3 ms·

Well, yeah. If a regulation is broken and not achieving its goal it should be changed. What's the alternative? "Regulation? We tried that once and it didn't wor

Well, yeah. If a regulation is broken and not achieving its goal it should be changed. What's the alternative? "Regulation? We tried that once and it didn't work perfectly, so now we let The Market™ sort out safety standards."

InsideOutSanta 2y ago
Who needs regulation when you can have free Fentanyl with your CrowdStrike subscription! All of your systems will go down, but you won't care, and the chance of accidental overdose is probably less than 10%!
- jddj 2y ago
  The child slave labour is what really gets the deal across the line
piker 2y ago
Yes, in many contexts that may well be the correct conclusion. Your comment presumes that regulation here has proven itself useful and not resulted in a single point of failure which potentially reduces overall safety. It’s of course the correct comment from a regulator’s perspective.
- dmix 2y ago
  Especially for something like technology and infosec which rapidly changes, it’s silly to look to slow moving regulations as a solution, not to mention ignoring history and gambling politicians will do it competently and it won’t have negative side effects like distracting teams from doing real work that’d actually help. You can make fines and consequences after the fact for blatant security failures as incentives but inventing a new “compliance” checklist of requirements is going to be out of date by the time it’s widely adopted and most companies do the bare minimum bullshit to pass these checklists.
  - engeljohnb 2y ago
    > companies do the bare minimum bullshit This can be true of security (and every other expense) whether it's regulated or not. Which do you think will result in fewer incidents: the regulated bare minimum, or the unregulated base minimum?
  - BartjeD 2y ago
    There are so many english centric assumptions here. Regulation of liability can be very generic and broad, with open standards that dont need to be updated. Case in point: Most of continental Europe still uses Napoleon's code civile to prescribe how and when private parties are liable. This is more than 150 years old. The real issue is that most Americans are stuck with an old English regulatory system, which for fear of overreach was never modernized.
- harimau777 2y ago
  For the market to work wouldn't you need something to hold the corps accountable if they fail to be secure AND to make regular people whole if the crops' failures cause them problems?
  - piker 2y ago
    Yes, like the court system … specifically class actions in the United States have been established for this exact purpose.
    - harimau777 2y ago
      After attorney's fees, class action rarely pays enough to make the victims whole. Suing individually is only an option if someone can afford a lawyer.

InsideOutSanta 2y ago

Who needs regulation when you can have free Fentanyl with your CrowdStrike subscription! All of your systems will go down, but you won't care, and the chance of accidental overdose is probably less than 10%!

jddj 2y ago
The child slave labour is what really gets the deal across the line

piker 2y ago

Yes, in many contexts that may well be the correct conclusion. Your comment presumes that regulation here has proven itself useful and not resulted in a single point of failure which potentially reduces overall safety. It’s of course the correct comment from a regulator’s perspective.

dmix 2y ago
Especially for something like technology and infosec which rapidly changes, it’s silly to look to slow moving regulations as a solution, not to mention ignoring history and gambling politicians will do it competently and it won’t have negative side effects like distracting teams from doing real work that’d actually help. You can make fines and consequences after the fact for blatant security failures as incentives but inventing a new “compliance” checklist of requirements is going to be out of date by the time it’s widely adopted and most companies do the bare minimum bullshit to pass these checklists.
- engeljohnb 2y ago
  > companies do the bare minimum bullshit This can be true of security (and every other expense) whether it's regulated or not. Which do you think will result in fewer incidents: the regulated bare minimum, or the unregulated base minimum?
- BartjeD 2y ago
  There are so many english centric assumptions here. Regulation of liability can be very generic and broad, with open standards that dont need to be updated. Case in point: Most of continental Europe still uses Napoleon's code civile to prescribe how and when private parties are liable. This is more than 150 years old. The real issue is that most Americans are stuck with an old English regulatory system, which for fear of overreach was never modernized.
harimau777 2y ago
For the market to work wouldn't you need something to hold the corps accountable if they fail to be secure AND to make regular people whole if the crops' failures cause them problems?
- piker 2y ago
  Yes, like the court system … specifically class actions in the United States have been established for this exact purpose.
  - harimau777 2y ago
    After attorney's fees, class action rarely pays enough to make the victims whole. Suing individually is only an option if someone can afford a lawyer.