3 ms·

I'm not sure what the answerer is trying to imply, but it seems like it's more a question of willingness to pay being very different between government and priv

I'm not sure what the answerer is trying to imply, but it seems like it's more a question of willingness to pay being very different between government and private individuals than real differences in quality. Sure, there has to be some sort of hoop to jump through with certification, but it doesn't sound like it actually makes a laptop's worth of price difference. Businesses do this all the time, they make an item and sell it at different prices to different entities. Put a small wrinkle on the expensive version so it's not too embarassing for the guy who buys the expensive one. That way you get what the cheap guy is willing to pay and the rich guy. Even universities do this with tuition fees. I have friends who write code for the government, and they also raise their prices for the same thing, they've even been told they were too cheap to seem credible.

noneeeed 6y ago
Something to consider in these kinds of cases is that you're not just paying for a more complex physical product, but the the cost of actually designing and certifying the device. The market for the basic stick is massive, so the cost of design and product development is spread across many, many units. The market for the FIPS stick will be tiny in comparison. That means that the cost of design and development will be both higher (more complex product) and spread across many fewer units. Now add on the cost of going through the certification, which will involve massive amoounts of paperwork, box-ticking and bureaucracy and the cost of development really shoots up compared with slapping some memory cells and an interface into a plastic box. I used to work on safety critical software, and the amount of time that was actually spent writing code was really quite small compared to the effort required to demonstrate both to ourselve, but also to the certifying authorities that the software was safe. The Verifcation and Validation teams would often be far larger than the original development teams. Having said that, I am absolutely sure there will also be some price gouging going on because there will be only a small number of companies that make FIPS certified devices and so competition is lower.
- coddle-hark 6y ago
  The company I work for runs networks on trains. We pay at least 10x for all our components (switches, APs, cables etc.) for exactly this reason; everything needs to be certified a bunch of times. And since there’s so few people buying these devices they’re often buggy and work much worse than commercial off the shelf hardware. Interestingly, you can slap just about anything you want in a bus without a second thought.
  - noneeeed 6y ago
    Indeed. I understand why some of this is necessary, but a lot of it seems to be a kind of process bleed, where "how we do things" in on part of the system just gets copied across without any real thought as to whether it's really necessary across the whole system. One of the more interesting aspects of working in safety critical software was the thought that went into how to architect a system to minimise the amount of it that needed to be built to the highest standards so that we could focus the effort in the most effective way.
  - varjag 6y ago
    Most off-the-shelf hardware isn't going to pass EN50121. Your hardware might be buggy and user unfriendly, but a 8KV chassis discharge isn't going to take it out.

noneeeed 6y ago

Something to consider in these kinds of cases is that you're not just paying for a more complex physical product, but the the cost of actually designing and certifying the device. The market for the basic stick is massive, so the cost of design and product development is spread across many, many units. The market for the FIPS stick will be tiny in comparison. That means that the cost of design and development will be both higher (more complex product) and spread across many fewer units. Now add on the cost of going through the certification, which will involve massive amoounts of paperwork, box-ticking and bureaucracy and the cost of development really shoots up compared with slapping some memory cells and an interface into a plastic box. I used to work on safety critical software, and the amount of time that was actually spent writing code was really quite small compared to the effort required to demonstrate both to ourselve, but also to the certifying authorities that the software was safe. The Verifcation and Validation teams would often be far larger than the original development teams. Having said that, I am absolutely sure there will also be some price gouging going on because there will be only a small number of companies that make FIPS certified devices and so competition is lower.

coddle-hark 6y ago
The company I work for runs networks on trains. We pay at least 10x for all our components (switches, APs, cables etc.) for exactly this reason; everything needs to be certified a bunch of times. And since there’s so few people buying these devices they’re often buggy and work much worse than commercial off the shelf hardware. Interestingly, you can slap just about anything you want in a bus without a second thought.
- noneeeed 6y ago
  Indeed. I understand why some of this is necessary, but a lot of it seems to be a kind of process bleed, where "how we do things" in on part of the system just gets copied across without any real thought as to whether it's really necessary across the whole system. One of the more interesting aspects of working in safety critical software was the thought that went into how to architect a system to minimise the amount of it that needed to be built to the highest standards so that we could focus the effort in the most effective way.
- varjag 6y ago
  Most off-the-shelf hardware isn't going to pass EN50121. Your hardware might be buggy and user unfriendly, but a 8KV chassis discharge isn't going to take it out.