4 ms·

agreed, but if a company is making millions for the security of software, the incentive is to keep it secure so customers stick with it. Remember the lastpass

agreed, but if a company is making millions for the security of software, the incentive is to keep it secure so customers stick with it. Remember the lastpass debacle, big leak and lost many customers...

krageon 2y ago
Oh yeah, corporations are so accountable. We have tons of examples of this.
advael 2y ago
Directly security-focused products like lastpass are the only things that have any market pressure whatsoever on this, and that's because they're niche products for which the security is the only value-add, marketed to explicitly security-conscious people and not insulated by a whole constellation of lock-in services. The relevant security threats for the overwhelming majority of people and organizations are breaches caused by the practices of organizations that face no such market pressure, including constant breaches of nonconsensually-harvested data, which aren't even subject to market pressures from their victims in the first place
- PaulHoule 2y ago
  I wouldn’t point to LastPass as an exemplar… https://www.theverge.com/2024/5/1/24146205/lastpass-independent-company-security-breaches https://www.theverge.com/2024/5/1/24146205/lastpass-independ...
  - advael 2y ago
    I didn't, and my point was exactly that it's not a great one, so I think we largely agree here
- the8472 2y ago
  Even for security-related products the incentives are murky. If they're not actually selling you security but a box on the compliance bingo then it's more likely that they actually increase your attack surface because they want to get their fingers into everything so they can show nice charts about all the things they're monitoring.
  - advael 2y ago
    Aye. My internal mythological idiolect's trickster deity mostly serves to personify the game-theoretic arms race of deception and is in a near-constant state of cackling derisively at the efficient market hypothesis
f1refly 2y ago
I think for some reason some people still buy cisco products, so this reasoning doesn't seem to be applicable to the real world.
hatenberg 2y ago
Only if they have competition. Which long term is not the default state in the market.
- robertlagrant 2y ago
  > Which long term is not the default state in the market Why not?
  - lucianbr 2y ago
    Why did Facebook buy Instagram and Whatsapp? Why did Google buy Waze? Why did Volkswagen buy Audi and Skoda and Seat and Bentley and so on? Might as well ask why companies like money.
    - robertlagrant 2y ago
      Sure, but the car industry is pretty old and there's plenty of competition still.
      - hatenberg 2y ago
        I’m not sure about plenty when you actually look at it, but in any case it’s because of government intervention.
  - Draiken 2y ago
    Think about it for a second mate: competition leads to winners and winners don't like competition, they like monopolies. And no, the car industry has almost no competition. It's an oligopoly with very few players and a notoriously hard industry to get in.

krageon 2y ago

Oh yeah, corporations are so accountable. We have tons of examples of this.

advael 2y ago

Directly security-focused products like lastpass are the only things that have any market pressure whatsoever on this, and that's because they're niche products for which the security is the only value-add, marketed to explicitly security-conscious people and not insulated by a whole constellation of lock-in services. The relevant security threats for the overwhelming majority of people and organizations are breaches caused by the practices of organizations that face no such market pressure, including constant breaches of nonconsensually-harvested data, which aren't even subject to market pressures from their victims in the first place

PaulHoule 2y ago
I wouldn’t point to LastPass as an exemplar… https://www.theverge.com/2024/5/1/24146205/lastpass-independent-company-security-breaches https://www.theverge.com/2024/5/1/24146205/lastpass-independ...
- advael 2y ago
  I didn't, and my point was exactly that it's not a great one, so I think we largely agree here
the8472 2y ago
Even for security-related products the incentives are murky. If they're not actually selling you security but a box on the compliance bingo then it's more likely that they actually increase your attack surface because they want to get their fingers into everything so they can show nice charts about all the things they're monitoring.
- advael 2y ago
  Aye. My internal mythological idiolect's trickster deity mostly serves to personify the game-theoretic arms race of deception and is in a near-constant state of cackling derisively at the efficient market hypothesis

f1refly 2y ago

I think for some reason some people still buy cisco products, so this reasoning doesn't seem to be applicable to the real world.

hatenberg 2y ago

Only if they have competition. Which long term is not the default state in the market.

robertlagrant 2y ago
> Which long term is not the default state in the market Why not?
- lucianbr 2y ago
  Why did Facebook buy Instagram and Whatsapp? Why did Google buy Waze? Why did Volkswagen buy Audi and Skoda and Seat and Bentley and so on? Might as well ask why companies like money.
  - robertlagrant 2y ago
    Sure, but the car industry is pretty old and there's plenty of competition still.
    - hatenberg 2y ago
      I’m not sure about plenty when you actually look at it, but in any case it’s because of government intervention.
- Draiken 2y ago
  Think about it for a second mate: competition leads to winners and winners don't like competition, they like monopolies. And no, the car industry has almost no competition. It's an oligopoly with very few players and a notoriously hard industry to get in.