Re:The Insecurity Industry
by user3939382 on Monday July 26, 2021 @07:59PM
(#27967024)
> People do not die if a Tweet doesn't make it through
True, and what you're saying is generally true. But what were the total consequences of the Equifax breach? We can't even quantify it. Snowden himself in the article mentions activists and journalists being killed because of these vulnerabilities. There are definitely counterexamples.
Re:The Insecurity Industry
by iamstupidsimple on Monday July 26, 2021 @09:00PM
(#27967431)
That's true. I suspect part of the problem there is lack of liability and therefore lack of willingness to pay for security. They're just going to lose the best security engineers to Google and Microsoft.
Re:The Insecurity Industry
by d110af5ccf on Monday July 26, 2021 @11:02PM
(#27968180)
That is due to issues with how Equifax operated (and related lack of meaningful consequences). It has nothing to do with a lack of liability for software companies.
The only reason our processes and practices aren't much heavier is because the stakes are lower. People do not die if a Tweet doesn't make it through, but they do if a bridge collapses through.
The threat model is also significantly different. If we go back to the bridge analogy, a company like Microsoft has to deal with tens of thousands of people trying to blow it up or find some weakness every day, while a million people are going over it. Just by sheer laws of scale they are going to have a tougher time, Real Engineering or not.