3 ms·
Given that you are running a security company, in that respect you have personal interest in this bill getting passed, right? The problems with the bill are ma
by jules 14y ago
Given that you are running a security company, in that respect you have personal interest in this bill getting passed, right?
The problems with the bill are mainly this:
1. The immunity gives companies an incentive to share more data.
2. There is neither oversight nor transparency for the sharing of information and other measures companies are allowed to take based on this bill, and what the government and third parties are allowed to do with the information.
3. Even if there were oversight, the conditions under which the companies would get immunity are so broad and ill defined that there is practically no restriction on that.
I would like to add that there are people who make hysterical arguments against the bill, but that doesn't mean that the bill isn't bad.
- tptacek 14y agoWe run a software security engineering firm, we don't do FedGov work, and in no way benefit from CISPA. The whole point of the bill is to get companies to share more data.
- jules 14y agoCISPA not only works for sharing of information with the government, but also with security companies. Your second sentence is a rather weak counterargument. (1) would be fine on its own, it is in the context of (2) and (3) that it is not; the incentives make (2) and (3) extra bad.
- tptacek 14y agoWe are a SOURCE of threat information. We are not a consumer of threat information.
- jules 14y agoWouldn't CISPA also protect the companies providing information to you by giving you permission to test and/or access to their systems, and hence be beneficial to your business? Why aren't you a consumer of threat information that way?
- tptacek 14y agoI think you have absolutely no idea what it is we do.
- jules 14y agoWhy are you so defensive and rude? I think I have an idea what you do. You check applications for security vulnerabilities. While doing this, you may access information that usually would be considered information that the company you are investigating would not be allowed to give you. But with CISPA, they would be allowed to give you. FYI, you have a dead link: http://www.matasano.com/services/shipsafe/ http://www.matasano.com/services/shipsafe/
- tptacek 14y agoI like the guy who asks why I'm being rude after suggesting that I arrived at my public policy positions out of a concealed financial interest. You have a weird and broken understanding of how engineering firms are contacted to test for vulnerabilities. CISPA has absolutely no bearing on my firm whatsoever.
- jules 14y agoCan you explain how the way engineering firms are contracted means that CISPA has absolutely no bearing on your firm? As far as I can see, the bill doesn't say that if a company is contracted in a certain way, then its protections don't apply. Surely it's not rude to ask if you have a personal interest, given that (1) CISPA has explicit provisions for security companies (2) it's not clear why this would not apply to your company and (3) you defend CISPA on almost every CISPA post on hacker news.
- tptacek 14y agoIf from this point on you would like to tell yourself that my non-responsive comment here, and my future lack of responsiveness to any of your other comments, implied that you Perry Mason'd some kind of acknowledgement of my corrupt CISPA dealings out of me on Hacker News, you have my blessing.