> So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? With big enoug

> So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? With big enough repercussions it should incentivize processes that don't allow it to happen in the first place. This is how HIPPA and various other things work already and it does a decent job (not perfect though). I'd also say that we need decide if mistakes are forgivable and whether or not if it's based on impact. Perhaps for a small data leak it's forgivable, and we won't hit them with a huge fine or whatever. If it's a big leak then maybe we need to jail people. It's a bit of a strawman to say everything has security holes because it's assuming the problem is unfixable from the start. It's a bit like launching a person into space. "We know that probability we'll be sending people to their death is high, let's not bother then." We decided to do it anyway but we set extremely high bars for safety.