4 ms·

There's a person whose job is to prioritize. If that person, and that person's management, think that security and privacy are a priority, then things get fixe

by Rygian 2y ago

There's a person whose job is to prioritize. If that person, and that person's management, think that security and privacy are a priority, then things get fixed.

bboygravity 2y ago
Where's the incentive for company leadership to spend resources on security currently? As long as there's no incentive to improve security, there will be no security. Examples of incentive: laws. Fix security or you can't sell your product, if you can't sell product you don't get a bonus or get fired. Don't gather location data if it's not critical for the functioning of the car or you can't sell your product, etc.
- deleted 2y ago
  [deleted]
- lobsterthief 2y ago
  In my experience it’s really up to technical leadership to highlight what will happen if security flaws are ignored. If more senior leadership continues to ignore these issues, then it’s a culture issue and I wouldn’t stick around. Surely it’s all about risk mitigation; some out-of-date NPM package with a minor flaw might cause the can to be kicked, but a major flaw with demonstrable consequences should get priority.
  - f1shy 2y ago
    You have a point. The problem in the german car industry there is no technical leadership. From the bottom management upwards they are all politicians. No technical people.
    - intelVISA 2y ago
      Is that unique to the German car industry? Outside of a few tech corps or some small startups, mainly in the US, most shops seem to 'run' their tech function more like buyer/seller e.g. "here's some Euros in exchange for [thing] we'd like" instead of the traditional employer/employee dynamic where your boss can evaluate your work to some degree. Arguably they'd be better off actually doing that as a true buyer and just engaging B2B for their easily solved CRUD variants than this weird go-between that combines the negatives of managing employees with the negatives of buying unknown solutions.
      - f1shy 2y ago
        No doubt it happens elsewhere. I meant only what I know for fact. Bur a good example where seems very much to be running similar is e.g. Boeing
- mejutoco 2y ago
  GDPR already exists. It just needs to be enforced in this context.
  - f1shy 2y ago
    Against VW? Ha ha ha!

by Rygian 2y ago

There's a person whose job is to prioritize. If that person, and that person's management, think that security and privacy are a priority, then things get fixed.

bboygravity 2y ago

Where's the incentive for company leadership to spend resources on security currently? As long as there's no incentive to improve security, there will be no security. Examples of incentive: laws. Fix security or you can't sell your product, if you can't sell product you don't get a bonus or get fired. Don't gather location data if it's not critical for the functioning of the car or you can't sell your product, etc.

deleted 2y ago
[deleted]
lobsterthief 2y ago
In my experience it’s really up to technical leadership to highlight what will happen if security flaws are ignored. If more senior leadership continues to ignore these issues, then it’s a culture issue and I wouldn’t stick around. Surely it’s all about risk mitigation; some out-of-date NPM package with a minor flaw might cause the can to be kicked, but a major flaw with demonstrable consequences should get priority.
- f1shy 2y ago
  You have a point. The problem in the german car industry there is no technical leadership. From the bottom management upwards they are all politicians. No technical people.
  - intelVISA 2y ago
    Is that unique to the German car industry? Outside of a few tech corps or some small startups, mainly in the US, most shops seem to 'run' their tech function more like buyer/seller e.g. "here's some Euros in exchange for [thing] we'd like" instead of the traditional employer/employee dynamic where your boss can evaluate your work to some degree. Arguably they'd be better off actually doing that as a true buyer and just engaging B2B for their easily solved CRUD variants than this weird go-between that combines the negatives of managing employees with the negatives of buying unknown solutions.
    - f1shy 2y ago
      No doubt it happens elsewhere. I meant only what I know for fact. Bur a good example where seems very much to be running similar is e.g. Boeing
mejutoco 2y ago
GDPR already exists. It just needs to be enforced in this context.
- f1shy 2y ago
  Against VW? Ha ha ha!