4 ms·

One consequence of previous software failures with tragic outcomes was the development of technical standards that are now referred to and required in governmen

by triska 5y ago

One consequence of previous software failures with tragic outcomes was the development of technical standards that are now referred to and required in government procurement procedures, in laws and certifications, in education etc. For example, the horrific Therac-25 incidents led to IEC 62304, a standard which specifies life cycle requirements for the development of medical software and software within medical devices: https://en.wikipedia.org/wiki/IEC_62304 https://en.wikipedia.org/wiki/IEC_62304 I hope analogous standards will be formulated for privacy on devices etc.

angelzen 5y ago
There have been 24 years between Therac-25 and IEC 62304, with a clear smoking gun that everybody agreed it was a horrific smoking gun. With privacy, we're still in 'if you've got nothing to hide, you've got nothing to fear' stage, and we may be stuck here perpetually. How do we move the needle of public opinion?
- triska 5y ago
  I strongly hope we are not stuck here perpetually: There are powerful companies that require privacy even in their conditions of use. For instance, to obtain a credit card from a bank, you have to sign a document stating that you will hide the PIN of your card. For example, quoting from Section 5.5 in the contract you have to sign to get a Visa Card or Mastercard https://www.cardcomplete.com/media/medialibrary/2021/03/AGBs_Kreditkarten_ENG_0719.pdf https://www.cardcomplete.com/media/medialibrary/2021/03/AGBs...: "The Cardholder must not disclose the assigned PIN, nor any personally chosen PIN (see Item 17.8.), nor the Secure Code to anyone, not even to employees of card complete. The Cardholder is responsible for ensuring strict secrecy concerning all card security details – PIN, Secure Code and mobileTANs received on his/her telephone (to be used for authenticating a ViS/MCID transaction and valid for a maximum of 5 minutes afterreceipt) – and must take all reasonable precautions to ensure that they cannot be discovered by others. The Cardholder must refrain from writing them down on the card, keeping them in the same place as the card, telling them to anyone, or acting in any other way that would allow others to discover these details." Hence, if you have a credit card, you must hide something. A bank, for example, would likely benefit from requiring a secure device for transactions as part of their conditions of use, otherwise it is unclear how exactly we can satisfy this contract as customers, and who is liable in case of problems. A common way to ensure such technical requirements is to refer to a technical standard that the device must conform to. As a closely related example, here is a recent Austrian law, the Registrierkassensicherheitsverordnung (regulation for security of cash registers): https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20009390 https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundes... Note to how many technical standards the law refers to in order to ensure the security of these devices, including AES-256, SHA-256 etc. These technical standards ensure that multiple vendors can participate in bidding and all adhere to the required specifications regarding security etc.
  - Sebb767 5y ago
    but it's just the algorithms of the nice corporation, they are only looking for crime and don't care about my pin Most people really don't get how much processing is happening and how much of it is a mechanical turk by the way of minimum wage contractors.
- deleted 5y ago
  [deleted]
- PeterisP 5y ago
  If I look at EU legislation (not only GDPR but in general) then it seems that the needle of public opinion with respect to privacy is already there and well known to the legislators. A problem for places like USA is that the legislators are unwilling to regulate against the interest of big companies unless the needle of public opinion is very, very, very strong to the point of it becoming the primary issue (which IMHO is not going to happen, privacy is important but there are and will be other priorities as well) - but if we're simply looking at the preferences of the population, then the public opinion is already there.

by triska 5y ago

angelzen 5y ago

There have been 24 years between Therac-25 and IEC 62304, with a clear smoking gun that everybody agreed it was a horrific smoking gun. With privacy, we're still in 'if you've got nothing to hide, you've got nothing to fear' stage, and we may be stuck here perpetually. How do we move the needle of public opinion?

triska 5y ago
I strongly hope we are not stuck here perpetually: There are powerful companies that require privacy even in their conditions of use. For instance, to obtain a credit card from a bank, you have to sign a document stating that you will hide the PIN of your card. For example, quoting from Section 5.5 in the contract you have to sign to get a Visa Card or Mastercard https://www.cardcomplete.com/media/medialibrary/2021/03/AGBs_Kreditkarten_ENG_0719.pdf https://www.cardcomplete.com/media/medialibrary/2021/03/AGBs...: "The Cardholder must not disclose the assigned PIN, nor any personally chosen PIN (see Item 17.8.), nor the Secure Code to anyone, not even to employees of card complete. The Cardholder is responsible for ensuring strict secrecy concerning all card security details – PIN, Secure Code and mobileTANs received on his/her telephone (to be used for authenticating a ViS/MCID transaction and valid for a maximum of 5 minutes afterreceipt) – and must take all reasonable precautions to ensure that they cannot be discovered by others. The Cardholder must refrain from writing them down on the card, keeping them in the same place as the card, telling them to anyone, or acting in any other way that would allow others to discover these details." Hence, if you have a credit card, you must hide something. A bank, for example, would likely benefit from requiring a secure device for transactions as part of their conditions of use, otherwise it is unclear how exactly we can satisfy this contract as customers, and who is liable in case of problems. A common way to ensure such technical requirements is to refer to a technical standard that the device must conform to. As a closely related example, here is a recent Austrian law, the Registrierkassensicherheitsverordnung (regulation for security of cash registers): https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20009390 https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundes... Note to how many technical standards the law refers to in order to ensure the security of these devices, including AES-256, SHA-256 etc. These technical standards ensure that multiple vendors can participate in bidding and all adhere to the required specifications regarding security etc.
- Sebb767 5y ago
  but it's just the algorithms of the nice corporation, they are only looking for crime and don't care about my pin Most people really don't get how much processing is happening and how much of it is a mechanical turk by the way of minimum wage contractors.
deleted 5y ago
[deleted]
PeterisP 5y ago
If I look at EU legislation (not only GDPR but in general) then it seems that the needle of public opinion with respect to privacy is already there and well known to the legislators. A problem for places like USA is that the legislators are unwilling to regulate against the interest of big companies unless the needle of public opinion is very, very, very strong to the point of it becoming the primary issue (which IMHO is not going to happen, privacy is important but there are and will be other priorities as well) - but if we're simply looking at the preferences of the population, then the public opinion is already there.