3 ms·

> Information Security experts understood for decades that conventional password complexity requirements produced harmful outcomes. How long did it take an auth

> Information Security experts understood for decades that conventional password complexity requirements produced harmful outcomes. How long did it take an authority to produce an alternative standard? Please tell me which authority is in charge of password complexity. The only one I could name is the NIST, and you mentioned them. > Alternatively, how much do you think the European Parliament has slowed development of new USB connectors? What makes you think that the USB standards committee didn't create the USB-C standard in anticipation of this and are happy that their connector became standard? The connector itself was designed to be configurable in software standards. Power is negotiated independent of the connector, as are data rates. The PD standard has already undergone multiple revisions as have the data standards and other uses for the connector. The connector is independent of its uses and standardizing it was the plan all along. Why do we need another one when the USB committee doesn't think we do?

AmericanChopper 4y ago
> Please tell me which authority is in charge of password complexity. There are numerous authorities around the world who mandate this. Last time I checked, the PCI DSS required conventional password complexity, and if you want to process credit cards, then you must comply with the PCI SSC’s standards. Central banks all around the world impose security standards on retail banks. Governments all over the world impose security standards on their vendors, and upon other industries that they regulate. NIST and the NCSC should be applauded for their innovation here, but they’re absolutely not the only regulating authorities in the world, and it took them a shockingly long time to adopt this incredibly simple change. > What makes you think that the USB standards committee didn't create the USB-C standard in anticipation of this and are happy that their connector became standard? I’m sure there’s not a standards committee in the world that would be unhappy about being enshrined into the law. But that doesn’t mean it’s appropriate to regulate this with legislation, and doesn’t change the fact that legislation like this stifles innovation. Innovation is a bottom up process. Innovation happens when small groups of people come up with something new, and gradually convince other people to adopt it by demonstrating its value to them. Changes to regulation can only happen top down. Any attempt to innovate in a regulated context eventually hits a wall where innovative experimentation must gain the blessing of the regulating authority before it progresses any further. It’s easy to advocate for this trade off when safety is involved. It’s no less stifling, in fact when a regulation is created to prevent a serious harm, it’s substantially more stifling and difficult to change. But the benefit of that trade off is very simple to understand. Regulating cellphone charging cables however, does not fall into that category, and the costs imposed by the regulation are of a highly dubious value. How many cables did you use 20 years ago, that you’re still happy using today? I can’t think of a single example in my personal life. I can only think of one that I begrudgingly use. The USB C connector will be 14 years old by the time the EU’s regulations are done rolling out.
- Eisenstein 4y ago
  > How many cables did you use 20 years ago, that you’re still happy using today? I can’t think of a single example in my personal life. Just off the top of my head... * SATA * USB-A * 1/8" / 3.5mm * 2.1/2.5mm DC barrel jack * RCA * RJ-45 * Molex * Phono / 1/4" * BNC
  - AmericanChopper 4y ago
    I find it rather unlikely that you used SATA 20 years ago, given that 20 years ago there was only one SATA HDD on the market, and it had only been on sale for a few months. RJ-45 is the only one of these that I use on a regular basis, and it’s a terrible connector. But if you’re so happy using USB A in 2023, then why would you want regulators to interfere with your freedom to choose that?
    - Eisenstein 4y ago
      If you can give me the reason why 20 years is a significant unit of measure in cable type obsolescence instead of a round number you picked off the top of your head then I will concede that I wasn't using SATA in April 2003 and that it matters in this context. I contend that it isn't and it doesn't. USB-A: The fact that connectors can coexist seems obvious to me. RJ45: Sorry you hate it -- it works well for its purpose.
      - AmericanChopper 4y ago
        My point is simply to demonstrate that the things we thought were great 20 years ago, we tend to feel differently about now. 20 years ago I definitely thought USB A was great. Today I don’t think it’s anywhere near as good as USB C, and I expect in 20 years time I’ll have a different perspective again. But the innovation that got us to here will clearly be hampered by legislating standards into law, for the reasons I explained above. So perhaps not. Perhaps in 20 years will all still be using USB C connectors, living in complete ignorance of what innovations we forewent in order to legislatively solve a problem that barely existed in the first place.
revelio 4y ago
Ask Apple? Real people spent a lot of time and effort on Thunderbolt and now their effort is actually illegal in Europe, not an outcome I imagine they ever thought possible.
- Eisenstein 4y ago
  Since when do we cry over Apple's connector choices being left behind? There happens to be a not-very-small list of them.
  - revelio 4y ago
    I don't want to get into a connector pissing match. It's a response to this question: > Why do we need another one when the USB committee doesn't think we do? Answer: maybe ask the people with alternative tech? They presumably have answers. It's nonsense to assume the USB Consortium are the only people who can design cables and connectors, there are other companies that have done so.
    - AmericanChopper 4y ago
      The EU’s regulation would prevent the USB Consortium from introducing new connectors.
    - Eisenstein 4y ago
      > It's nonsense to assume the USB Consortium are the only people who can design cables and connectors, there are other companies that have done so. Sure. There are plenty of people who can design power delivery systems to residences, and plenty of people who can design radio transmitters, and plenty of people who can make road signs... I shall weep for all of them who have the boot placed upon their necks by those dastardly regulators.

AmericanChopper 4y ago

> Please tell me which authority is in charge of password complexity. There are numerous authorities around the world who mandate this. Last time I checked, the PCI DSS required conventional password complexity, and if you want to process credit cards, then you must comply with the PCI SSC’s standards. Central banks all around the world impose security standards on retail banks. Governments all over the world impose security standards on their vendors, and upon other industries that they regulate. NIST and the NCSC should be applauded for their innovation here, but they’re absolutely not the only regulating authorities in the world, and it took them a shockingly long time to adopt this incredibly simple change. > What makes you think that the USB standards committee didn't create the USB-C standard in anticipation of this and are happy that their connector became standard? I’m sure there’s not a standards committee in the world that would be unhappy about being enshrined into the law. But that doesn’t mean it’s appropriate to regulate this with legislation, and doesn’t change the fact that legislation like this stifles innovation. Innovation is a bottom up process. Innovation happens when small groups of people come up with something new, and gradually convince other people to adopt it by demonstrating its value to them. Changes to regulation can only happen top down. Any attempt to innovate in a regulated context eventually hits a wall where innovative experimentation must gain the blessing of the regulating authority before it progresses any further. It’s easy to advocate for this trade off when safety is involved. It’s no less stifling, in fact when a regulation is created to prevent a serious harm, it’s substantially more stifling and difficult to change. But the benefit of that trade off is very simple to understand. Regulating cellphone charging cables however, does not fall into that category, and the costs imposed by the regulation are of a highly dubious value. How many cables did you use 20 years ago, that you’re still happy using today? I can’t think of a single example in my personal life. I can only think of one that I begrudgingly use. The USB C connector will be 14 years old by the time the EU’s regulations are done rolling out.

Eisenstein 4y ago
> How many cables did you use 20 years ago, that you’re still happy using today? I can’t think of a single example in my personal life. Just off the top of my head... * SATA * USB-A * 1/8" / 3.5mm * 2.1/2.5mm DC barrel jack * RCA * RJ-45 * Molex * Phono / 1/4" * BNC
- AmericanChopper 4y ago
  I find it rather unlikely that you used SATA 20 years ago, given that 20 years ago there was only one SATA HDD on the market, and it had only been on sale for a few months. RJ-45 is the only one of these that I use on a regular basis, and it’s a terrible connector. But if you’re so happy using USB A in 2023, then why would you want regulators to interfere with your freedom to choose that?
  - Eisenstein 4y ago
    If you can give me the reason why 20 years is a significant unit of measure in cable type obsolescence instead of a round number you picked off the top of your head then I will concede that I wasn't using SATA in April 2003 and that it matters in this context. I contend that it isn't and it doesn't. USB-A: The fact that connectors can coexist seems obvious to me. RJ45: Sorry you hate it -- it works well for its purpose.
    - AmericanChopper 4y ago
      My point is simply to demonstrate that the things we thought were great 20 years ago, we tend to feel differently about now. 20 years ago I definitely thought USB A was great. Today I don’t think it’s anywhere near as good as USB C, and I expect in 20 years time I’ll have a different perspective again. But the innovation that got us to here will clearly be hampered by legislating standards into law, for the reasons I explained above. So perhaps not. Perhaps in 20 years will all still be using USB C connectors, living in complete ignorance of what innovations we forewent in order to legislatively solve a problem that barely existed in the first place.

revelio 4y ago

Ask Apple? Real people spent a lot of time and effort on Thunderbolt and now their effort is actually illegal in Europe, not an outcome I imagine they ever thought possible.

Eisenstein 4y ago
Since when do we cry over Apple's connector choices being left behind? There happens to be a not-very-small list of them.
- revelio 4y ago
  I don't want to get into a connector pissing match. It's a response to this question: > Why do we need another one when the USB committee doesn't think we do? Answer: maybe ask the people with alternative tech? They presumably have answers. It's nonsense to assume the USB Consortium are the only people who can design cables and connectors, there are other companies that have done so.
  - AmericanChopper 4y ago
    The EU’s regulation would prevent the USB Consortium from introducing new connectors.
  - Eisenstein 4y ago
    > It's nonsense to assume the USB Consortium are the only people who can design cables and connectors, there are other companies that have done so. Sure. There are plenty of people who can design power delivery systems to residences, and plenty of people who can design radio transmitters, and plenty of people who can make road signs... I shall weep for all of them who have the boot placed upon their necks by those dastardly regulators.