7 ms·

I personally know how this works in Europe & UK. Not only government, this applies to big companies such as large banks as well. They recruit two kinds of staff

by zkmon 1y ago

I personally know how this works in Europe & UK. Not only government, this applies to big companies such as large banks as well. They recruit two kinds of staff. One that works to progress some work and one who puts an many hurdles as possible and call it risk management, compliance, security, regulatory etc (RCSR). They hire approximately 3 times more people into these RCSR positions compared to the technical and real work related positions. These RCSR guys dump thousands of pages of guidelines, making it impossible for any meaningful work to progress. My technical team has been running around for 4 months for approvals for testing an upgrade of a database. Top management can never go against the RCSR guys, who are like priests of the church in medieval ages. And the RCSR guys have no goals linked to the progress of the real work. The don't like any thing that moves. It's a risk. Management thinks that RCSR helps with controls around the work. But what happens is, you put more people in building controls, they deliver fort walls around your garbage bins.

landl0rd 1y ago
America has a similar (if less severe) version of this problem where nobody can contradict any compliance-adjacent function. Because if you get sued, someone will ask you "why did you ignore the guidance of your compliance team??" and might even try to use that to justify piercing the corporate veil. Of course compliance types have no incentive to let business happen just like business types have a limited incentive to operate in a compliant fashion, but lawsuits favor compliance always taking precedent with a hyper-cautious approach.
- flappyeagle 1y ago
  And yet uber and Airbnb and polymarket and…
  - landl0rd 1y ago
    These are at some level businesses that do well because they avoid regulatory regimes. That risk is built-in from day one and basically their raison d'etre. I happen to think that's fine and good, but it's still the case. In other words, the guys who actually believe in a normal level of compliance are hamstrung, defection is rewarded, classic failure mode of this kind of thing.
    - quotemstr 1y ago
      IOW, America also has a stagnant, risk-averse business culture, except that superimposed on this culture there's a thin, fragile, layer of risk taking, one geography- and sector-constrained, but in which ~all US value creation and economic differentiation happens. It's like how the growth of a tree trunk happens in a thin layer beneath the bark and the rest is inert wood.
      - tomcam 1y ago
        You’re right IMHO, but now look at what it’s like to build a business in places like France or England or China or India and you’ll learn we are in a place with an order of magnitude less trouble building a business. Frightening.
        mandmandam 1y ago
        > we are in a place with an order of magnitude less trouble building a business. What is this claim based on? Is there 10x as much stress among French business owners? Are entrepreneurs working 10x as hard in China? Are there 10x fewer businesses in England? And, stepping back a bit: To the extent that running a business is easier in America, how much of that is because the US exploits and bullies the rest of the world? How much is because it's a huge country with vast resources (that were stolen from its murdered inhabitants)? How much is because the lack of regulations allows for rampant externalization of costs? How much is because businesses are more 'free' to exploit their own workers? How much is because most of the mechanisms for basic accountability are broken? These aren't "gotcha" questions. They're fundamentally important to our future, because none of that is sustainable.
        tomcam 1y ago
        >> we are in a place with an order of magnitude less trouble building a business. > What is this claim based on? Blog posts I've read from I've read, largely in HN. Personal interviews in those countries. > Is there 10x as much stress among French business owners? Are entrepreneurs working 10x as hard in China? Are there 10x fewer businesses in England? No clue. I've run many businesses and it's all stressful. > And, stepping back a bit: To the extent that running a business is easier in America, how much of that is because the US exploits and bullies the rest of the world? The US definitely exploits and bullies the rest of the world. Very often it's shameful and I hate it. All countries exploit other countries in their best interest. You may also be forgetting that for centuries the US has policed the world's waterways mostly in its own interest but, from about 1945-2020, for the rest of the world too, all at its own expense. We've been the leaders in anti-pirate forces since Jefferson. > How much is because it's a huge country with vast resources A lot. We are the luckiest country on Earth by a country mile. But also because of somewhat free markets, rule of law, somewhat free press, property rights, and constitutional belief in the individual. Japan doesn't have a huge country with vast resources but still does well. Canada and many countries in Africa have vast resources they could exploit responsibly but don't. > (that were stolen from its murdered inhabitants)? All countries are stolen from murdered inhabitants. All of them. Look at the Comanche, the Huns, the Houthis, the Japanese in WWII, the Goths, the Chinese, the Spanish, the Portuguese, the Dutch, and Luxembourg. OK I'm kidding about Luxembourg. > How much is because the lack of regulations allows for rampant externalization of costs? Super complex question and a good one. Impossible to deal with in a comment. > How much is because businesses are more 'free' to exploit their own workers? Zero. No one forces you to work here, unless you're one of the hundred of thousands of trafficked workers here. Those traffickers should be hunted down and shot. > How much is because most of the mechanisms for basic accountability are broken? Don't know. We have huge corrupt corporations and a huge corrupt government working hand in hand against the citizens, but we also have tons of regulations and a justice system that can still help the little guy sometimes. You are absolutely on the right track, but we might have different definitions for accountability. However since we're comparing the USA to others Mexico and China are shot through with corruption, China more perhaps than any other country on earth. Though we give them a run for their money. > These aren't "gotcha" questions. They're fundamentally important to our future, because none of that is sustainable. I sort of think you played your hand. The term "none of that is sustainable" suggests to me you've already decided on answers to all these non-gotcha questions. But I tried to answer them in the best light.
runlevel1 1y ago
In theory, when there's viable competition, a competitor will take advantage of their competitor's overly-cautious interpretation.* But if the regulation is indeed oppressive or byzantine, everybody hurts and only the biggest survive. *Social contagion effects on risk perception can be a confounding factor here, though.
- watwut 1y ago
  Practically, this is the reason for regulation and enforcement. Absent those, only companies that dont care about customer data safety survive. There will be scandal once in a while, but safety conscious companies will still all die.
MarkSweep 1y ago
> My technical team has been running around for 4 months for approvals for testing an upgrade of a database. Jeez, and I was just grumbling how it takes up to 24 hours for a change I make to appear in prod, compared to about 4 hours at my previous job. It should be possible to develop automated systems and processes to keep most changes on the “happy path” where approvals are quick. These sorts of organization responses were a new layer of people who can say “no” grow whenever a problem happens or a regulation changes are suffocating.
xyzzy123 1y ago
It's also interesting how much worse security gets with all this RCSR oversight. Because the policy teams don't understand the technical details, they get hung up on things that don't matter so all your "security budget" (in terms of dev effort available for improvement) gets spent on useless things. Because there is a CIS guideline recommending "do not put secrets in environment variables" in k8s, a team I work with recently spent two weeks modifying deployments of all their third party charts to mount all secrets as volumes, this included modifying / patching upstream helm charts. This will be a maintenance burden forever lol. Actual security benefit in context is approximately zero. Meanwhile they COULD have spent that time implementing broadly effective things like NetworkPolicy or CSP for the front-end but now there is no dev time for that. At the top levels of their process there are plenty of risk x impact matrices but there aren't corresponding effort / payoff assessments, so the things being done end up not being engineering.
- fch42 1y ago
  "secrets in env vars" (or program arguments) always triggers squeamy smirks off me. It's a bullsh*t rule. One that would work is a clear mandate, "if you're found to use env vars / args for secrets, you must demonstrate within four weeks of finding that you have implemented code to clear your process' args/env vars immediately after program startup, for the lifetime of the process (and that you moved all secrets to non-cleartext memory)". Given how frameworky-frameworky much modern software is, such action items make folks think ("how on earth do I get state to openssl&Co without env vars", ...). But alas, the regulations people shy away from any such precise prescriptions - because then, they have to involve themselves with SRE, SOC, CI/CD, and developers for monitoring, enforcement and training/assistance. So instead, as you say, byzantine Reuben-Goldberg constructs are created exploiting "every loophole in the book" to comply with the rule but not the spirit; software becomes even more of a performance art. I think, over time, I have moved into the camp that strongly believes all practical security is security-from-obscurity. Starting with the compliance rules around it.
- baby_souffle 1y ago
  > This will be a maintenance burden forever lol. Not if they never ever ship an update. (i - briefly - worked for place that did things this way. They didn't update the chart, but they _did_ use `sed` to update the image tag from time to time.)
numpad0 1y ago
Sounds like the rest of the world couldn't be bothered with learning code, but couldn't tolerate code being law, that they tried to dilute the code's stake by adding more laws, despite code still being the law.
dreamcompiler 1y ago
This is not limited to Europe. I worked for a company like this in the US. The problem of course is the incentive structure: The penalty for violating some minor regulation was that the company would cease to exist (or so management assumed) while there was effectively no penalty for not getting the mission accomplished. Thus the only reasonable course of action was to do nothing.
darkhorse222 1y ago
I imagine it must feel like that. The reality is that engineers are blasé with data and have been since the personal computing revolution. Legal frameworks are incredibly irritating and often defined by people who know nothing about what they're regulating. This can lead to very bad laws. Given that we live in the real world and one can be sued for violating those laws, the stakes are quite high and low cost. Many states in the US allow individuals to bring suit based on these laws, meaning all that needs to happen is you make a mistake and some rando has time to hire a lawyer. And that is, by the way, notwithstanding the reality that many of the annoying compliance requirements are actually not all that annoying in principle, they are annoying to implement because many software development practices involve the free flow of data. Maybe that was fine when it was public blogs. But when it's someone's medical records or their financial data, or when it lands in the bucket of a Cambridge Analytica type, sorry, there's a higher burden. It is frustrating, I know. But we as engineers need to take responsibility for the consequences and stakes of what we're building. It's lack of that awareness that caused many of the largest controversies in our industry.
ropable 1y ago
This is a crude strawman argument at best. I don't disagree that compliance/regulation requirements can be overdone, but unfettered progress-at-any-cost has its own downside. History is overloaded with technological innovations followed by regulation efforts to mitigate the the unintended consequences. Reality, as always, as much more nuanced than this hot take. It's a balancing act.
kindkang2024 1y ago
> These RCSR guys dump thousands of pages of guidelines, making it impossible for any meaningful work to progress. This always reminds me of Darwin’s discovery — survival of the fittest — especially in the ruthless and highly competitive world of commerce. Yet this truth is often misunderstood or even outright rejected by those with a so-called "woke" mindset. In such a competitive world, the only inevitable outcome for a business that isn’t fit enough is failure and eventual disappearance. Always remember: no one can be forced to buy a product or service if they live in freedom. Deals won’t happen because of burdensome frameworks like "RCSR." Trade flows naturally toward what creates the greatest value for both parties — usually better products or services at lower costs. From a Darwinian perspective, this kind of trade helps make the parties involved more fit. So why wouldn’t they choose it? Hope all come to recognize this natural/divine will with reverence — and try our best to align with it and stay fit (while helping to keep those we love fit as well). This can truly help foster a competitive market and benefits all.
- Moomoomoo309 1y ago
  Stop using the word "woke". No one agrees what it means, so when you use it, people interpret it differently. The people I think you meant when you said "woke" probably aren't actually the people you meant. Seriously, just say what you mean, because "woke" is meaningless.
  - mvdtnz 1y ago
    You're responding to AI slop. Just so you know.
    - kindkang2024 1y ago
      It is not. Just so you know. But I do have, at times, used AI to help the writing, primarily for checking errors and fine-tuning the wording to express my thoughts/wills precisely. Does it considered AI slop? And I was quite offended by your comment. Your choice of words seems to suggest a malevolent intent. It appears your real objection is to the views I expressed but you hide in a smart way - If it is so, it is indeed disgusting. And, I truly hope the 'Free Will' behind the name 'mvdtnz' can transcend the 'Representation' of mere words and symbols,and grasp and judge the underlying 'Will' directly— never become ensnared by the Representation ("The World as Will and Representation.") And I sincerely hope you can avoid such attacks in the future and choose to state your points directly. My karma dropped by 2 points due to your response—a powerful reminder that we should all be cautious with our words - the human mind is perpetually trained by the words it consumes, not unlike an LLM. I'm taking the good advice I received about 'Woke', adapting it for the term 'AI slop', and sharing it with you: Stop using the word "AI slop". No one agrees what it means, so when you use it, people interpret it differently. The people I think you meant when you said "AI slop" probably aren't actually the people you meant. Seriously, just say what you mean, because "AI slop" is meaningless.

by zkmon 1y ago

landl0rd 1y ago

America has a similar (if less severe) version of this problem where nobody can contradict any compliance-adjacent function. Because if you get sued, someone will ask you "why did you ignore the guidance of your compliance team??" and might even try to use that to justify piercing the corporate veil. Of course compliance types have no incentive to let business happen just like business types have a limited incentive to operate in a compliant fashion, but lawsuits favor compliance always taking precedent with a hyper-cautious approach.

flappyeagle 1y ago
And yet uber and Airbnb and polymarket and…
- landl0rd 1y ago
  These are at some level businesses that do well because they avoid regulatory regimes. That risk is built-in from day one and basically their raison d'etre. I happen to think that's fine and good, but it's still the case. In other words, the guys who actually believe in a normal level of compliance are hamstrung, defection is rewarded, classic failure mode of this kind of thing.
  - quotemstr 1y ago
    IOW, America also has a stagnant, risk-averse business culture, except that superimposed on this culture there's a thin, fragile, layer of risk taking, one geography- and sector-constrained, but in which ~all US value creation and economic differentiation happens. It's like how the growth of a tree trunk happens in a thin layer beneath the bark and the rest is inert wood.
    - tomcam 1y ago
      You’re right IMHO, but now look at what it’s like to build a business in places like France or England or China or India and you’ll learn we are in a place with an order of magnitude less trouble building a business. Frightening.
      - mandmandam 1y ago
        > we are in a place with an order of magnitude less trouble building a business. What is this claim based on? Is there 10x as much stress among French business owners? Are entrepreneurs working 10x as hard in China? Are there 10x fewer businesses in England? And, stepping back a bit: To the extent that running a business is easier in America, how much of that is because the US exploits and bullies the rest of the world? How much is because it's a huge country with vast resources (that were stolen from its murdered inhabitants)? How much is because the lack of regulations allows for rampant externalization of costs? How much is because businesses are more 'free' to exploit their own workers? How much is because most of the mechanisms for basic accountability are broken? These aren't "gotcha" questions. They're fundamentally important to our future, because none of that is sustainable.
        tomcam 1y ago
        >> we are in a place with an order of magnitude less trouble building a business. > What is this claim based on? Blog posts I've read from I've read, largely in HN. Personal interviews in those countries. > Is there 10x as much stress among French business owners? Are entrepreneurs working 10x as hard in China? Are there 10x fewer businesses in England? No clue. I've run many businesses and it's all stressful. > And, stepping back a bit: To the extent that running a business is easier in America, how much of that is because the US exploits and bullies the rest of the world? The US definitely exploits and bullies the rest of the world. Very often it's shameful and I hate it. All countries exploit other countries in their best interest. You may also be forgetting that for centuries the US has policed the world's waterways mostly in its own interest but, from about 1945-2020, for the rest of the world too, all at its own expense. We've been the leaders in anti-pirate forces since Jefferson. > How much is because it's a huge country with vast resources A lot. We are the luckiest country on Earth by a country mile. But also because of somewhat free markets, rule of law, somewhat free press, property rights, and constitutional belief in the individual. Japan doesn't have a huge country with vast resources but still does well. Canada and many countries in Africa have vast resources they could exploit responsibly but don't. > (that were stolen from its murdered inhabitants)? All countries are stolen from murdered inhabitants. All of them. Look at the Comanche, the Huns, the Houthis, the Japanese in WWII, the Goths, the Chinese, the Spanish, the Portuguese, the Dutch, and Luxembourg. OK I'm kidding about Luxembourg. > How much is because the lack of regulations allows for rampant externalization of costs? Super complex question and a good one. Impossible to deal with in a comment. > How much is because businesses are more 'free' to exploit their own workers? Zero. No one forces you to work here, unless you're one of the hundred of thousands of trafficked workers here. Those traffickers should be hunted down and shot. > How much is because most of the mechanisms for basic accountability are broken? Don't know. We have huge corrupt corporations and a huge corrupt government working hand in hand against the citizens, but we also have tons of regulations and a justice system that can still help the little guy sometimes. You are absolutely on the right track, but we might have different definitions for accountability. However since we're comparing the USA to others Mexico and China are shot through with corruption, China more perhaps than any other country on earth. Though we give them a run for their money. > These aren't "gotcha" questions. They're fundamentally important to our future, because none of that is sustainable. I sort of think you played your hand. The term "none of that is sustainable" suggests to me you've already decided on answers to all these non-gotcha questions. But I tried to answer them in the best light.

runlevel1 1y ago

In theory, when there's viable competition, a competitor will take advantage of their competitor's overly-cautious interpretation.* But if the regulation is indeed oppressive or byzantine, everybody hurts and only the biggest survive. *Social contagion effects on risk perception can be a confounding factor here, though.

watwut 1y ago
Practically, this is the reason for regulation and enforcement. Absent those, only companies that dont care about customer data safety survive. There will be scandal once in a while, but safety conscious companies will still all die.

MarkSweep 1y ago

> My technical team has been running around for 4 months for approvals for testing an upgrade of a database. Jeez, and I was just grumbling how it takes up to 24 hours for a change I make to appear in prod, compared to about 4 hours at my previous job. It should be possible to develop automated systems and processes to keep most changes on the “happy path” where approvals are quick. These sorts of organization responses were a new layer of people who can say “no” grow whenever a problem happens or a regulation changes are suffocating.

xyzzy123 1y ago

It's also interesting how much worse security gets with all this RCSR oversight. Because the policy teams don't understand the technical details, they get hung up on things that don't matter so all your "security budget" (in terms of dev effort available for improvement) gets spent on useless things. Because there is a CIS guideline recommending "do not put secrets in environment variables" in k8s, a team I work with recently spent two weeks modifying deployments of all their third party charts to mount all secrets as volumes, this included modifying / patching upstream helm charts. This will be a maintenance burden forever lol. Actual security benefit in context is approximately zero. Meanwhile they COULD have spent that time implementing broadly effective things like NetworkPolicy or CSP for the front-end but now there is no dev time for that. At the top levels of their process there are plenty of risk x impact matrices but there aren't corresponding effort / payoff assessments, so the things being done end up not being engineering.

fch42 1y ago
"secrets in env vars" (or program arguments) always triggers squeamy smirks off me. It's a bullsh*t rule. One that would work is a clear mandate, "if you're found to use env vars / args for secrets, you must demonstrate within four weeks of finding that you have implemented code to clear your process' args/env vars immediately after program startup, for the lifetime of the process (and that you moved all secrets to non-cleartext memory)". Given how frameworky-frameworky much modern software is, such action items make folks think ("how on earth do I get state to openssl&Co without env vars", ...). But alas, the regulations people shy away from any such precise prescriptions - because then, they have to involve themselves with SRE, SOC, CI/CD, and developers for monitoring, enforcement and training/assistance. So instead, as you say, byzantine Reuben-Goldberg constructs are created exploiting "every loophole in the book" to comply with the rule but not the spirit; software becomes even more of a performance art. I think, over time, I have moved into the camp that strongly believes all practical security is security-from-obscurity. Starting with the compliance rules around it.
baby_souffle 1y ago
> This will be a maintenance burden forever lol. Not if they never ever ship an update. (i - briefly - worked for place that did things this way. They didn't update the chart, but they _did_ use `sed` to update the image tag from time to time.)

numpad0 1y ago

Sounds like the rest of the world couldn't be bothered with learning code, but couldn't tolerate code being law, that they tried to dilute the code's stake by adding more laws, despite code still being the law.

dreamcompiler 1y ago

This is not limited to Europe. I worked for a company like this in the US. The problem of course is the incentive structure: The penalty for violating some minor regulation was that the company would cease to exist (or so management assumed) while there was effectively no penalty for not getting the mission accomplished. Thus the only reasonable course of action was to do nothing.

darkhorse222 1y ago

I imagine it must feel like that. The reality is that engineers are blasé with data and have been since the personal computing revolution. Legal frameworks are incredibly irritating and often defined by people who know nothing about what they're regulating. This can lead to very bad laws. Given that we live in the real world and one can be sued for violating those laws, the stakes are quite high and low cost. Many states in the US allow individuals to bring suit based on these laws, meaning all that needs to happen is you make a mistake and some rando has time to hire a lawyer. And that is, by the way, notwithstanding the reality that many of the annoying compliance requirements are actually not all that annoying in principle, they are annoying to implement because many software development practices involve the free flow of data. Maybe that was fine when it was public blogs. But when it's someone's medical records or their financial data, or when it lands in the bucket of a Cambridge Analytica type, sorry, there's a higher burden. It is frustrating, I know. But we as engineers need to take responsibility for the consequences and stakes of what we're building. It's lack of that awareness that caused many of the largest controversies in our industry.

ropable 1y ago

This is a crude strawman argument at best. I don't disagree that compliance/regulation requirements can be overdone, but unfettered progress-at-any-cost has its own downside. History is overloaded with technological innovations followed by regulation efforts to mitigate the the unintended consequences. Reality, as always, as much more nuanced than this hot take. It's a balancing act.

kindkang2024 1y ago

> These RCSR guys dump thousands of pages of guidelines, making it impossible for any meaningful work to progress. This always reminds me of Darwin’s discovery — survival of the fittest — especially in the ruthless and highly competitive world of commerce. Yet this truth is often misunderstood or even outright rejected by those with a so-called "woke" mindset. In such a competitive world, the only inevitable outcome for a business that isn’t fit enough is failure and eventual disappearance. Always remember: no one can be forced to buy a product or service if they live in freedom. Deals won’t happen because of burdensome frameworks like "RCSR." Trade flows naturally toward what creates the greatest value for both parties — usually better products or services at lower costs. From a Darwinian perspective, this kind of trade helps make the parties involved more fit. So why wouldn’t they choose it? Hope all come to recognize this natural/divine will with reverence — and try our best to align with it and stay fit (while helping to keep those we love fit as well). This can truly help foster a competitive market and benefits all.

Moomoomoo309 1y ago
Stop using the word "woke". No one agrees what it means, so when you use it, people interpret it differently. The people I think you meant when you said "woke" probably aren't actually the people you meant. Seriously, just say what you mean, because "woke" is meaningless.
- mvdtnz 1y ago
  You're responding to AI slop. Just so you know.
  - kindkang2024 1y ago
    It is not. Just so you know. But I do have, at times, used AI to help the writing, primarily for checking errors and fine-tuning the wording to express my thoughts/wills precisely. Does it considered AI slop? And I was quite offended by your comment. Your choice of words seems to suggest a malevolent intent. It appears your real objection is to the views I expressed but you hide in a smart way - If it is so, it is indeed disgusting. And, I truly hope the 'Free Will' behind the name 'mvdtnz' can transcend the 'Representation' of mere words and symbols,and grasp and judge the underlying 'Will' directly— never become ensnared by the Representation ("The World as Will and Representation.") And I sincerely hope you can avoid such attacks in the future and choose to state your points directly. My karma dropped by 2 points due to your response—a powerful reminder that we should all be cautious with our words - the human mind is perpetually trained by the words it consumes, not unlike an LLM. I'm taking the good advice I received about 'Woke', adapting it for the term 'AI slop', and sharing it with you: Stop using the word "AI slop". No one agrees what it means, so when you use it, people interpret it differently. The people I think you meant when you said "AI slop" probably aren't actually the people you meant. Seriously, just say what you mean, because "AI slop" is meaningless.