Accessing Publicly Available Information on the Internet Is Not a Crime

Re:Accessing Publicly Available Information on the Internet ... by nathan_long on Thursday December 14, 2017 @12:30PM (#15924254)

> It should be ensured that certain practices are followed in security

Let's not legislate specific practices.

Imagine if we had security legislation from 1995 to follow when programming today. Imagine trying to explain to senators why last year's XSS protection rules need updating. Imagine Oracle lobbying to get their database enshrined as the "security-compliant" one.

The law should focus on outcomes: if a site gets hacked and people are harmed, the site should be penalized.

[ Parent | on HN ]

Re:Accessing Publicly Available Information on the Internet ... by gkya on Thursday December 14, 2017 @01:43PM (#15925297)

"Security compliance" is about how you use a given database, not which one you happen to use. You can securely (but inefficiently) store credentials in a plain text file.

WRT some defences becoming outdated by time, well, it probably would not be two-decades behind, but a couple years or so at most. Even then, ensuring that is better then nothing.

People need tools to judge if they can safely use some product, and that's why standards exist. Otherwise companies are going to continue to screw us until they drop the balls.

[ Parent | on HN ]

Re:Accessing Publicly Available Information on the Internet ... by nathan_long on Friday December 15, 2017 @03:08PM (#15934634)

> WRT some defences becoming outdated by time, well, it probably would not be two-decades behind, but a couple years or so at most. Even then, ensuring that is better then nothing.

Not necessarily. What if the law mandates use of, say, an encryption algorithm that has been cracked? You can't move to a new one without breaking the law.

[ Parent | on HN ]