Or, you know, simply fine companies that have data breaches. They will figure out how to secure their systems on their own if sufficiently motivated. No need for heavy handed bureaucracy and red tape.

Or they will pay the hackers and try to keep the breach a secret...

that's against the GDPR.

My preference here would be for civil actions for damages rather than fines paid to bureaucrats.

I have no idea why this got downvoted.

I think that would hurt startups much more. It will require that the degrees are accredited, which is a lot of work for both the institution that provides certification and for people applying

Secondly, a large percentage of developers do not have a CS degree. There's also a significant number of educations that are not specified as a CS degree, but still teach people skills with the aim of them entering the workforce to work as developers

It's also unclear how domains where software is developed as a tool, but isn't a primary focus (i.e. bioinformatics)

> EU already lacks big tech compared to US, China and Russia

US has next to zero privacy protections, and unlimited investor money with zero expectations for a company to ever turn profitable. E.g. all of YCombinator's "top companies" lose hundreds of millions and billions dollars a year.

China and Russia have cheap labor and yes, zero privacy.

Edit: the same people who clamor for Russia and China-style big companies will immediately shout for government to step in if any company ever gets to the size and influence of Yandex or AliBaba.

I love privacy, but the majority of people in the world seem not to understand it's importance.

No, there are no "zero expectations for a company to ever turn profitable". If you ever tried to get investor money you'll know how hard is to prove to them you have a good path to profitability. Even if all of YCombinat companies except one lose hundreds of millions, the last one can turn into a Facebook, worth hundreds of billions.

dmitriid, you seem to not understand the simple fact that if one of a hundred startups an investor financed turns into a big success he can make big profits overall, despite 99% of the companies lost him money.

That literally means "no expectation of profitability". Also: https://news.ycombinator.com/item?id=35012114

sure, no expectation of profitability on a single investment, expectation of profitability by distributing investments over a large amount of companies.

> No, there are no "zero expectations for a company to ever turn profitable". If you ever tried to get investor money you'll know how hard is to prove to them you have a good path to profitability.

And yet, YCombinator's top companies lose billions for years and keep getting the money. What's the "proven path to profitability"? The flimsy belief that "just wait a bit and we'll have a next Facebook?"

Most of the companies that get mentioned as "big innovative companies" in HN threads have been around for 5+ or even 10+ years, lost incalculable amounts of money, never turned a profit, and we're led to believe that there's an expectation to turn a profit in any of these scenarios.

> US has next to zero privacy protections

One in five US citizens is protected by a regulation that looks an awful lot like GDPR. And if history is any guide, it won't be long before that number gets a lot closer to 100%.

You mean California. And California laws do not apply to companies located in, say, Delaware.

EU laws apply to all member states and even entities just dealing with EU members (which is why Privacy Shield is dead again, USA lied).

> You mean California. And Californiaaws do not apply to companies located in, say, Delaware.

They do, in fact, when it does business in California. (Also, California is less than 1/5 of the country, so the reference is not just to California law.)

The problem here is that having remote customers does not count as "doing business in". So it only applies to brick and mortar located in Cali.

Otherwise it's illegal as due to fun laws only FED can regulate interstate commerce.

> The problem here is that having remote customers does not count as "doing business in". So it only applies to brick and mortar located in California

Physical presence is not a requirement for commerce clause nexus (though it definitely satisfies it.) I’m not sure it ever was viewed as a requirement outside of sales taxes, and the precedent establishing it as a requirement for sales taxes was overturned by the Supreme Court in South Dakota v. Wayfair (2018).

> Otherwise it's illegal as due to fun laws only FED can regulate interstate commerce.

The “fun law” is the Constitution's Commerce Clause, and that’s not actually how it works.

it is a nightmare for us big companies to be compliant exactly because we have millions of lines of code that we now are expected to clean up, or remove decades of security debt.

from where I sit being a start-up, or SME that can make quick decisions and consolidate their security debt is a lot easier on them and worse for us big guys.

I don't want to use a phrase as "level the playing field" but the upcoming expectations of RED and CRA means most of us are praying this isn't enforced as quickly as it is written into law.

I'm totally rooting for this because its the only thing that will improve security.

All the extra red tape and auditing doesn't come for free, so startups and SMEs without huge amounts of cash somehow lying around will struggle.

Also, nothing about compliance is actually about "consolidating security debt" or "quick decisions". It's about paying someone to go through checklists and, like a reviewer of a scientific paper, find something, anything, no matter how inane, to criticize, before handing you a certification. Any slightly unconventional new idea to improve security in your product will be suffocated beneath the blanket of compliance.

> I'm totally rooting for this because its the only thing that will improve security.

So does the author. Well, they strongly endorse a sensible version without the vague phrases and open-source-killing blanket statements, and without brain-dead sentences like "your product must be un-DDoS-able". I do wonder, though, why you're rooting for legislation that would kill any open source project that might, conceivably, be used in a commercial setting?

it is in fact only US companies that have been screaming loudest against better security baselines in IoT. every on of the EU member companies is welcoming this (along with RED coming in 2024) ... for US companies it presents an additional cost or even barrier of entry because they don't need to implement the same security controls in products sold back in the US.

> regulate that to write software one needs to have a masters degree in CS

It's already hard enough to hire software engineers, how hard would it be after further restricting to only software engineers with a relevant masters? I know I'd be entirely forced out of the field, and would have to undertake a 4 year course (abroad, because here it would be 6 years) to be eligible for employment again, if that happened in my country.

You wish the masters would teach you anything about these new regulations. Universities lag 10 years or more behind the research edge in teaching, if not more...

Well as someone that has had the "joy" of implementing a lot of the ones that exist in the US: SOC*, HIPAA, HITRUST, PCI-DSS, a handful of DoD ones. I think if they seriously taught them in schools it would cause a lot change of majors when students realize what an absolute clown car of regulation they are getting themselves into. Its also probably the most boring subject availible.

Something to keep in mind is that this is about certification of products, not people. This is not a regulation for the profession of Software Developer, but a regulation for software products. The EU knows very well that it needs more people from all backgrounds writing and understanding software, not less.

As it is, I think this is going to be very similar to what is already required for some specific industries like healthcare or finance. Startups that want to operate in these industries already need to go through some certification processes of their products and services. Most startups will probably fall under the "low risk status" category until they are a big enough. If self-assessment is anything similar to what it is already required for things like PCI DSS or GDPR, then most small companies will be fine until they are big enough to care.

And by the way, there is no easy way for the EU to regulate that to write software you need a specific degree.

Computer science is not the same as software development (or "engineering").

Honestly, you should. Europe isn't America. We have free education here. If you leave academia and enter the workforce willingly at a lower level than society offers you for free, should you really get to do the work you refused to train for?