4 ms·

That all sounds good in theory, but in practice I would argue you can't simply create effective laws like that. I agree that companies will not spend on securi

That all sounds good in theory, but in practice I would argue you can't simply create effective laws like that. I agree that companies will not spend on security unless they have a reason too -- but how exactly can you effectively legislate that? Helping people make informed choices with where they put their business is a much better solution, in my opinion. You say that there is no cost for having weak security, but that is not because there is no legislation, it's in spite of it. Legislation written by people who don't understand the technology they are regulating is not helping.

acdha 12y ago
It's usually because legislation specifically blocks liability, as requested by the backers. By default you could sue a credit agency for reporting false information but they specifically got that exempted, similar to the way companies have managed to establish things like EULAs or binding arbitration as alternatives to the legal system. All we need to do is restore the primacy of the legal system over suborned alternatives but that requires undercutting decades of successful marketing the idea that government is inevitably bad or corrupting which has been highly effective at convincing people not to expect better.