Hacker News Reader

Comment by kerng | Hacker News Reader

Managment just does basic risk assessment: pay a few million here or there for a fine doesn't really impact business continuity - so security is not important at all. That's the reality.

For profit companies are often quite unethical. Laws that put executives in jail if they do not perform basic due diligence might help, e.g. proof a security program is established and executed on, to ensure their own defined standards and policies are met. There are quite a few CSO/CISOs from breached companies who should not be allowed to continue performing their profession.

Startups are often perfectly falling into this bucket unfortunately. As soon as one has more then a certain amount of customers, stakes should become extremely high.

View on HN

> For profit companies are often quite unethical.

this is why i m an advocate of making the law === to ethics. The reason a company is unethical is because those that are ethical are punished by the market (as an unethical, but completely law abiding company can outcompete them by virtue of having less costs involved).

This is difficult because not everyone believes in the same ethics or follows the same laws. I think it's best to not assume my ethics are somehow more or less valid than anyone else's.

That said, I definitely agree that the law needs to change for these situations. It's tricky though, because the entire reason people create corporations is to avoid personal responsibility for their actions.

There is a great new book describing ethical and moral stances and how one goes from moral absolutism to decency called “A Decent Life” by Todd May.

Also, corporations allow you to avoid personal financial liability but not personal responsibility.... society and community still holds people accountable for social violations. People are also still accountable for criminal activity.

>I think it's best to not assume my ethics are somehow more or less valid than anyone else's.

That violates the law of non-contradiction. Either one is wrong and one is right, or both people are wrong and they haven't realized what is right yet. Moral subjectivism as a principle makes absolutely no sense, and Aristotle destroyed that argument in Nichomachean Ethics.

I simply meant that when I am initially appalled by someone else's behavior it is usually more useful to try to understand their point of view than it is to demonize them. I also try to remind myself that I always have room for improvement. Of course there are plenty of times where I can't excuse or even understand the bad actions of others. I'm just wary of anyone treating their personal morals as absolute.

Are you trolling? I can't tell.

No. People just have no concept of objective morality today because everyone is hyper-sensitive to everything and can't take criticism at all.

what does it even mean for a moral system to be "right" or "wrong"? it's not like they have any predictive power.

I think the problem with this is that there will always be "unethical" ways to work around the legal system. In fact, having more laws can make this easier and more obscure.

This would be incredible, but generally deregulation is eschewed by the elite. Speed limits for instance serve no purpose in nearly every case except to raise revenue.

speed limits serve a very important purpose. set them so that most people will speed and now you can pull any of them over at any time.

exactly what the parent comment was getting at. the main reason to pull someone over for speeding is to issue a ticket to generate revenue.

most often, yes, it is just to raise revenue. but it also creates an opportunity to sidestep some of the protections that a driver should enjoy. technically, a police officer cannot pull you over without cause, but unreasonable traffic laws essentially create a cause to pull anyone over.

I don't disagree with GP, just pointing out that it's a bit more sinister than just writing tickets. many situations where police abuse their power and/or use excessive force begin with a legal traffic stop.

The law profession has the bar and licensing that requires you to be licensed to practice law.

Why can't we have something similar for such professions?

Because thats fundamentally not the problem. At every company I've worked at, the senior engineers could tell you exactly how they were skimping on security, why its bad, and how to fix it.

The problem isn't lack of knowledge or skill, it is that management refuses to commit the resources necessary to build secure products. When the difference between building secure X and not-secure X is often 2-3 times the effort and time commitment, managers will almost always pick not-secure X and roll the dice on nothing going wrong.

From their point of view, adding security does nothing for the product. The customers are paying for the value-prop and marginal improvements on it, not the integrity of the backend.

If you want to solve the problem of lax security, you need to make security breaches a buisness-ending proposition. You also need to increase the likelyhood of being compromised so that people aren't tempted to roll the dice. If you want regulation, I would support some kind of white hat law that says if you compromise sensitive company data, the corporation has to (1) pay an amazon-bankrupting amount of money and (2) they have to give 20% of it to the team that broke them.

> pay an amazon-bankrupting amount of money

I'd love to see this even though I know it won't happen but I want to go through a mental exercise:

(Off-topic but) where does this money go to? I think about things like traffic tickets or any other fee or fine and I can't think of anything that's any good. If it goes to anything that taxes would go toward, it will cause pressure to decrease taxes and make our governments dependent on this income.

Is there any good answer to this? Prison for the CEO and the board seems much easier in comparison.

I can see that if the intent was malicious. (Like executives made a trade-off that it was totally fine to lose insurance money to pay out in case of a breach, vs hire a security team).

But if it is the more normal circumstance (some vulnerability in the 30 libraries you use, led to the breach), there should absolutely be a monetary punishment but jail time seems too much.

Reply on news.ycombinator.com