4 ms·

> like fines and people going to jail for negligence Being bad at your job is not negligence, nor is underestimating the threat. It’d be nice to see consequen

by biztos 5y ago

> like fines and people going to jail for negligence Being bad at your job is not negligence, nor is underestimating the threat. It’d be nice to see consequences but I really don’t want to have the government locking people up for being well-paid fuck-ups. Don’t some of these companies have… shareholders?

darkwater 5y ago
If you screw it up with a building or a bridge, you might go to jail, and we as a society are fine with that. Why not in this case as well?
- djrogers 5y ago
  It is 100% possible to be really good at InfoSec, do everything right, and still be breached. I think there’s a (very simplistic) view of IS, where it’s a black and white process of just engineering everything ’correctly’. It’s not like that in the real world…
  - genmud 5y ago
    Nobody is saying you should go to jail or get fined for getting owned by a 0day. I don't think that it is unreasonable to say that someone is negligent in having a CVE from 2014 unpatched, which then allows your customers to get compromised.
lawtalkinghuman 5y ago
> I really don’t want to have the government locking people up for being well-paid fuck-ups. If you go to a doctor and he fucks up: he (or his insurer) has to pay you. If he really fucks up, he ceases to be able to practice medicine. The same with nurses, lawyers, accountants, architects and other professionals. Software's much better—then they point to the "we take no liability for any errors" clause in the contract and everyone carries on as if nothing ever happened.
- dlvktrsh 5y ago
  afaik if a doctor fucks up his rights to practice medicine are taken away by a board of (probably) doctors after a examination of the case. Although this sounds all well and good, I've read countless accounts of this not happening as much as it should be happening, almost similar to the police not taking action on their own officials who go bad, corruption runs deep in our systems and imo our psyche I think a top down approach to enforce anything at scale is never gonna work until people decide to respect their place in the world and do the due diligence from bottom up
labawi 5y ago
People shouldn't go to prison for being fuck-ups. Those negligently responsible should be fined and go to prison for leaking private data, endangering physical safety, possibly for compromising national security, damages from the toxic sludge they produce etc. Note that the US does deploy it's national security forces to fix some of those fuck-ups, and at least threatens to use physical forces, so it's not just a private or civil matter.
arp242 5y ago
Where does "being bad at your job" stop and "negligence" begin? Some jobs come with certain responsibilities. Of course we need to have some leeway for e.g. doctors making honest mistakes – they're only human after all – but at some point that stops.
pbak 5y ago
In case of Equifax, for example, they're in a quasi-cartel with only two competitors. It's quasi-monopolistic. It has the same problems : nobody gives a flying furry about actual performance.

by biztos 5y ago

darkwater 5y ago

If you screw it up with a building or a bridge, you might go to jail, and we as a society are fine with that. Why not in this case as well?

djrogers 5y ago
It is 100% possible to be really good at InfoSec, do everything right, and still be breached. I think there’s a (very simplistic) view of IS, where it’s a black and white process of just engineering everything ’correctly’. It’s not like that in the real world…
- genmud 5y ago
  Nobody is saying you should go to jail or get fined for getting owned by a 0day. I don't think that it is unreasonable to say that someone is negligent in having a CVE from 2014 unpatched, which then allows your customers to get compromised.

lawtalkinghuman 5y ago

> I really don’t want to have the government locking people up for being well-paid fuck-ups. If you go to a doctor and he fucks up: he (or his insurer) has to pay you. If he really fucks up, he ceases to be able to practice medicine. The same with nurses, lawyers, accountants, architects and other professionals. Software's much better—then they point to the "we take no liability for any errors" clause in the contract and everyone carries on as if nothing ever happened.

dlvktrsh 5y ago
afaik if a doctor fucks up his rights to practice medicine are taken away by a board of (probably) doctors after a examination of the case. Although this sounds all well and good, I've read countless accounts of this not happening as much as it should be happening, almost similar to the police not taking action on their own officials who go bad, corruption runs deep in our systems and imo our psyche I think a top down approach to enforce anything at scale is never gonna work until people decide to respect their place in the world and do the due diligence from bottom up

labawi 5y ago

People shouldn't go to prison for being fuck-ups. Those negligently responsible should be fined and go to prison for leaking private data, endangering physical safety, possibly for compromising national security, damages from the toxic sludge they produce etc. Note that the US does deploy it's national security forces to fix some of those fuck-ups, and at least threatens to use physical forces, so it's not just a private or civil matter.

arp242 5y ago

Where does "being bad at your job" stop and "negligence" begin? Some jobs come with certain responsibilities. Of course we need to have some leeway for e.g. doctors making honest mistakes – they're only human after all – but at some point that stops.

pbak 5y ago

In case of Equifax, for example, they're in a quasi-cartel with only two competitors. It's quasi-monopolistic. It has the same problems : nobody gives a flying furry about actual performance.