5 ms·

Countless companies every year hire security auditors, and get back a 100-page report in 8 point font filled with vulnerabilities, many of them marked "severe"

by Meekro 8y ago

Countless companies every year hire security auditors, and get back a 100-page report in 8 point font filled with vulnerabilities, many of them marked "severe" or "critical." Forcing companies to then publicize those reports will be burdensome and counterproductive.

tivert 8y ago
Forcing them to publicize would also force them to spend the resources to patch them. I'm sure many companies go through those 100 pages and throw out 50 as "wontfix." Though, if you force them to publicize, you'd probably have to force them to conduct the audits, so they can't avoid the publicity/patching spend by keeping themselves in the dark.
- matwood 8y ago
  > I'm sure many companies go through those 100 pages and throw out 50 as "wontfix." I agree in principle, but it's not always that simple. Outside of the obvious "don't make your S3 buckets public", it's usually a combination of priority, cost, and compatibility. Years ago I ran a network inside the firewall of <Insert large company here>. They did constant vulnerability testing, and I had monthly meetings explaining what I was doing to mitigate all of the vulnerabilities that came up. Mitigation for some vulnerabilities meant rewriting decades old programs to run on a new OS/platform so we would harden around it the best we could while the work was done.
specialist 8y ago
I'm pretty sure you're wrong here. Publicly traded companies have to declare their risks. Cue share holder lawsuits if an identified risk was ignored and caused material damage.
s73v3r_ 8y ago
Why do I care if something like this is "burdensome" to businesses?
- wild_preference 8y ago
  Just because something is burdensome to a business does not mean it will have the intended, positive effect. At worst, you only make things worse for users and empower large incumbents without solving anything. So hopefully someone out there cares.
  - s73v3r_ 8y ago
    But the way it was said, it implied that I should care about the burden on business. I don't. If you're saying I should be concerned about unintended consequences, then I can agree with that. But I'm not going to be upset that businesses are "burdened" by doing what they should be doing in the first place.
- CamperBob2 8y ago
  Because you, as a consumer, will ultimately pay for it.

by Meekro 8y ago

tivert 8y ago

Forcing them to publicize would also force them to spend the resources to patch them. I'm sure many companies go through those 100 pages and throw out 50 as "wontfix." Though, if you force them to publicize, you'd probably have to force them to conduct the audits, so they can't avoid the publicity/patching spend by keeping themselves in the dark.

matwood 8y ago
> I'm sure many companies go through those 100 pages and throw out 50 as "wontfix." I agree in principle, but it's not always that simple. Outside of the obvious "don't make your S3 buckets public", it's usually a combination of priority, cost, and compatibility. Years ago I ran a network inside the firewall of <Insert large company here>. They did constant vulnerability testing, and I had monthly meetings explaining what I was doing to mitigate all of the vulnerabilities that came up. Mitigation for some vulnerabilities meant rewriting decades old programs to run on a new OS/platform so we would harden around it the best we could while the work was done.

specialist 8y ago

I'm pretty sure you're wrong here. Publicly traded companies have to declare their risks. Cue share holder lawsuits if an identified risk was ignored and caused material damage.

s73v3r_ 8y ago

Why do I care if something like this is "burdensome" to businesses?

wild_preference 8y ago
Just because something is burdensome to a business does not mean it will have the intended, positive effect. At worst, you only make things worse for users and empower large incumbents without solving anything. So hopefully someone out there cares.
- s73v3r_ 8y ago
  But the way it was said, it implied that I should care about the burden on business. I don't. If you're saying I should be concerned about unintended consequences, then I can agree with that. But I'm not going to be upset that businesses are "burdened" by doing what they should be doing in the first place.
CamperBob2 8y ago
Because you, as a consumer, will ultimately pay for it.