Hacker News Reader

Comment by bboygravity | Hacker News Reader

Where's the incentive for company leadership to spend resources on security currently?

As long as there's no incentive to improve security, there will be no security.

Examples of incentive: laws. Fix security or you can't sell your product, if you can't sell product you don't get a bonus or get fired. Don't gather location data if it's not critical for the functioning of the car or you can't sell your product, etc.

View on HN

In my experience it’s really up to technical leadership to highlight what will happen if security flaws are ignored. If more senior leadership continues to ignore these issues, then it’s a culture issue and I wouldn’t stick around.

Surely it’s all about risk mitigation; some out-of-date NPM package with a minor flaw might cause the can to be kicked, but a major flaw with demonstrable consequences should get priority.

You have a point. The problem in the german car industry there is no technical leadership. From the bottom management upwards they are all politicians. No technical people.

Is that unique to the German car industry? Outside of a few tech corps or some small startups, mainly in the US, most shops seem to 'run' their tech function more like buyer/seller e.g. "here's some Euros in exchange for [thing] we'd like" instead of the traditional employer/employee dynamic where your boss can evaluate your work to some degree.

Arguably they'd be better off actually doing that as a true buyer and just engaging B2B for their easily solved CRUD variants than this weird go-between that combines the negatives of managing employees with the negatives of buying unknown solutions.

No doubt it happens elsewhere. I meant only what I know for fact. Bur a good example where seems very much to be running similar is e.g. Boeing

GDPR already exists. It just needs to be enforced in this context.

Against VW? Ha ha ha!

Reply on news.ycombinator.com