3 ms·

You mean we should make companies pay hefty fines

by LtWorf 3y ago

drivebycomment 3y ago
The inconvenient truth is that people say they want more, better security but they don't want to pay for it. So to survive you need "just enough" security to get by, and that "just enough" turns out to be quite low. It's also not clear if a significantly better proactive security is necessarily better - humanity is still collectively figuring out how to balance the security/privacy vs the convenience, and we do risk fossilized information technology stacks if we jump on the security too hard. That said, it's often easy things that get the most benefit and we are collectively a long way away from getting the basic security things done properly across the board.
- LtWorf 3y ago
  > The inconvenient truth is that people say they want more, better security but they don't want to pay for it. They are already paying for it, and not getting the security.
Loughla 3y ago
How do you differentiate between honest to goodness mistakes and a willful/malicious attitude toward just getting (product) done to make money at all costs? It seems like a fine structure would have to take that into account? Or am I way off base?
- ReactiveJelly 3y ago
  It's all the same to the users, and making mistakes impossible is also part of quality. I'd say go for it.
  - worthless-trash 3y ago
    You can reduce mistakes, but you can't make mistakes impossible. This is a very rough take. We wouldn't have the level of tech we have today if we were to require 'mistakes to be impossible', Rapid growth requires mistakes to be acceptable in some situations.
rainsford 3y ago
That sounds great(-ish) when the company in question is one like SolarWinds that does hundreds of millions in revenue, but people and companies are equally reliant on open source software or software from tiny businesses. Trying to fine random Github users or the Linux foundation or whoever seems like a losing strategy. It also ignores the point from the article that the solution can't be trying to make all software secure. Whatever the incentive mechanism and whatever the source of the insecurity, it's unrealistic to think we're ever going to be able to make that a reality. But designing the environments software is used in such that broken software isn't the end of the world seems doable, if also incredibly difficult.
- Veserv 3y ago
  You do not fine Home Depot if a suspension bridge fails because the builder decided to go there and buy the cheapest rivets to hold up their suspension bridge instead of sourcing components that meet the design specifications. You fine the bridge builder for using components unfit for purpose. For that matter, even considering to use components that unfit for purpose is inconceivable in most professions. Only in software do people use systems with no specifications, no guarantees, and where even the component makers did not intend or design them to be load bearing.
concordDance 3y ago
That probably costs us as a society more man hours than it saves. Particularly in reduced competition due to deep pockets being required to even play the game.
zx8080 3y ago
It also entrenches the Big Tech. Because what FAANG and big banks can pay, no startup or small company can afford. On the other hand, a quality needs fines. Otherwise, it's too easy to "forget" an inconvenient quality to make a short-term profit (and sometimes compromise users data).

You mean we should make companies pay hefty fines

by LtWorf 3y ago

You mean we should make companies pay hefty fines

The inconvenient truth is that people say they want more, better security but they don't want to pay for it. So to survive you need "just enough" security to get by, and that "just enough" turns out to be quite low. It's also not clear if a significantly better proactive security is necessarily better - humanity is still collectively figuring out how to balance the security/privacy vs the convenience, and we do risk fossilized information technology stacks if we jump on the security too hard. That said, it's often easy things that get the most benefit and we are collectively a long way away from getting the basic security things done properly across the board.

LtWorf 3y ago
> The inconvenient truth is that people say they want more, better security but they don't want to pay for it. They are already paying for it, and not getting the security.

Loughla 3y ago

How do you differentiate between honest to goodness mistakes and a willful/malicious attitude toward just getting (product) done to make money at all costs? It seems like a fine structure would have to take that into account? Or am I way off base?

ReactiveJelly 3y ago
It's all the same to the users, and making mistakes impossible is also part of quality. I'd say go for it.
- worthless-trash 3y ago
  You can reduce mistakes, but you can't make mistakes impossible. This is a very rough take. We wouldn't have the level of tech we have today if we were to require 'mistakes to be impossible', Rapid growth requires mistakes to be acceptable in some situations.

rainsford 3y ago

That sounds great(-ish) when the company in question is one like SolarWinds that does hundreds of millions in revenue, but people and companies are equally reliant on open source software or software from tiny businesses. Trying to fine random Github users or the Linux foundation or whoever seems like a losing strategy. It also ignores the point from the article that the solution can't be trying to make all software secure. Whatever the incentive mechanism and whatever the source of the insecurity, it's unrealistic to think we're ever going to be able to make that a reality. But designing the environments software is used in such that broken software isn't the end of the world seems doable, if also incredibly difficult.

Veserv 3y ago
You do not fine Home Depot if a suspension bridge fails because the builder decided to go there and buy the cheapest rivets to hold up their suspension bridge instead of sourcing components that meet the design specifications. You fine the bridge builder for using components unfit for purpose. For that matter, even considering to use components that unfit for purpose is inconceivable in most professions. Only in software do people use systems with no specifications, no guarantees, and where even the component makers did not intend or design them to be load bearing.

concordDance 3y ago

That probably costs us as a society more man hours than it saves. Particularly in reduced competition due to deep pockets being required to even play the game.

zx8080 3y ago

It also entrenches the Big Tech. Because what FAANG and big banks can pay, no startup or small company can afford. On the other hand, a quality needs fines. Otherwise, it's too easy to "forget" an inconvenient quality to make a short-term profit (and sometimes compromise users data).