Hacker News Reader

Comment by Townley | Hacker News Reader

This is an absurd sum, both in the fees:rewards ratio, and in the total amount ($22,500 might as well be nothing for all of the people involved).

That said, I'm a bit surprised to see a "Rake them over the coals" attitude on HN. They leaked a DB with hashed passwords, user data, and last 4 digits of credit cards. That happens to even the most responsible websites all the time, even with seven years of best practices to build upon. I know it would have absolutely happened to the awful, framework-less PHP I was writing back in 2012.

Without letting Zappos off the hook for not taking security more seriously, it seems to me that substantial, non-ridiculous monetary punishments should be reserved for instances of deliberate recklessness, or at least clear, preventable negligence.

View on HN

Their settlement ended up costing as much as a few good engineers for a year. Consequences like that will mean it makes financial sense to ignore security and just pay the settlements as they come.

Consequences should motivate companies to be secure. i.e. it should be much cheaper to hire a large competent security team who has a chunk of engineer time than it is to pay tiny settlements to teams of lawyers.

Data breaches aren't just necessary evils, they can be prevented, but not without a lot of extra work. Companies should consider a data breach to be an existential threat, not a cost of business.

> Consequences like that will mean it makes financial sense to ignore security and just pay the settlements as they come.

If judgments like this were the only reason to prioritize security, then sure. But hopefully there are at least some market/reputational forces at work too.

I honestly don't think the general public cares enough for reputational effects to be particularly important.

Can you think of an incident, however heinous, that materially impacted a company's bottom line?

The Ashley Madison Breach comes to mind. If the core demographic cares about not wanting their data on the platform to get out, they will vote with their feet. That said, I think this example is not the norm, and most people probably won't care for most applications. https://en.wikipedia.org/wiki/Ashley_Madison_data_breach

I mean wasn't it also revealed that an overwhelming amount of people on the site were male in the same breach? Id guess that would be a motivating factor more than the privacy

If the general public doesn't care, are the damages really significant?

Data breaches are never a question of "if", but "when".

> $22,500 might as well be nothing for all of the people involved

It looks like the $22,500 is just for 9 named plaintiffs ($2,500 each). The other victims get nothing.

I worked for a much smaller place with far less resources than Amazon (which is what Zappos is) and our PCI compliance as a payments processor was rock solid. Our systems were under attack all the time from all corners of the globe and we never suffered a breach.

If you can't manage PCI compliance then you shouldn't be involved with credit cards.

> I know it would have absolutely happened to the awful, framework-less PHP I was writing back in 2012.

If you were writing framework-less PHP in 2012, you were doing it wrong. There were major frameworks well before that point: CakePHP (Apr 2005), Symfony (Oct 2005), CodeIgniter (2006) and even Laravel (2011).

What is the point of your comment? OP never claimed to be doing it right in 2012.

And nor is frameworkless inherently wrong, right? Plenty of footguns, but a decent mind for security can deal with them.

Reply on news.ycombinator.com