7 ms·
This is an absurd sum, both in the fees:rewards ratio, and in the total amount ($22,500 might as well be nothing for all of the people involved). That said, I'
by Townley 7y ago
This is an absurd sum, both in the fees:rewards ratio, and in the total amount ($22,500 might as well be nothing for all of the people involved).
That said, I'm a bit surprised to see a "Rake them over the coals" attitude on HN. They leaked a DB with hashed passwords, user data, and last 4 digits of credit cards. That happens to even the most responsible websites all the time, even with seven years of best practices to build upon. I know it would have absolutely happened to the awful, framework-less PHP I was writing back in 2012.
Without letting Zappos off the hook for not taking security more seriously, it seems to me that substantial, non-ridiculous monetary punishments should be reserved for instances of deliberate recklessness, or at least clear, preventable negligence.
- wavefunction 7y agoI worked for a much smaller place with far less resources than Amazon (which is what Zappos is) and our PCI compliance as a payments processor was rock solid. Our systems were under attack all the time from all corners of the globe and we never suffered a breach. If you can't manage PCI compliance then you shouldn't be involved with credit cards.
- colechristensen 7y agoTheir settlement ended up costing as much as a few good engineers for a year. Consequences like that will mean it makes financial sense to ignore security and just pay the settlements as they come. Consequences should motivate companies to be secure. i.e. it should be much cheaper to hire a large competent security team who has a chunk of engineer time than it is to pay tiny settlements to teams of lawyers. Data breaches aren't just necessary evils, they can be prevented, but not without a lot of extra work. Companies should consider a data breach to be an existential threat, not a cost of business.
- oconnor663 7y ago> Consequences like that will mean it makes financial sense to ignore security and just pay the settlements as they come. If judgments like this were the only reason to prioritize security, then sure. But hopefully there are at least some market/reputational forces at work too.
- nickcox 7y agoI honestly don't think the general public cares enough for reputational effects to be particularly important. Can you think of an incident, however heinous, that materially impacted a company's bottom line?
- christopheraden 7y agoThe Ashley Madison Breach comes to mind. If the core demographic cares about not wanting their data on the platform to get out, they will vote with their feet. That said, I think this example is not the norm, and most people probably won't care for most applications. https://en.wikipedia.org/wiki/Ashley_Madison_data_breach https://en.wikipedia.org/wiki/Ashley_Madison_data_breach
- 0_gravitas 7y agoI mean wasn't it also revealed that an overwhelming amount of people on the site were male in the same breach? Id guess that would be a motivating factor more than the privacy
- FDSGSG 7y agoIf the general public doesn't care, are the damages really significant?
- scient 7y agoData breaches are never a question of "if", but "when".
- deaddodo 7y ago> I know it would have absolutely happened to the awful, framework-less PHP I was writing back in 2012. If you were writing framework-less PHP in 2012, you were doing it wrong. There were major frameworks well before that point: CakePHP (Apr 2005), Symfony (Oct 2005), CodeIgniter (2006) and even Laravel (2011).
- viscanti 7y ago> $22,500 might as well be nothing for all of the people involved It looks like the $22,500 is just for 9 named plaintiffs ($2,500 each). The other victims get nothing.