4 ms·
> and CEO going to jail… So, a CEO runs a company which uses another company to host their servers which uses an operating system built by another company, and
by MR4D 4y ago
> and CEO going to jail…
So, a CEO runs a company which uses another company to host their servers which uses an operating system built by another company, and runs on hardware built by yet another company and has a processor built by another company yet again.
Every one of those is a potential security hole. Now who do you want to send to jail again?
I get it, it’s frustrating. But the reason we haven’t solved this problem is because it’s both complicated and complex.
- voytec 4y ago> Now who do you want to send to jail again? People responsible for making decisions - usually holding a title of CxO. Judges are not unreasonable - if a CEO is responsible for cutting corners on security spending, it's something different than a faulty hardware (say, intel CPUs) which "everyone" uses.
- MR4D 4y agoEverything short of perfect security involves cutting corners - if nowhere else, then in the dimension of time. Mostly we call those trade offs, with this huge gray area where we argue about whether something is a trade off or unreasonably cutting corners. Again, these are difficult problems to address. The social aspect of getting humans to agree on something like this is hard.
- harikb 4y agoI agree. unless the one who stole the data comes and lays out the exact preventable vulnerability they exploited, this is just going to result in businesses paying through the roof for fake assurances of security from middlemen, indirectly passing the cost on to consumers/society.
- eclipticplane 4y agoHow many breaches does t-mobile need to have before they face some form of repercussions?
- artificial 4y agoSeems like one of those n+1 problems in practice.
- shortcake27 4y agoPunishment is complex, but the solution isn’t. It could be mandated that companies are only permitted to request & store information that is necessary to provide the service. A telco literally requires zero data from its users in order to provide a service. Maybe only payment details for postpaid.
- p1necone 4y agoThis is basically what GDPR does.
- maxk42 4y agoAnd yet there are still breeches...
- darekkay 4y agoGDPR doesn't prevent breaches, it limits the amount of data being breached.
- maxk42 4y agoT-mobile is headquartered in Germany.
- darekkay 4y agoFor GDPR, it does not matter where a company is headquartered. GDPR applies to EU citizens (users, customers). That's why big companies often comply with GDPR for EU citizens but completely ignore it for people outside. It would be interesting to see if that's the case for T-Mobile. If the leak exposes GDPR violations, fines will most likely follow.
- Nextgrid 4y agoWhen it comes to mobile carriers it's common for them to lease the name off each other as to appear the same even though it's different companies. The T-Mobile from Germany may be a totally different (though equally shitty) company than the T-Mobile we're talking about here.
- hotpotamus 4y agoDoesn't a CEO make something like 100 times an average employee? What does all that money buy? Shouldn't it go to someone who can on some level promise that they'll solve the hard problems and/or take responsibility?
- richbell 4y agoUsually they take responsibility by throwing a single lowly employee under the bus and firing them. https://www.cnn.com/2021/02/26/politics/solarwinds123-password-intern/index.html https://www.cnn.com/2021/02/26/politics/solarwinds123-passwo...
- barbarbar 4y agoMy bank has not leaked any of my private info. And it has not allowed other than me to use my account. I suppose their systems are subject to the same risks you listed. So it is possible - isn't it?