at the history of malware infactions in organisations, one vector historically stands out since the early 2000's: office/pdf attachments in emails. It's been obviously a catastrophic combination to feed untrusted, unauthenticated complex office formats to insecure productivity applications, but nothing was done about it despite weekly new public vulnerabilities and pwnage continuing over 20 years.

nineteen999 8y ago

From the tone of articles like these sometimes I feel like I must be the only person left in the world without an internet connected refrigerator or robot vacuum cleaner.

village-idiot 8y ago
You’re not alone! I had to go with the monoprice Sous Vide cooker, since it was the only one that could be operated without a smart phone. It was also cheaper, which is nice.
- craftyguy 8y ago
  I just ended up building a sous vide cooker with a dumb thermostat, heating element, water pump, and waterproof container. Cheap, and won't be subjected to the 'security' whims of any Internet of Trash manufacturers.
- jmulho 8y ago
  That was a good choice. There is a nasty worm going around that will turn your water up from 55 degrees Celsius to 56 for 15 minutes ruining any chance of perfect 48 hour short ribs. It hit a lot of Michelin star restaurants in Iran really hard back in 2010.
  - ardy42 8y ago
    You jest, but sillier things have been exploited to mine bitcoin or conduct DDOS attacks before.
  - village-idiot 8y ago
    I’m more interested in having my Sous Vide cooker continuing to work after the company goes under or Google buys them and cancels support.
  - dstick 8y ago
    Pretty sure it was a lettuce centrifuge.

jumelles 8y ago

I think he's right - the line between regular hacks and cyber warfare has been blurred to invisibility, and defending the nation is one of the most basic of governmental responsibilities.

apetrov 8y ago
that’s a really interesting point. A good example is cops patrolling streets. But if these cops force their way into your house to “protect” you without your consent it’s not protection anymore, so voluntary consent is neccesary to make it protection and not a regulation.
- youdontknowtho 8y ago
  Cops have always been able to force their way into your house to protect society. They aren't just protecting you, they are protecting you as part of a larger group that employs them.

jkingsbery 8y ago

"The National Institute of Standards and Technology’s Cybersecurity Framework is an excellent example of this... The Cybersecurity Framework — which contains guidance on how to identify, prevent, recover, and respond to security risks — is voluntary at this point, which means nobody follows it." How "excellent" of an example could it be if no one follows it? If he's worried about low-cost devices today that don't have security teams, it seems that fining companies for having security issues could lead to some percentage of them going bankrupt, which in turn would lead to more devices that are abandoned by their manufacturer post-launch. I also think it would, to some degree, stifle innovation. Even if what's involved is paying some fee for some new security technology or license, that's still less money that a startup can spend on the part of the product that customers are paying for. I wouldn't say we shouldn't have any sort of regulation whatsoever, I'm just skeptical that the government could do a good job of it.

ardy42 8y ago
>> We also need our standards to be flexible and easy to adapt to the needs of various companies, organizations, and industries. The National Institute of Standards and Technology’s Cybersecurity Framework is an excellent example of this, because its recommendations can be tailored to suit the individual needs and risks of organizations. The Cybersecurity Framework — which contains guidance on how to identify, prevent, recover, and respond to security risks — is voluntary at this point, which means nobody follows it. Making it mandatory for critical industries would be a great first step. An appropriate next step would be to implement more specific standards for industries like automobiles, medical devices, consumer goods, and critical infrastructure. > How "excellent" of an example could it be if no one follows it? I can be very excellent indeed, from the computer security perspective. The problem of why it's not followed is probably twofold: 1) organizations don't know about it (and aren't motivated to find out) and 2) business leaders don't want to spend the money to implement it if they do know. Making it mandatory nicely solves both of those issues. > If he's worried about low-cost devices today that don't have security teams, it seems that fining companies for having security issues could lead to some percentage of them going bankrupt, which in turn would lead to more devices that are abandoned by their manufacturer post-launch. That's no big loss, because those devices are inevitably abandoned today. > I wouldn't say we shouldn't have any sort of regulation whatsoever, I'm just skeptical that the government could do a good job of it. The government will do a better job at regulating in this area than anyone has ever done before, because no one has ever tried.

LeicaLatte 8y ago

At best, we will end up like China.

marnett 8y ago

The market won't solve it. Regulations won't solve it. Why can't we just have meaningful legal frameworks where impacted parties can sue these negligent corporations?

GreenToad5 8y ago

Government regulation? They can't keep themselves secure. There was just a post here a couple of days ago saying how vulnerable the DOD's systems are. How are they going to police others when they can't police themselves? I work in the banking industry where security IS regulated (by the FDIC). We have government auditors come and review our technology once a year. These guys don't know what the hell they are doing. We have had blatant security problems (now addressed) that they couldn't see right in front of their nose. Community banks have terrible security. Larger ones are better, but still rife with problems. I fail to see how government regulation and intervention has helped in my industry, or how it would help in any. If by regulations, you mean that we would get fined if some data got compromised, that already happens through negligence lawsuits. It is not an effective motivator though. In my experience, the threat/worry of bad publicity is actually the best motivator in a company getting their security up to par.

kartan 8y ago
> In my experience, the threat/worry of bad publicity is actually the best motivator in a company getting their security up to par. If that were just true Facebook will not exist. > I work in the banking industry where security IS regulated. We have auditors come and review our technology once a year. These guys don't know what the hell they are doing. Regulations do not make problems disappear but make the situation better. If you vote for politicians that want to improve it, instead of politicians that are paid by lobbyists to free companies of their responsibilities.
- roms 8y ago
  > Regulations do not make problems disappear but make the situation better. I also work in banking (major financial hub in Europe). Regulation is the bane of security and data management because it adds several layers of complexity on top of already complex processes. It leads to people performing repetitive tasks to comply with regulation, leaving no time for in-depth analyses, process reviews and enhancements, and the clean-up of sensitive data. You provide a baseless assertion shoehorned with a comparison to lobbyists nobody ever brought up. I can't prove a negative but you sure didn't prove your positive.

tribby 8y ago

online security will always be cat and mouse. that has nothing to do with the market. if you get the government to step in, then it will just be the government that fails instead of the market.

westpfelia 8y ago
Its not entirely cat and mouse. Especially in some older banks. There is a local home town bank whose online banking only works in IE6. Its a joke.
- tribby 8y ago
  the bank example is interesting because I do think banks might belong to a special class of institution that deserves to be regulated, but I think most other businesses really don't need it.

JoshuaAshton 8y ago

Why? Incompetence will always exist. Now youre just wanting to stifle the free internet.

deleted 8y ago

[deleted]

Kaotique 8y ago

There are already a lot of safety regulatory agencies in the world. These government sponsored organisations managed to make food and other consumer products a lot safer. These type of discussions often end up with mass control by the government versus free market will solve it by itself. The sweet spot is somewhere in the middle, like many of these agencies have proven for decades.

netcan 8y ago

"The primary reason computers are insecure is that most buyers aren’t willing to pay — in money, features, or time to market" Im not sure this is true. That the market is not producing adequately secured stuff is fact, but... It strikes me as similar to "journalism is broken because people aren't willing to pay for good journalism anymore". Maybe be it's true in a sense, but I don't think it's a useful sense. It's not like computers come in regular or secure, with a 20% discount on regular. Money is not always a direct lever on things. Some software has crappy UI. This does not generally correlate to UI spending. A much bigger influence is the type of market that software is in. "Enterprise" will likely be much worse than consumer stuff, because of market structure, incentives and hard feedback loops. Bureaucracy/rules come with costs that can't be easily priced too. For example, gdpr... The writer complains that current laws are written from a naive perspective, as if the internet existed within its jurisdiction. That nativity is inherent in regulatory/rule-based systems. GDPR was written as if it will be written by a person writing software. It's not. It is written by lawyers, hired by companies to "do gdpr." Mostly, lawyers reduced this to paperwork. Policies that must be meticulously written. Checkbox software that must be installed. Agreements with vendors that must be updated. ..All things that cost money, put lawyers and compliance officers in more powerful positions, and do very little to improve user privacy and agency over their data. If you want to start a company in a regulated market, your first hire is a compliance expert, preferably one with a personal relationship with that specific regulator. Regulators are process oriented, not results oriented. For example, let's say some drug is overprescribed. Regulators respond with new small print that must be included in ads. They will meticulously measure "compliance," but may not even take an interest in results. Ie, they may not even check to see if sale/consumption of the overprescribed drug have gone down. Anyway... Whether through regulation or whatever, security is hard. It is almost always reactive, responding to past crisis. Personally, I'd start with laws (not regulators) targeting after-the-fact disclosure. I think self reporting is the most useful/successful part of gdpr, for example. Light helps. It can also create the pressures, incentives and information required for change.

JDEW 8y ago

If anything should be regulated it's ethical hacking and security research. Having a bug bounty program that is accountable to some government agency should be mandatory for every single enterprise that does some form of development and the prizes/awards should be some function of the revenue and the severity of the vulnerability.

deleted 8y ago

[deleted]

sanchitasaha 8y ago

Absolutely should be regulated. We;ve seen so many breaches including the latest news about Google+ hiding info about their latest data breach that we need a layer on top to avoid this happening again.

dkrich 8y ago

I don’t get the premise of this. On the one hand he’s making the assertion that government regulation is needed because consumers won’t pay for added security. He then immediately goes on to say that in the past security breaches weren’t life threatening but now they are because refrigerators and cars are connected to the network. Okay so people won’t pay more for security when it’s not life threatening but this time the threats are different, but people still won’t pay more. How does he know this if the threats are different this time? Tbh though he lost me when he advocated for government regulation as the fail safe solution.

coretx 8y ago

The #1 risk are nation states. They became a threat by means of convincing politicians of "cybercrime" being ordinary violence. Violence is something the state has a monopoly thus the idea is easy to sell. However, online security should be left to the market otherwise we'll only see more "violence". Vulnerabilities kept secret and online targets being compromised.

OliverJones 8y ago

As an alternative to government regulation, how about an approach like Underwriters' Laboratories? Those guys got their start around 130 years ago with regulations about fire doors in factories. Now they have standards for all sorts of EGoT (Electric Grid of Things) devices, from lamps to toasters. They get their teeth from the fire-insurance companies who back them. If you have non-UL junk in your office, an insurance risk-manager inspector will instruct you to change it. If you have that kind of junk in your apartment, heaven help you if you have a fire and make a claim. Industrial shops have Factory Mutual filling the same role. One place I worked required Factory Mutual certification. Those guys are not fooling around; they improved our products. If Walmart and Best Buy discontinued selling uncertified IoT products it would help the cause. Even MicroCenter and Fry's could help get the ball rolling. But they can't do that until a certification process is workable. A UL or FM approach is more workable with USA attitudes toward government regulation. And workable is what we need.

wongarsu 8y ago
Fires are incredibly expensive, which makes everyone buy fire insurance and incentivizes fire insurances to push fire safety on their customers. In contrast, most data breaches are very cheap. In most industries the market doesn't seem to punish breaches at all, so there's only the unquantifyable cost of that data benefiting your competitors. If there was a multi-million-dollar fine on data breaches regardless of fault and countermeasures, we would get exactly what you describe: the market working to reduce risk and average insurance payouts, making everyone's life better in the process.
kevin_b_er 8y ago
This is a "cost for screwing up" approach. The best way to do that is to charge or fine them for such screwups. But, an under-regulated capitalism ideology stands in the way.

rexgallorum2 8y ago

I don't buy the regulation argument. Regulators will not have a sufficient understanding of the systems they are regulating, and of course regulation is too slow to react to a dynamic phenomenon. Perhaps more basic regulation stipulating liability if something goes wrong would be of use. I suggest we apply some lateral thinking to the underlying problem and approach it from another perspective entirely. Over the last 30 years or so, really since the end of the Cold War, high on idealism and technological utopianism, we've built a whole new high tech infrastructure to replace the low-tech infrastructure that preceded it. In so doing, we have invariably embraced technologies that we did not and do not understand, technologies that have never really been tested (as in been subjected to the test of time). Was this wise? Should we be using new, unproven technologies for security critical systems? These new systems have untold vulnerabilities, and their often centralised structure makes them very susceptible to disruptions. Should we not be building robust, decentralised, low tech solutions instead? Could something as fundamentally vulnerable as modern undersea cables have survived a cataclysm like the Second World War? I anticipate that any valuable data sitting on a networked device anywhere is at risk of eventually being lost, leaked, or stolen. Any networked safety critical system will be hacked or otherwise exploited (or fail catastrophically). It is only a matter of time. So much of modern (hybrid) warfare hinges on sowing discord, confusion, using disinformation and misinformation to cripple adversaries--and we have collectively built an infrastructure that is tailor made for this kind of disruption. What I mean is virtually everything that has come into being in the last 30 or so years, from complex global supply chains to modern banking. What that exists now would survive a SHTF scenario (not hard to imagine)? Again, we should be designing systems to be robust, decentralised, secure, and wherever possible, totally independent of high tech gadgetry. What use would 'identity theft' have been in the 1970s? Exactly.

hamilyon2 8y ago

Continuous security upgrades means byers no longer buy a device. They buy service and should be charged for one

deleted 8y ago
[deleted]

nsarafa 8y ago

We should fine companies for data breaches.

craig_peacock 8y ago

I would rather take any insecure device over any regulation from any government, particularly the US. Your government has no business interfering in what hardware I decide I should run and from who. You are a muppet.

craig_peacock 8y ago

We can no longer leave article writing to Muppets. All journalists should be HIGHLY regulated, certified and only licensed journalists are legally allowed to write articles for the public.

dustfinger 8y ago

Governments are not neutral parties. They have interest in mass surveillance. Moreover, I don't believe a neutral party is possible. Organized groups with enough motivation and resources will find a way to influence neutral parties. Just take a look at journalism, or even education, today. Both of those groups were intended to be neutral, but they are not because they are heavily influenced from outside. I know education in regulated, but it shouldn't be. I don't believe the original intention was for heavy handed political parties to use education to meld young influential minds to their liking. On a side note: companies and governments alike believe that a single security audit before each release is sufficient (many don't even do that much). They are wrong. Instead, they should be hiring a team of full-time penetration testers that work in parallel with standard quality control testers. Now back to my original train of thought. I believe the solution is exactly what we have -- natural selection. When the financial loss exceeds the executives tolerance threshold they will either fold, or adapt. The organizations that are better at adapting will survive. It will take time, but as long as the losses are great enough natural selection will affect the course of things to come.