6 ms·
I disagree. This only encourages companies not to disclose such issues.
by kaoD 2y ago
I disagree. This only encourages companies not to disclose such issues.
- Rygian 2y agoThat's where certification (Articles 42 and 43) will come in useful.
- OptionX 2y agoOnly true if the punishment for both is the same. If they come forward they should be punished more lightly, but if not at all it only encourage "we'll just apologize latter" sort of thinking.
- im3w1l 2y agoThere is also no real benefit to storing passwords in plaintext so I don't think your fear is realistic at all. If you are going to fine this at all, then 10k-100k would be an appropriate amount.
- Timon3 2y agoWhy 10k-100k, how did you arrive at that amount? Meta put their customers at risk through negligent actions. A fine in the range you propose would be lower than any investment required to improve security (e.g. by hiring a single additional person). What company in their right mind would do anything to improve security in that case?
- im3w1l 2y agoThat's close to how I arrived at the number - I used programmer wages. Reading about best practices around password storage and implementing it is fairly quick and easy, so a fine of that size will still be sufficient incentive.
- Timon3 2y agoBut why would that be an appropriate amount? By having the fine around the lowest possible investment to tackle the issue, you're literally incentivizing companies not to take security seriously. After all, you can save money early into development, and just fix it whenever you have time - you'll still save money compared to doing things right immediately. So again, why would this make sense?
- rsynnott 2y agoThat seems like pretty much a license to have practices as poor as you want. For a company of that size, a fine that size would just not be material at all.
- rsynnott 2y agoThey would have been punished more lightly if they’d come forward within 72 hours; as it is it appears to have taken two months.
- organsnyder 2y agoThe penalties would undoubtedly been much higher if they didn't disclose it. Of course, perhaps it never would have been discovered, but whistleblower protections/incentives and high enough penalties for covering up issues can set the right balance. It's similar to just about any other violation, really: if I injure someone accidentally—even through negligence—I'm going to get a much more lenient punishment if I don't try to cover it up or run away from it.
- donatj 2y agoWho in their right mind is going whistle blow and risk their entire career over a security flaw that was detected internally, found to be unutilized, and was fixed in a timely fashion? The fact that such a case even has reporting requirements at all seems nuts to me.
- orf 2y agoGood - then the person who sees that they didn’t report it can whistleblow on that and get a nice paycheck. See how that works out for the person who didn’t report it.
- xvector 2y agoI am shocked to see the "let's make writing vulnerable code illegal" take be so popular on HN. If you have written any meaningful amount of code, you have written vulnerable code.
- orf 2y agoCool story I guess, but that’s not related to anything I said.
- hifromwork 2y agoWriting vulnerable code is not illegal, negligence is.
- thirdtruck 2y agoThis is why we need regular government inspections that will make such disclosures inevitable. It's kind of insane that we don't already have an EPA (Environmental Protection Agency) of citizen data management.
- randoomed 2y agoThere needs to be some kind of punishment for failing to take basic security practise into account. A system where a simple disclosure is enough will probably result in company ignoring security, then when there is a problem they disclose and go on without change. But, it is also important for the fines to be reduced when taking the right steps to improve. Balancing this will probably be quite difficult.
- Buttons840 2y agoMake a law protecting whistleblowers. Include criminal penalties for the worst cases. What executive is going to brush something under the rug when they know their employees can whistle blow and if so, the executive will go to jail.
- xvector 2y agoExecutives can already go to jail for not reporting vulnerabilities. The risk of personal criminal liability is one of the reasons people choose not to move into the Director role, in big tech security careers.
- deleted 2y ago[deleted]