5 ms·

I remember there are some laws about disclosing breaches. Did this happened before those laws or the letter of the law does not apply in this specific case. Fo

I remember there are some laws about disclosing breaches. Did this happened before those laws or the letter of the law does not apply in this specific case. For the anti-regulation guys, please explain how free market helps in this or similar cases and why a law to demand transparency for this cases is also evil. (I am still waiting on other threads an explanation that regulation that only forces transparency and what is tracked and shared is bad and free market solves it better)

nemothekid 6y ago
I'm not sure the law applies to Apple in this case. It wasn't Apple that was hacked. Another way of looking at it is if Facebook was hacked, and the hacker put malicious code into the Facebook iOS app and Apple notices, it's Facebook that is the liable party; Apple just noticed.
- lupire 6y ago
  What company had full control over whether the Facebook software is installed on my phone?
  - nemothekid 6y ago
    You? I’m not sure what point you are making. Apple does not preload apps onto your phone.
    - simion314 6y ago
      Apple/Google restrict what apps are in the Store , they and their fans will say that the locked store is for security. When Apple/Google review fails (it will never be a perfect review process), reasonable people would say that Apple/Google would not only remove the malware from the store but they would also at least notify the victims.
- Dah00n 6y ago
  Apple controls and approve Appstore apps. If it were in the app Apple is clearly also a party since they are paid to approve it. It's only s matter of time before the EU will smack Apple down.
  - nemothekid 6y ago
    I’m not sure how (1) follows (2). How is Apple “clearly” also a party when they aren’t even given the source code to the app?
    - pornel 6y ago
      Apple insists on having editorial and technical control over apps, but also they take no responsibility for their decisions and their technology that allowed bad apps. It's their platform, their APIs, their sandbox, their store, their verification, their rules, but when something goes wrong, it's someone else's fault. That doesn't seem fair (even though it's legal currently).
      - B1FF_PSUVM 6y ago
        So, like one of those parking lots that do not take responsibility for thefts in their premises?
      - simondotau 6y ago
        By that logic, Governments who enact and enforce laws should be held responsible for all crime.
      - nemothekid 6y ago
        >It's their platform, their APIs, their sandbox, their store, their verification, their rules, but when something goes wrong, it's someone else's fault. Does this also mean Microsoft is at fault when someone writes malware that exploits Chrome on Windows? After all it’s the Windows platform and API. Should I also blame RMS when someone writes malware in C? After all they might have used the libc.
- pornel 6y ago
  Apple is in charge when it benefits them, and devs are in charge when there's a liability.
- deleted 6y ago
  [deleted]
- gpm 6y ago
  I'm not sure any particular law like that applies to Apple, but I would actually be somewhat surprised if they didn't. You bought an Apple device, used it to access Apple's servers, which pointed you at software hosted on Apple's servers, which you proceeded to download from Apple's servers, if it was non-free software you paid Apple for it, and Apple has final approval over any software that is actually distributed to consumers. Edit: And if you were infected via way of an update, the update mechanism is Apple's software asked Apple's servers if there was any updates, and when Apple's servers said yes they downloaded software from Apple's servers and deployed it on your phone. To argue by analogy, Amazon is responsible for goods they sell on there store that they don't even distribute themselves... https://www.theverge.com/2021/5/1/22414185/california-appeals-court-amazon-marketplace-responsible-third-party-hoverboard https://www.theverge.com/2021/5/1/22414185/california-appeal...
  - simondotau 6y ago
    So if a criminal sneaks into a Campbells soup factory and poisons a batch of tomato soup, the proper response should be to blame Walmart for selling it. Impeccable logic.
    - gpm 6y ago
      "Blame", no. Require that Walmart issues a recall, alerts the purchasers of the defective soup, and issues refunds, yes, that is how the law works. Walmart in turn can go after Campbell for the cost of the refunds, but the end purchasers aren't a party to that suit. Campbell (and maybe Walmart directly) can also go after the criminal for damages, again not the consumers problem.
      - simondotau 6y ago
        Apple did all the things you described in the first paragraph.
        gpm 6y ago
        On the contrary, the complaint is that they did not. They specifically chose not to alert those affected. But also... you do understand that we're talking about analogous but not identical laws here right? The context of this entire thread is laws that specifically require notifying people of data breaches, and not laws that require recalling bad food.
nickff 6y ago
In a situation with less top-down regulation, security-focused users are more likely to rely on guarantees and audits, perhaps causing them to select different vendors.
- scarmig 6y ago
  Is the population of security focused users enough to support an ecosystem of auditing firms? Is it enough to even support a neighborhood coffee shop?
  - mojo982 6y ago
    If so few users care about security, why should the government regulate for that outcome? I think theoretically the argument above makes sense, but in reality it doesn't. The market that exists doesn't provide a solution because the barrier to entry is basically infinite. Even Microsoft couldn't offer an alternative to iOS and Android because Microsoft couldn't do it alone. It's a natural monopoly problem, which means normal market arguments don't work.
- kdmccormick 6y ago
  Isn't this the case already (to the extent that each security-focused user finds it practical)? Would decreasing top-down regulation somehow make it easier for those users to select vendors based on their security practices? Or perhaps, would it increase the number of security-focused users? Help me understand.
  - nickff 6y ago
    Top-down regulations often give people a false sense of security, so they don't bother doing their own research and 'watching their backs'. Regulations are also generally 'sticky', so many originators focus on bare minimum compliance, and there is a dearth of variety. Another related problem is that regulations often inentivize ignorance; the originator is usually better off not learning about breaches, so they are not as vigilant as many users think they should be.
doikor 6y ago
GDPR requires disclosing to the supervisory authority if user data was breached. Though this hack was before GDPR. https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/ edit: Also California requires notifying the residents directly and if over 500 residents were effected also the attorney general https://oag.ca.gov/privacy/databreach/reporting https://oag.ca.gov/privacy/databreach/reporting
deleted 6y ago
[deleted]

nemothekid 6y ago

I'm not sure the law applies to Apple in this case. It wasn't Apple that was hacked. Another way of looking at it is if Facebook was hacked, and the hacker put malicious code into the Facebook iOS app and Apple notices, it's Facebook that is the liable party; Apple just noticed.

lupire 6y ago
What company had full control over whether the Facebook software is installed on my phone?
- nemothekid 6y ago
  You? I’m not sure what point you are making. Apple does not preload apps onto your phone.
  - simion314 6y ago
    Apple/Google restrict what apps are in the Store , they and their fans will say that the locked store is for security. When Apple/Google review fails (it will never be a perfect review process), reasonable people would say that Apple/Google would not only remove the malware from the store but they would also at least notify the victims.
Dah00n 6y ago
Apple controls and approve Appstore apps. If it were in the app Apple is clearly also a party since they are paid to approve it. It's only s matter of time before the EU will smack Apple down.
- nemothekid 6y ago
  I’m not sure how (1) follows (2). How is Apple “clearly” also a party when they aren’t even given the source code to the app?
  - pornel 6y ago
    Apple insists on having editorial and technical control over apps, but also they take no responsibility for their decisions and their technology that allowed bad apps. It's their platform, their APIs, their sandbox, their store, their verification, their rules, but when something goes wrong, it's someone else's fault. That doesn't seem fair (even though it's legal currently).
    - B1FF_PSUVM 6y ago
      So, like one of those parking lots that do not take responsibility for thefts in their premises?
    - simondotau 6y ago
      By that logic, Governments who enact and enforce laws should be held responsible for all crime.
    - nemothekid 6y ago
      >It's their platform, their APIs, their sandbox, their store, their verification, their rules, but when something goes wrong, it's someone else's fault. Does this also mean Microsoft is at fault when someone writes malware that exploits Chrome on Windows? After all it’s the Windows platform and API. Should I also blame RMS when someone writes malware in C? After all they might have used the libc.
pornel 6y ago
Apple is in charge when it benefits them, and devs are in charge when there's a liability.
deleted 6y ago
[deleted]
gpm 6y ago
I'm not sure any particular law like that applies to Apple, but I would actually be somewhat surprised if they didn't. You bought an Apple device, used it to access Apple's servers, which pointed you at software hosted on Apple's servers, which you proceeded to download from Apple's servers, if it was non-free software you paid Apple for it, and Apple has final approval over any software that is actually distributed to consumers. Edit: And if you were infected via way of an update, the update mechanism is Apple's software asked Apple's servers if there was any updates, and when Apple's servers said yes they downloaded software from Apple's servers and deployed it on your phone. To argue by analogy, Amazon is responsible for goods they sell on there store that they don't even distribute themselves... https://www.theverge.com/2021/5/1/22414185/california-appeals-court-amazon-marketplace-responsible-third-party-hoverboard https://www.theverge.com/2021/5/1/22414185/california-appeal...
- simondotau 6y ago
  So if a criminal sneaks into a Campbells soup factory and poisons a batch of tomato soup, the proper response should be to blame Walmart for selling it. Impeccable logic.
  - gpm 6y ago
    "Blame", no. Require that Walmart issues a recall, alerts the purchasers of the defective soup, and issues refunds, yes, that is how the law works. Walmart in turn can go after Campbell for the cost of the refunds, but the end purchasers aren't a party to that suit. Campbell (and maybe Walmart directly) can also go after the criminal for damages, again not the consumers problem.
    - simondotau 6y ago
      Apple did all the things you described in the first paragraph.
      - gpm 6y ago
        On the contrary, the complaint is that they did not. They specifically chose not to alert those affected. But also... you do understand that we're talking about analogous but not identical laws here right? The context of this entire thread is laws that specifically require notifying people of data breaches, and not laws that require recalling bad food.

nickff 6y ago

In a situation with less top-down regulation, security-focused users are more likely to rely on guarantees and audits, perhaps causing them to select different vendors.

scarmig 6y ago
Is the population of security focused users enough to support an ecosystem of auditing firms? Is it enough to even support a neighborhood coffee shop?
- mojo982 6y ago
  If so few users care about security, why should the government regulate for that outcome? I think theoretically the argument above makes sense, but in reality it doesn't. The market that exists doesn't provide a solution because the barrier to entry is basically infinite. Even Microsoft couldn't offer an alternative to iOS and Android because Microsoft couldn't do it alone. It's a natural monopoly problem, which means normal market arguments don't work.
kdmccormick 6y ago
Isn't this the case already (to the extent that each security-focused user finds it practical)? Would decreasing top-down regulation somehow make it easier for those users to select vendors based on their security practices? Or perhaps, would it increase the number of security-focused users? Help me understand.
- nickff 6y ago
  Top-down regulations often give people a false sense of security, so they don't bother doing their own research and 'watching their backs'. Regulations are also generally 'sticky', so many originators focus on bare minimum compliance, and there is a dearth of variety. Another related problem is that regulations often inentivize ignorance; the originator is usually better off not learning about breaches, so they are not as vigilant as many users think they should be.

doikor 6y ago

GDPR requires disclosing to the supervisory authority if user data was breached. Though this hack was before GDPR. https://gdpr-info.eu/art-33-gdpr/ https://gdpr-info.eu/art-33-gdpr/ edit: Also California requires notifying the residents directly and if over 500 residents were effected also the attorney general https://oag.ca.gov/privacy/databreach/reporting https://oag.ca.gov/privacy/databreach/reporting

deleted 6y ago

[deleted]