3 ms·
I think it's fine to implement a useless control to get a customer. Just don't pretend that you're doing it because it is a useful control, pretend that you're
by deathanatos 2y ago
I think it's fine to implement a useless control to get a customer.
Just don't pretend that you're doing it because it is a useful control, pretend that you're doing it because jumping through that hoop gets you that customer, and "we're a smaller fish than the government". Especially with the government (especially if it's the USA…) there are going to be utterly pointless hoops. I can pragmatically smile & jump, … but that doesn't make it useful.
- JoshTriplett 2y agoExactly. There is absolutely a threshold of money that will get me to implement FIPS. There is no threshold of money that will get me to say it's a good idea that has any value other than getting the (singular) customer that demands FIPS.
- SAI_Peregrinus 2y agoThe core idea of FIPS doesn't seem terrible at first glance: a validation program to ensure known attacks are protected against. The obvious issue is that known attacks have progressed significantly faster than FIPS has been updated, so in practice it doesn't defend against actual attackers. Compliance-based security pretty much always falls into this trap, and often is even worse because compliance with the standard is considered the maximum that can be done instead of the minimum that must be done. FIPS' fatal flaw is that in many cases it mandates a maximum security level that is now outdated. It's a lot like building or electrical codes: if they're treated as the minimum as intended things stay safe, but if they're just barely complied with then buildings tend to fall down and/or catch fire.
- encomiast 2y agoI guess as a company I would agree that it's fine to implement a useless control to get a customer. As a tax-payer...not so much. We spend so much money (at least in the U.S.) on garbage.