4 ms·
They can simply require a security measures that is protected by existing IP, thus leaving network security up to the biggest patent-trolls with a lobbying budg
by smokeyj 16y ago
They can simply require a security measures that is protected by existing IP, thus leaving network security up to the biggest patent-trolls with a lobbying budget. I would much rather entrust security to market-driven solutions, not some herp derp government agency.
- tptacek 16y agoMarket-driven security is failing us. It's luck, not sound engineering, that is preventing catastrophe. I can respect that regulation would be even worse than catastrophe, but have a hard time dignifying the argument that there's no tradeoff.
- deleted 16y ago[deleted]
- joe_the_user 16y agoThom, I think you're confusing market-driven security levels with market-driven security products. Big-website-taking-lots-of-citizen-data: I don't need security, the market hasn't demanded it. The-State: I'm demanding it. Go buy good security, I don't care how. Big-website-taking-lots-of-citizen-data: Ah, Ok, I think I've found it. The-State: good, just give me outline so I know. Big-website-taking-lots-of-citizen-data: here you go. While the anarchist in me might just hate the state and the large corporations, here no one has yet shown how any of these are doing dastardly deeds. And that's a fine exception to the rule, really.
- tptacek 16y agoThis bill isn't about "big-website-taking-lots-of-citizen-data". To save us a really pointless and boring argument, let's stipulate that it's about Exelon and not about eBay, and to the extent it isn't, that's a flaw that needs to be corrected.
- joe_the_user 16y ago... orthogonal to my earlier argument...
- Andys 16y agoHow about PCI-DSS (as a counterpoint)?
- tptacek 16y agoThere's plusses and minuses to PCI. On the plus side, it has absolutely increased awareness of web security at commerce companies, and further it has pushed people from trying to do their own credit card handling to outsourcing that function to companies that can keep on top of it. On the minus side, it's spawned a small industry of checkbox consultants who do companies a disservice by allowing them to believe they've been audited and assured when really nothing of the sort has happened. It's not hard to trace public incidents back to the PCI auditors who OK'd those companies.