3 ms·

So, if a company is small and unable to afford any security, they can just set the number at $0 which means it is the customer's problem. And if a company is l

So, if a company is small and unable to afford any security, they can just set the number at $0 which means it is the customer's problem. And if a company is large and low margin, they can do this too so nothing changes. A few companies will be out there promising things, like today, and maybe they can deliver and maybe you can sue them if they don't, like today.

setr 6y ago
Well, right now everyone and everything claims to be secure; this puts a number on that claim, and gives you companies explicitly claiming that they’re not secure (at least, they wouldn’t bet on it), which is quite a bit more information than you have today. Being able to actually get your money back... is another problem. But obviously a toothless regulation is toothless, and changes nothing, so its not a useful assumption to make
Veserv 6y ago
If a company is large and low margin and does not care about security and they write in big bold print that they provide exactly zero guarantees about security and it is your problem if something happens and they never insinuate that there is any appreciable security, then I do not see the problem with that. The customer has been informed in no uncertain terms what they are getting and can make the cost-benefit analysis themselves. Obviously, there are complexities with regard to what exactly constitutes proper notice such that the customer can do a proper cost-benefit analysis, but the spirit of such a rule is clear. This is would be different than the current state of affairs because lying or overstating your security story would have direct, pre-committed, quantitative downside. This is contrast to the outcomes of a lawsuit which are expensive, highly variable, generally require proof of intent, and depend on demonstrating actual quantitative damages.
no-dr-onboard 6y ago
Couldn't agree with you more. The decision to take on risk for the purpose of marketing is not at all palatable to decision makers. Why would you want to accept an increase in risk for an unknown-unknown?

setr 6y ago

Well, right now everyone and everything claims to be secure; this puts a number on that claim, and gives you companies explicitly claiming that they’re not secure (at least, they wouldn’t bet on it), which is quite a bit more information than you have today. Being able to actually get your money back... is another problem. But obviously a toothless regulation is toothless, and changes nothing, so its not a useful assumption to make

Veserv 6y ago

If a company is large and low margin and does not care about security and they write in big bold print that they provide exactly zero guarantees about security and it is your problem if something happens and they never insinuate that there is any appreciable security, then I do not see the problem with that. The customer has been informed in no uncertain terms what they are getting and can make the cost-benefit analysis themselves. Obviously, there are complexities with regard to what exactly constitutes proper notice such that the customer can do a proper cost-benefit analysis, but the spirit of such a rule is clear. This is would be different than the current state of affairs because lying or overstating your security story would have direct, pre-committed, quantitative downside. This is contrast to the outcomes of a lawsuit which are expensive, highly variable, generally require proof of intent, and depend on demonstrating actual quantitative damages.

no-dr-onboard 6y ago

Couldn't agree with you more. The decision to take on risk for the purpose of marketing is not at all palatable to decision makers. Why would you want to accept an increase in risk for an unknown-unknown?