5 ms·

> Imagine a cyber defense agency that does nothing but find and fix holes in computing infrastructure and major software projects. It pays for exploits and then

> Imagine a cyber defense agency that does nothing but find and fix holes in computing infrastructure and major software projects. It pays for exploits and then works to patch them, promotes bug bounties, develops secure coding standards, audits open source projects, etc. Imagine something like The National Endowment for the Arts (NEA) that instead funds critical pieces of software like openSSL, etc. I like this idea. At the same time, I think the agency - or organization, if you prefer - should look something like the National Transportation Safety Board, where incidents are investigated, reported on, and recommendations are made in a way that improves user safety. Maybe the 'National Digital Safety Board'?

hirako2000 5y ago
Or they should stop stealing tax payers money and dissolve these agencies. The one thing they are good at is digging deeper and deeper the debt account, for virtually no benefit, and surely nuisance and worries.
- pjmorris 5y ago
  Are you saying that the market, such as it is, is doing a good enough job of managing software vulnerabilities and their consequent breaches?
  - hirako2000 5y ago
    No. I'M by no means saying nor implying that. I'm saying tax should not be taken away from people to fund agencies. Businesses are free to do a good or bad job at managing their security posture. And if it is a bad job they are very likely to pay the consequences. The market is fine regulating itself in the long term. Agencies and regulation rather create obstacles and biases.
tablespoon 5y ago
> I like this idea. At the same time, I think the agency - or organization, if you prefer - should look something like the National Transportation Safety Board, where incidents are investigated, reported on, and recommendations are made in a way that improves user safety. Maybe the 'National Digital Safety Board'? I like it too, but I also think it would be needed to be backed by some kind of regulatory agency that could issue the cybersecurity equivalent of an "Airworthiness Directive". Otherwise we'd be in a similar situation we have know: lots of information about vulnerabilities that are often not acted upon.

hirako2000 5y ago

Or they should stop stealing tax payers money and dissolve these agencies. The one thing they are good at is digging deeper and deeper the debt account, for virtually no benefit, and surely nuisance and worries.

pjmorris 5y ago
Are you saying that the market, such as it is, is doing a good enough job of managing software vulnerabilities and their consequent breaches?
- hirako2000 5y ago
  No. I'M by no means saying nor implying that. I'm saying tax should not be taken away from people to fund agencies. Businesses are free to do a good or bad job at managing their security posture. And if it is a bad job they are very likely to pay the consequences. The market is fine regulating itself in the long term. Agencies and regulation rather create obstacles and biases.

tablespoon 5y ago

> I like this idea. At the same time, I think the agency - or organization, if you prefer - should look something like the National Transportation Safety Board, where incidents are investigated, reported on, and recommendations are made in a way that improves user safety. Maybe the 'National Digital Safety Board'? I like it too, but I also think it would be needed to be backed by some kind of regulatory agency that could issue the cybersecurity equivalent of an "Airworthiness Directive". Otherwise we'd be in a similar situation we have know: lots of information about vulnerabilities that are often not acted upon.