6 ms·

Going to play the devil’s advocate. If you fine Facebook, you have to fine the small companies too, and even individual developers developing OSS, since the law

Going to play the devil’s advocate. If you fine Facebook, you have to fine the small companies too, and even individual developers developing OSS, since the law should apply to everyone equally. Of course the fines have to be proportional to the number of affected users. So would you like a fine for your bugs? And note that contrary to other professions, software development doesn’t have generally agreed recipes for building bug-free software, so was that really negligence? Was it malpractice? Being fined for a contribution to an OSS project would be terrible, wouldn’t it? And no, the size of the company doesn’t and shouldn’t matter in the eyes of the law, only the impact. Also people uploading stuff on the Internet should really expect a best effort privacy. If you expect secrecy, then uploading shit on a platform meant for sharing is pretty dumb. Note that I will blame Facebook for willful privacy violations. And I hope to see them suffer under GDPR. But a bug doesn’t fall in the same category.

spiderPig 8y ago
Hoarding data is different from OSS. We’re talking about infra providers. IMO, they should be regulated like public utility companies.
- bad_user 8y ago
  Really, so does Mastodon qualify? https://joinmastodon.org/ https://joinmastodon.org/ How about a blog commenting system that leaks emails due to a bug, something like Isso: https://posativ.org/isso/ https://posativ.org/isso/ Basically I don't like these arguments because it's about the company's size. Facebook should be punished because they are big, have a lot of data and we don't like them, right? No matter how you look at it, it's a Pandora's box.
  - Apocryphon 8y ago
    Maybe there should be a general regulatory framework which all data-storing entities should be subjected to, with stiff penalties for the largest violators, as they can shoulder the burden of the biggest burdens. Is this not how it works for every other industry? Up until the 2008 bank bailouts, that is.
    - bad_user 8y ago
      That does not answer my questions. So what should the penalty be for a 14 year old that contributes a bug into a project like Mastodon or OpenSSH or whatever, which then leaks the data of tens of millions of people? All this would do is to have a chilling effect on the industry such that only big companies like Facebook will be able to develop critical software, due to being able to afford it. And yes, this happens in all the industries you're talking about. And it did not stop the market from crashing, it did not stop malpractice. Also this regulation will probably not stop Facebook from lawfully violating privacy.
      - Apocryphon 8y ago
        Maybe there should be a chilling effect on the industry, and the drive to consume ever more personal data is harmful to society and wrong.
        bad_user 8y ago
        Oh, but that's the thing, there's no regulation that can stop the consumption of personal data. Let's be clear, we are talking about bugs. The consumption of personal data will continue, because: 1. consumers want it 2. governments want it The only thing regulation will accomplish is that only companies like Facebook will be able to do it. Yeah, big win.
794CD01 8y ago
Absolutely. Fine everyone into the ground. Doesn't look like there is any other way to make people take security seriously. I'm not a fan of the overregulation of industries like aviation, but consumer software has gone too far in the other direction and is long overdue for an adjustment.
- UncleMeat 8y ago
  The end result of this is that the number of software companies drops by 99.99%. Does your company run anything on Linux? Too bad, there are vulns in the kernel and now you are fined into the ground.
  - 794CD01 8y ago
    I would hope for 100. We deserve it. Though of course others deserve it more.
  - rapind 8y ago
    Let's assume you're not being dramatic. It would be a pretty lucrative market if 99.99% of current software companies went under. New businesses would show up with a much greater focus on security and quality. That's a bad thing? The realm problem is the inevitable regulatory capture that occurs in every market with even an ounce of complexity. Given the number of high profile breaches we see every month, I definitely think we're due for some consequences.
- bad_user 8y ago
  Really? How has "consumer software gone too far in the other direction"? Does it ... kill people? Does it enforce bad policies like the healthcare industry did for the past couple of decades, causing an epidemic of obesity, diabetes and heart disease, which are the top causes of death? Yeah, regulation there definitely helped /s
  - bosie 8y ago
    > Does it ... kill people? Facebook asked users to upload nude photos. what if those get leaked and users commit suicide because of it? Would you (partially) blame facebook for their death? > Does it enforce bad policies like the healthcare industry did for the past couple of decades, causing an epidemic of obesity, diabetes and heart disease, which are the top causes of death? Genuine question but what policies are the reasons for the epidemic of the three death causes you just mentioned?
JustSomeNobody 8y ago
> If you fine Facebook, you have to fine the small companies too... Absolutely nothing wrong with that. If a small trucking company has a driver that speeds, that driver gets fined the same way a driver for a large trucking company does. > Of course the fines have to be proportional to the number of affected users. Of course.
- bad_user 8y ago
  Personally I hate analogies. The recipe for how a driver should not go over the speed limit is well known. Nowadays you even have the GPS apps alerting you and many trucks get monitored in real time from the dispatch center, drivers risking to be fired if not exactly on schedule. Most software projects are greenfield ... people reuse previous work when available and for a good price, but all custom changes are greenfield. Do you really think that the guy responsible for Heartbleed [1] was aware when he introduced that bug, just like a truck driver going over the speed limit? It's really not the same thing, lets not pretend that it is and regulation in this field would have a chilling effect for open source or startups, because only big companies like Facebook will still be willing to develop critical software, which is definitely not what we want. [1] http://heartbleed.com/ http://heartbleed.com/
  - JustSomeNobody 8y ago
    > It's really not the same thing, lets not pretend that it is... You're right. Look, software is complicated, and there's no way, yet, to make it bug free for any meaningful system. I get that. But at the same time, let's stop calling ourselves engineers if we keep hiding behind 'bugs happen'. We need to be a LOT more responsible than that. Does that mean regulation? If we keep going down the road we're on, yes. Because I gotta be honest, I'm tired of hearing, 'bugs happen' and I, the consumer, am the one who suffers.
  - Spooky23 8y ago
    No, you’re wrong. Speeding is one minor factor in driver or truck safety. Motor Carrier regulation is about much more than speeding. It’s a difficult problem that is addressed via a federal/state/local framework of regulation and enforcement. I’ve worked in engineering roles where law made me potentially criminally liable for negligent handling of certain data. We took things more seriously than Facebook.
drb91 8y ago
> Being fined for a contribution to an OSS project would be terrible, wouldn’t it? Not if your contribution causes harm. A fine would be a more than welcome addition to consumer protections.
- bad_user 8y ago
  In other words you'd rather have companies like Facebook develop critical software, because that's exactly what would happen, because only companies with big pockets would be able to afford it, is that right? Funny, because community-driven open source is the only hope for replacing Facebook with something that is privacy oriented.
  - drb91 8y ago
    I think you have responsibility for your creations. I do not believe that people build things because it is risk free. However, there needs to be SOME distinction beyond intent, which is often impossible to discern.
fhrow4484 8y ago
> If you fine Facebook, you have to fine the small companies too, and even individual developers developing OSS, since the law should apply to everyone equally. I would agree regarding small companies, but I wouldn't put oss developers in the same boat, fining the entity that provides a service makes more sense. It doesn't matter if that service relies on OSS or not. It's the company providing the service to the consumer who is responsible to vet the final product. A OSS developer has no idea if her/his code is going to be used by a gaming app or by NASA for mission critical stuff and shouldn't be made responsible if a bug in the oss project caused a rocket failure. Similarly a construction company providing wood (and that company isn't making any false claims about the level of quality): it should not be the company's fault if someone decides to use that wood for a bridge where concrete is needed. The bridge builder is responsible of picking a good material.
- saagarjha 8y ago
  Plus OSS software is often provided with not liability or warranty, which should protect developers from legislation.
  - jimktrains2 8y ago
    So is most commercial software and tos iirc.
- bacon_waffle 8y ago
  > It's the company providing the service to the consumer who is responsible to vet the final product. I agree with your post, but I tend to think of facebook's users as providing the product (their attention). If the consumer is a company buying advertising, then where's facebook's motivation to be careful with a user's "private" data?
  - WA 8y ago
    Sorry, but you’re overthinking this. Facebooks product is not advertising. It’s a platform that brings users and advertisers together. Just because it’s free for some or most users of the platform doesn’t mean that only paying people (advertisers) need to be protected. Under GDPR, it actually doesn’t matter if you charge money for your product or not. If you process personal data, you’re responsible for it. This also applies to private people with no commercial interest who start to gather data from strangers (in exchange for some service or whatever). Edit: The motivation should’ve been there from the beginning, if only for ethical reasons. Now the motivation is probably enforced by hefty fines.

spiderPig 8y ago

Hoarding data is different from OSS. We’re talking about infra providers. IMO, they should be regulated like public utility companies.

bad_user 8y ago
Really, so does Mastodon qualify? https://joinmastodon.org/ https://joinmastodon.org/ How about a blog commenting system that leaks emails due to a bug, something like Isso: https://posativ.org/isso/ https://posativ.org/isso/ Basically I don't like these arguments because it's about the company's size. Facebook should be punished because they are big, have a lot of data and we don't like them, right? No matter how you look at it, it's a Pandora's box.
- Apocryphon 8y ago
  Maybe there should be a general regulatory framework which all data-storing entities should be subjected to, with stiff penalties for the largest violators, as they can shoulder the burden of the biggest burdens. Is this not how it works for every other industry? Up until the 2008 bank bailouts, that is.
  - bad_user 8y ago
    That does not answer my questions. So what should the penalty be for a 14 year old that contributes a bug into a project like Mastodon or OpenSSH or whatever, which then leaks the data of tens of millions of people? All this would do is to have a chilling effect on the industry such that only big companies like Facebook will be able to develop critical software, due to being able to afford it. And yes, this happens in all the industries you're talking about. And it did not stop the market from crashing, it did not stop malpractice. Also this regulation will probably not stop Facebook from lawfully violating privacy.
    - Apocryphon 8y ago
      Maybe there should be a chilling effect on the industry, and the drive to consume ever more personal data is harmful to society and wrong.
      - bad_user 8y ago
        Oh, but that's the thing, there's no regulation that can stop the consumption of personal data. Let's be clear, we are talking about bugs. The consumption of personal data will continue, because: 1. consumers want it 2. governments want it The only thing regulation will accomplish is that only companies like Facebook will be able to do it. Yeah, big win.

794CD01 8y ago

Absolutely. Fine everyone into the ground. Doesn't look like there is any other way to make people take security seriously. I'm not a fan of the overregulation of industries like aviation, but consumer software has gone too far in the other direction and is long overdue for an adjustment.

UncleMeat 8y ago
The end result of this is that the number of software companies drops by 99.99%. Does your company run anything on Linux? Too bad, there are vulns in the kernel and now you are fined into the ground.
- 794CD01 8y ago
  I would hope for 100. We deserve it. Though of course others deserve it more.
- rapind 8y ago
  Let's assume you're not being dramatic. It would be a pretty lucrative market if 99.99% of current software companies went under. New businesses would show up with a much greater focus on security and quality. That's a bad thing? The realm problem is the inevitable regulatory capture that occurs in every market with even an ounce of complexity. Given the number of high profile breaches we see every month, I definitely think we're due for some consequences.
bad_user 8y ago
Really? How has "consumer software gone too far in the other direction"? Does it ... kill people? Does it enforce bad policies like the healthcare industry did for the past couple of decades, causing an epidemic of obesity, diabetes and heart disease, which are the top causes of death? Yeah, regulation there definitely helped /s
- bosie 8y ago
  > Does it ... kill people? Facebook asked users to upload nude photos. what if those get leaked and users commit suicide because of it? Would you (partially) blame facebook for their death? > Does it enforce bad policies like the healthcare industry did for the past couple of decades, causing an epidemic of obesity, diabetes and heart disease, which are the top causes of death? Genuine question but what policies are the reasons for the epidemic of the three death causes you just mentioned?

JustSomeNobody 8y ago

> If you fine Facebook, you have to fine the small companies too... Absolutely nothing wrong with that. If a small trucking company has a driver that speeds, that driver gets fined the same way a driver for a large trucking company does. > Of course the fines have to be proportional to the number of affected users. Of course.

bad_user 8y ago
Personally I hate analogies. The recipe for how a driver should not go over the speed limit is well known. Nowadays you even have the GPS apps alerting you and many trucks get monitored in real time from the dispatch center, drivers risking to be fired if not exactly on schedule. Most software projects are greenfield ... people reuse previous work when available and for a good price, but all custom changes are greenfield. Do you really think that the guy responsible for Heartbleed [1] was aware when he introduced that bug, just like a truck driver going over the speed limit? It's really not the same thing, lets not pretend that it is and regulation in this field would have a chilling effect for open source or startups, because only big companies like Facebook will still be willing to develop critical software, which is definitely not what we want. [1] http://heartbleed.com/ http://heartbleed.com/
- JustSomeNobody 8y ago
  > It's really not the same thing, lets not pretend that it is... You're right. Look, software is complicated, and there's no way, yet, to make it bug free for any meaningful system. I get that. But at the same time, let's stop calling ourselves engineers if we keep hiding behind 'bugs happen'. We need to be a LOT more responsible than that. Does that mean regulation? If we keep going down the road we're on, yes. Because I gotta be honest, I'm tired of hearing, 'bugs happen' and I, the consumer, am the one who suffers.
- Spooky23 8y ago
  No, you’re wrong. Speeding is one minor factor in driver or truck safety. Motor Carrier regulation is about much more than speeding. It’s a difficult problem that is addressed via a federal/state/local framework of regulation and enforcement. I’ve worked in engineering roles where law made me potentially criminally liable for negligent handling of certain data. We took things more seriously than Facebook.

drb91 8y ago

> Being fined for a contribution to an OSS project would be terrible, wouldn’t it? Not if your contribution causes harm. A fine would be a more than welcome addition to consumer protections.

bad_user 8y ago
In other words you'd rather have companies like Facebook develop critical software, because that's exactly what would happen, because only companies with big pockets would be able to afford it, is that right? Funny, because community-driven open source is the only hope for replacing Facebook with something that is privacy oriented.
- drb91 8y ago
  I think you have responsibility for your creations. I do not believe that people build things because it is risk free. However, there needs to be SOME distinction beyond intent, which is often impossible to discern.

fhrow4484 8y ago

> If you fine Facebook, you have to fine the small companies too, and even individual developers developing OSS, since the law should apply to everyone equally. I would agree regarding small companies, but I wouldn't put oss developers in the same boat, fining the entity that provides a service makes more sense. It doesn't matter if that service relies on OSS or not. It's the company providing the service to the consumer who is responsible to vet the final product. A OSS developer has no idea if her/his code is going to be used by a gaming app or by NASA for mission critical stuff and shouldn't be made responsible if a bug in the oss project caused a rocket failure. Similarly a construction company providing wood (and that company isn't making any false claims about the level of quality): it should not be the company's fault if someone decides to use that wood for a bridge where concrete is needed. The bridge builder is responsible of picking a good material.

saagarjha 8y ago
Plus OSS software is often provided with not liability or warranty, which should protect developers from legislation.
- jimktrains2 8y ago
  So is most commercial software and tos iirc.
bacon_waffle 8y ago
> It's the company providing the service to the consumer who is responsible to vet the final product. I agree with your post, but I tend to think of facebook's users as providing the product (their attention). If the consumer is a company buying advertising, then where's facebook's motivation to be careful with a user's "private" data?
- WA 8y ago
  Sorry, but you’re overthinking this. Facebooks product is not advertising. It’s a platform that brings users and advertisers together. Just because it’s free for some or most users of the platform doesn’t mean that only paying people (advertisers) need to be protected. Under GDPR, it actually doesn’t matter if you charge money for your product or not. If you process personal data, you’re responsible for it. This also applies to private people with no commercial interest who start to gather data from strangers (in exchange for some service or whatever). Edit: The motivation should’ve been there from the beginning, if only for ethical reasons. Now the motivation is probably enforced by hefty fines.