2 ms·
> But if governments do nothing, then let us, as an industry, take the chance to do something to avoid another disaster that would give governments the politica
by lolinder 2y ago
> But if governments do nothing, then let us, as an industry, take the chance to do something to avoid another disaster that would give governments the political will to enslave our software, and our minds, to their wills.
Setting aside for a moment the flagrant hyperbole:
The industry will never do something without government pressure. It's a collective action problem—building reliable software has an enormous cost to it that building unreliable software does not. No company is going to swallow that cost out of the goodness of their hearts, and unless all companies in a sector move at once they can't recoup the cost from the customer.
This is the exact kind of problem that governments exist to solve: without intervention the market is broken and safety will always be sacrificed to undercut on price. Whatever the author feels about regulation, it's inevitable in some form or another. The question isn't whether the industry will get their act together before governments start moving (they most definitely won't), it's whether governments will give the industry a window to self-regulate under direct and explicit threat of intervention or if they'll immediately start writing the regulations themselves.
- gavinhoward 2y ago> Whatever the author feels about regulation, it's inevitable in some form or another. Yes, it is, and I am all for good regulations. > The question isn't whether the industry will get their act together before governments start moving (they most definitely won't) I wrote this post to change this. > it's whether governments will give the industry a window to self-regulate under direct and explicit threat of intervention or if they'll immediately start writing the regulations themselves. EU's Cybersecurity Resilience Act shows that they are already doing the latter.
- MattPalmer1086 2y agoI'd say that is entirely correct. I worked for a while on the Trustworthy Software Initiative, which looked at how we can make software more secure and reliable. We found that the economic incentives basically work against it. The only practical ways to improve it seemed to be raising awareness and education at the people level (important but not sufficient), and regulation/liability at the corporate level (the only way to really move the needle).