8 ms·

The problem is certifications, standards, reviews are strong barriers to entry and destroy competition and startup opportunities. EU already lacks big tech comp

The problem is certifications, standards, reviews are strong barriers to entry and destroy competition and startup opportunities. EU already lacks big tech compared to US, China and Russia. EU can easily regulate that to write software one needs to have a masters degree in CS.

MrBuddyCasino 4y ago
Or, you know, simply fine companies that have data breaches. They will figure out how to secure their systems on their own if sufficiently motivated. No need for heavy handed bureaucracy and red tape.
- Idiot_in_Vain 4y ago
  Or they will pay the hackers and try to keep the breach a secret...
  - bryanrasmussen 4y ago
    that's against the GDPR.
- aww_dang 4y ago
  My preference here would be for civil actions for damages rather than fines paid to bureaucrats.
  - MrBuddyCasino 4y ago
    I have no idea why this got downvoted.
Scandiravian 4y ago
I think that would hurt startups much more. It will require that the degrees are accredited, which is a lot of work for both the institution that provides certification and for people applying Secondly, a large percentage of developers do not have a CS degree. There's also a significant number of educations that are not specified as a CS degree, but still teach people skills with the aim of them entering the workforce to work as developers It's also unclear how domains where software is developed as a tool, but isn't a primary focus (i.e. bioinformatics)
dmitriid 4y ago
> EU already lacks big tech compared to US, China and Russia US has next to zero privacy protections, and unlimited investor money with zero expectations for a company to ever turn profitable. E.g. all of YCombinator's "top companies" lose hundreds of millions and billions dollars a year. China and Russia have cheap labor and yes, zero privacy. Edit: the same people who clamor for Russia and China-style big companies will immediately shout for government to step in if any company ever gets to the size and influence of Yandex or AliBaba.
- Idiot_in_Vain 4y ago
  I love privacy, but the majority of people in the world seem not to understand it's importance. No, there are no "zero expectations for a company to ever turn profitable". If you ever tried to get investor money you'll know how hard is to prove to them you have a good path to profitability. Even if all of YCombinat companies except one lose hundreds of millions, the last one can turn into a Facebook, worth hundreds of billions.
  - dmitriid 4y ago
    > No, there are no "zero expectations for a company to ever turn profitable". If you ever tried to get investor money you'll know how hard is to prove to them you have a good path to profitability. And yet, YCombinator's top companies lose billions for years and keep getting the money. What's the "proven path to profitability"? The flimsy belief that "just wait a bit and we'll have a next Facebook?" Most of the companies that get mentioned as "big innovative companies" in HN threads have been around for 5+ or even 10+ years, lost incalculable amounts of money, never turned a profit, and we're led to believe that there's an expectation to turn a profit in any of these scenarios.
  - Idiot_in_Vain 4y ago
    dmitriid, you seem to not understand the simple fact that if one of a hundred startups an investor financed turns into a big success he can make big profits overall, despite 99% of the companies lost him money.
DyslexicAtheist 4y ago
it is a nightmare for us big companies to be compliant exactly because we have millions of lines of code that we now are expected to clean up, or remove decades of security debt. from where I sit being a start-up, or SME that can make quick decisions and consolidate their security debt is a lot easier on them and worse for us big guys. I don't want to use a phrase as "level the playing field" but the upcoming expectations of RED and CRA means most of us are praying this isn't enforced as quickly as it is written into law. I'm totally rooting for this because its the only thing that will improve security.
- Attrecomet 4y ago
  All the extra red tape and auditing doesn't come for free, so startups and SMEs without huge amounts of cash somehow lying around will struggle. Also, nothing about compliance is actually about "consolidating security debt" or "quick decisions". It's about paying someone to go through checklists and, like a reviewer of a scientific paper, find something, anything, no matter how inane, to criticize, before handing you a certification. Any slightly unconventional new idea to improve security in your product will be suffocated beneath the blanket of compliance. > I'm totally rooting for this because its the only thing that will improve security. So does the author. Well, they strongly endorse a sensible version without the vague phrases and open-source-killing blanket statements, and without brain-dead sentences like "your product must be un-DDoS-able". I do wonder, though, why you're rooting for legislation that would kill any open source project that might, conceivably, be used in a commercial setting?
DyslexicAtheist 4y ago
it is in fact only US companies that have been screaming loudest against better security baselines in IoT. every on of the EU member companies is welcoming this (along with RED coming in 2024) ... for US companies it presents an additional cost or even barrier of entry because they don't need to implement the same security controls in products sold back in the US.
piperswe 4y ago
> regulate that to write software one needs to have a masters degree in CS It's already hard enough to hire software engineers, how hard would it be after further restricting to only software engineers with a relevant masters? I know I'd be entirely forced out of the field, and would have to undertake a 4 year course (abroad, because here it would be 6 years) to be eligible for employment again, if that happened in my country.
- AstralStorm 4y ago
  You wish the masters would teach you anything about these new regulations. Universities lag 10 years or more behind the research edge in teaching, if not more...
  - Atlas22 4y ago
    Well as someone that has had the "joy" of implementing a lot of the ones that exist in the US: SOC*, HIPAA, HITRUST, PCI-DSS, a handful of DoD ones. I think if they seriously taught them in schools it would cause a lot change of majors when students realize what an absolute clown car of regulation they are getting themselves into. Its also probably the most boring subject availible.
MrQuimico 4y ago
Something to keep in mind is that this is about certification of products, not people. This is not a regulation for the profession of Software Developer, but a regulation for software products. The EU knows very well that it needs more people from all backgrounds writing and understanding software, not less. As it is, I think this is going to be very similar to what is already required for some specific industries like healthcare or finance. Startups that want to operate in these industries already need to go through some certification processes of their products and services. Most startups will probably fall under the "low risk status" category until they are a big enough. If self-assessment is anything similar to what it is already required for things like PCI DSS or GDPR, then most small companies will be fine until they are big enough to care. And by the way, there is no easy way for the EU to regulate that to write software you need a specific degree.
yencabulator 4y ago
Computer science is not the same as software development (or "engineering").
3836293648 4y ago
Honestly, you should. Europe isn't America. We have free education here. If you leave academia and enter the workforce willingly at a lower level than society offers you for free, should you really get to do the work you refused to train for?

MrBuddyCasino 4y ago

Or, you know, simply fine companies that have data breaches. They will figure out how to secure their systems on their own if sufficiently motivated. No need for heavy handed bureaucracy and red tape.

Idiot_in_Vain 4y ago
Or they will pay the hackers and try to keep the breach a secret...
- bryanrasmussen 4y ago
  that's against the GDPR.
aww_dang 4y ago
My preference here would be for civil actions for damages rather than fines paid to bureaucrats.
- MrBuddyCasino 4y ago
  I have no idea why this got downvoted.

Scandiravian 4y ago

I think that would hurt startups much more. It will require that the degrees are accredited, which is a lot of work for both the institution that provides certification and for people applying Secondly, a large percentage of developers do not have a CS degree. There's also a significant number of educations that are not specified as a CS degree, but still teach people skills with the aim of them entering the workforce to work as developers It's also unclear how domains where software is developed as a tool, but isn't a primary focus (i.e. bioinformatics)

dmitriid 4y ago

> EU already lacks big tech compared to US, China and Russia US has next to zero privacy protections, and unlimited investor money with zero expectations for a company to ever turn profitable. E.g. all of YCombinator's "top companies" lose hundreds of millions and billions dollars a year. China and Russia have cheap labor and yes, zero privacy. Edit: the same people who clamor for Russia and China-style big companies will immediately shout for government to step in if any company ever gets to the size and influence of Yandex or AliBaba.

Idiot_in_Vain 4y ago
I love privacy, but the majority of people in the world seem not to understand it's importance. No, there are no "zero expectations for a company to ever turn profitable". If you ever tried to get investor money you'll know how hard is to prove to them you have a good path to profitability. Even if all of YCombinat companies except one lose hundreds of millions, the last one can turn into a Facebook, worth hundreds of billions.
- dmitriid 4y ago
  > No, there are no "zero expectations for a company to ever turn profitable". If you ever tried to get investor money you'll know how hard is to prove to them you have a good path to profitability. And yet, YCombinator's top companies lose billions for years and keep getting the money. What's the "proven path to profitability"? The flimsy belief that "just wait a bit and we'll have a next Facebook?" Most of the companies that get mentioned as "big innovative companies" in HN threads have been around for 5+ or even 10+ years, lost incalculable amounts of money, never turned a profit, and we're led to believe that there's an expectation to turn a profit in any of these scenarios.
- Idiot_in_Vain 4y ago
  dmitriid, you seem to not understand the simple fact that if one of a hundred startups an investor financed turns into a big success he can make big profits overall, despite 99% of the companies lost him money.

DyslexicAtheist 4y ago

it is a nightmare for us big companies to be compliant exactly because we have millions of lines of code that we now are expected to clean up, or remove decades of security debt. from where I sit being a start-up, or SME that can make quick decisions and consolidate their security debt is a lot easier on them and worse for us big guys. I don't want to use a phrase as "level the playing field" but the upcoming expectations of RED and CRA means most of us are praying this isn't enforced as quickly as it is written into law. I'm totally rooting for this because its the only thing that will improve security.

Attrecomet 4y ago
All the extra red tape and auditing doesn't come for free, so startups and SMEs without huge amounts of cash somehow lying around will struggle. Also, nothing about compliance is actually about "consolidating security debt" or "quick decisions". It's about paying someone to go through checklists and, like a reviewer of a scientific paper, find something, anything, no matter how inane, to criticize, before handing you a certification. Any slightly unconventional new idea to improve security in your product will be suffocated beneath the blanket of compliance. > I'm totally rooting for this because its the only thing that will improve security. So does the author. Well, they strongly endorse a sensible version without the vague phrases and open-source-killing blanket statements, and without brain-dead sentences like "your product must be un-DDoS-able". I do wonder, though, why you're rooting for legislation that would kill any open source project that might, conceivably, be used in a commercial setting?

DyslexicAtheist 4y ago

it is in fact only US companies that have been screaming loudest against better security baselines in IoT. every on of the EU member companies is welcoming this (along with RED coming in 2024) ... for US companies it presents an additional cost or even barrier of entry because they don't need to implement the same security controls in products sold back in the US.

piperswe 4y ago

> regulate that to write software one needs to have a masters degree in CS It's already hard enough to hire software engineers, how hard would it be after further restricting to only software engineers with a relevant masters? I know I'd be entirely forced out of the field, and would have to undertake a 4 year course (abroad, because here it would be 6 years) to be eligible for employment again, if that happened in my country.

AstralStorm 4y ago
You wish the masters would teach you anything about these new regulations. Universities lag 10 years or more behind the research edge in teaching, if not more...
- Atlas22 4y ago
  Well as someone that has had the "joy" of implementing a lot of the ones that exist in the US: SOC*, HIPAA, HITRUST, PCI-DSS, a handful of DoD ones. I think if they seriously taught them in schools it would cause a lot change of majors when students realize what an absolute clown car of regulation they are getting themselves into. Its also probably the most boring subject availible.

MrQuimico 4y ago

Something to keep in mind is that this is about certification of products, not people. This is not a regulation for the profession of Software Developer, but a regulation for software products. The EU knows very well that it needs more people from all backgrounds writing and understanding software, not less. As it is, I think this is going to be very similar to what is already required for some specific industries like healthcare or finance. Startups that want to operate in these industries already need to go through some certification processes of their products and services. Most startups will probably fall under the "low risk status" category until they are a big enough. If self-assessment is anything similar to what it is already required for things like PCI DSS or GDPR, then most small companies will be fine until they are big enough to care. And by the way, there is no easy way for the EU to regulate that to write software you need a specific degree.

yencabulator 4y ago

Computer science is not the same as software development (or "engineering").

3836293648 4y ago

Honestly, you should. Europe isn't America. We have free education here. If you leave academia and enter the workforce willingly at a lower level than society offers you for free, should you really get to do the work you refused to train for?