Did you even read my comment? I specifically mentioned that the size of the fine could be tied to their market cap.
If you work in cyber security, you’d know that there are best practices in place for cybersecurity and it is a WELL UNDERSTOOD FIELD. The main advice everyone gives is to never roll your own cryptography…and that is EXACTLY what many of the hacked companies did.
Taking a shortcut and hiring shitty devs who just use some random NPM package for security and call it a day is exactly why there are so many breaches. Just as bridges need to be built to withstand double or triple their weight, there should be STANDARDS in place that if violated are subject to fines.
Companies like Google would basically have to build SUPER SECURE technologies lest they be bankrupted by a breach.
In conclusion, please try to remove your tongue from your exploitive employer’s back side.
I did miss that, but again, it’s additional fines on top of an almost guaranteed lawsuit for something that may not even be their fault. If they got owned by a Heartbleed exploit back when it was first announced and a fix wasn’t available yet, should a company be responsible for that? What about when they get hit by a vuln that’s been stockpiled for a couple years and purposely has no fix due to interference from bad actors? There are a lot of situations where fining someone for getting breached doesn’t make sense.
You make great points but my final point is this: if a company simply cannot guarantee protection of user data, it shouldn’t be trusted with user data in the first place.
And I’ll counter with this: no system is perfect, especially when major parts are made by non-employees. Mistakes can and do happen because corporations, regardless of size, are made up of humans, and humans are really good at fucking up.
Go back to my bridge analogy and test that against what you just said.
Your comment equates to: “oh well, that bridge falling killed thousands of people. At least we were able to allow them to fail in the crucible of the free market!”
Your bridge analogy falls apart because there already are standards (FIPS, among others) that are shockingly insecure despite having been updated relatively recently, and yet we still have breaches. If the standards were effective, places like AmerisourceBergen, the country’s largest pharmaceutical distributor, wouldn’t be supplementing them with additional safeguards. No standard is going to work perfectly, or even particularly well, for everyone. Bridges still fall down.
EDIT: Alternatively, there would need to be a provision that allows companies to sue the government if they get breached while following their standards, since it was the government that said they were safe.
Anyone who says, “think of the corporations” before they think of the people being PERMANENTLY compromised is a lost soul indeed. You are blaming the inadequacy of standards rather than the demagogues working for the corporations that enabled these lax standards. Of course there are going to be 0 day exploits that no one could protect for but that is a red herring. That’s something that could easily come out and be considered when that company is brought in front of a civil court to decide the fines, obviously!
I think we’re too dissimilar for this conversation to bear any fruit. Thanks for the well constructed devil’s advocate stance but you certainly haven’t convinced me.
When you say “corporations,” it seems like you’re exclusively counting companies like Google, Meta, etc, whereas I’m also including the mom and pop, 15-person operations that would be impacted by the same regulations you suggest. Those underdogs are the ones I want to protect, since they’re the only chance the world has at dethroning the incumbents and ensuring that the big guys don’t outlive their usefulness.
And what I proposed (see my revised original comment) actually protects those companies because it takes into account:
the amount of users infected
the general standards that were or were not followed by that theoretical startup rag tag team of hacks which would help paint a picture for regulators of the severity of the violation and codifying the ever-evolving concept of what is “reasonably secure”.
the market cap of said theoretical hacked corporation.
Did you even read my comment? I specifically mentioned that the size of the fine could be tied to their market cap.
If you work in cyber security, you’d know that there are best practices in place for cybersecurity and it is a WELL UNDERSTOOD FIELD. The main advice everyone gives is to never roll your own cryptography…and that is EXACTLY what many of the hacked companies did.
Taking a shortcut and hiring shitty devs who just use some random NPM package for security and call it a day is exactly why there are so many breaches. Just as bridges need to be built to withstand double or triple their weight, there should be STANDARDS in place that if violated are subject to fines.
Companies like Google would basically have to build SUPER SECURE technologies lest they be bankrupted by a breach.
In conclusion, please try to remove your tongue from your exploitive employer’s back side.
I did miss that, but again, it’s additional fines on top of an almost guaranteed lawsuit for something that may not even be their fault. If they got owned by a Heartbleed exploit back when it was first announced and a fix wasn’t available yet, should a company be responsible for that? What about when they get hit by a vuln that’s been stockpiled for a couple years and purposely has no fix due to interference from bad actors? There are a lot of situations where fining someone for getting breached doesn’t make sense.
You make great points but my final point is this: if a company simply cannot guarantee protection of user data, it shouldn’t be trusted with user data in the first place.
And I’ll counter with this: no system is perfect, especially when major parts are made by non-employees. Mistakes can and do happen because corporations, regardless of size, are made up of humans, and humans are really good at fucking up.
I’m not trying to get the last word, I swear! 🤣
Go back to my bridge analogy and test that against what you just said.
Your comment equates to: “oh well, that bridge falling killed thousands of people. At least we were able to allow them to fail in the crucible of the free market!”
Your bridge analogy falls apart because there already are standards (FIPS, among others) that are shockingly insecure despite having been updated relatively recently, and yet we still have breaches. If the standards were effective, places like AmerisourceBergen, the country’s largest pharmaceutical distributor, wouldn’t be supplementing them with additional safeguards. No standard is going to work perfectly, or even particularly well, for everyone. Bridges still fall down.
EDIT: Alternatively, there would need to be a provision that allows companies to sue the government if they get breached while following their standards, since it was the government that said they were safe.
Anyone who says, “think of the corporations” before they think of the people being PERMANENTLY compromised is a lost soul indeed. You are blaming the inadequacy of standards rather than the demagogues working for the corporations that enabled these lax standards. Of course there are going to be 0 day exploits that no one could protect for but that is a red herring. That’s something that could easily come out and be considered when that company is brought in front of a civil court to decide the fines, obviously!
I think we’re too dissimilar for this conversation to bear any fruit. Thanks for the well constructed devil’s advocate stance but you certainly haven’t convinced me.
When you say “corporations,” it seems like you’re exclusively counting companies like Google, Meta, etc, whereas I’m also including the mom and pop, 15-person operations that would be impacted by the same regulations you suggest. Those underdogs are the ones I want to protect, since they’re the only chance the world has at dethroning the incumbents and ensuring that the big guys don’t outlive their usefulness.
I just realized you’re the Tesla guy from yesterday. I’m glad we could have a more mature discussion on this topic and I’m glad I didn’t block you. 🤣
I’m not.
And what I proposed (see my revised original comment) actually protects those companies because it takes into account: