Technology

60024 readers

2600 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

256

Why the ‘mother of all breaches’ is a wake up call for everyone (www.itpro.com)

submitted 11 months ago by [email protected] to c/[email protected]

102 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 11 months ago* (last edited 11 months ago) (1 children)

Your bridge analogy falls apart because there already are standards (FIPS, among others) that are shockingly insecure despite having been updated relatively recently, and yet we still have breaches. If the standards were effective, places like AmerisourceBergen, the country's largest pharmaceutical distributor, wouldn't be supplementing them with additional safeguards. No standard is going to work perfectly, or even particularly well, for everyone. Bridges still fall down.

EDIT: Alternatively, there would need to be a provision that allows companies to sue the government if they get breached while following their standards, since it was the government that said they were safe.

[–] [email protected] 5 points 11 months ago (1 children)

Anyone who says, “think of the corporations” before they think of the people being PERMANENTLY compromised is a lost soul indeed. You are blaming the inadequacy of standards rather than the demagogues working for the corporations that enabled these lax standards. Of course there are going to be 0 day exploits that no one could protect for but that is a red herring. That’s something that could easily come out and be considered when that company is brought in front of a civil court to decide the fines, obviously!

I think we’re too dissimilar for this conversation to bear any fruit. Thanks for the well constructed devil’s advocate stance but you certainly haven’t convinced me.

[–] [email protected] 2 points 11 months ago (2 children)

When you say "corporations," it seems like you're exclusively counting companies like Google, Meta, etc, whereas I'm also including the mom and pop, 15-person operations that would be impacted by the same regulations you suggest. Those underdogs are the ones I want to protect, since they're the only chance the world has at dethroning the incumbents and ensuring that the big guys don't outlive their usefulness.

[–] [email protected] 2 points 11 months ago* (last edited 11 months ago) (1 children)

I’m not.

And what I proposed (see my revised original comment) actually protects those companies because it takes into account:

the amount of users infected
the general standards that were or were not followed by that theoretical startup rag tag team of hacks which would help paint a picture for regulators of the severity of the violation and codifying the ever-evolving concept of what is “reasonably secure”.
the market cap of said theoretical hacked corporation.

[–] [email protected] 2 points 11 months ago* (last edited 11 months ago) (1 children)

See, I figure all of those things would be accounted for in whatever civil suit gets brought against the company. Frankly, I think that's much more fair to companies both big and small because it involves a group of people working together to figure how much of a fine to levy in each individual instance, rather than having a blanket policy that may or may not account for edge cases. If the company is huge and the fuckup egregious, then the jury is (theoretically) going to throw the book at them.

At the very least, I'd want a jury in between the company and whichever government body is fining them, because regulatory bodies are prime targets for corporate shills to take over and it's harder for that to run rampant if you have a bunch of regular jackoffs acting as gatekeepers.

There's also the issue of ongoing compliance for small companies. Cybersecurity engineers are not cheap, and being all but required by law to employ one could (1) drive small companies out of business (180k a year may be cheap for Facebook, but it's definitely not for Joe Buttsniffer and Sons Catering), and (2) cause market saturation so bad that the average salary makes nobody want to do the job anymore.