Hacker News Reader

Comment by ronsor | Hacker News Reader

> many have memory corruption bugs and incorrect anti-tampering code requiring our per-app exploit protection compatibility mode toggle

Ironic for apps that are often so paranoid about "security" and "hardware attestation"

View on HN

Because it’s mostly about checking compliance boxes than really caring about security.

Corporation are not able to "care". It's the boxes's fault. That is, legislation and/or enforcement.

This meme again? Corporations are not capable of anything, but corporations are made of people, and people can care.

We need a graph of empathy vs number of people in organization

Call me cynical, but I would rather rely on written regulations and systems of checks than human altruism.

True. Those who only care about meeting regulatory requirements are not going to care if the regulatory requirements cease to exist. Those who care about security may be dismissive of regulatory requirements, but they will do so primarily when they are insufficient or when they conflict with their opinion. In the former case, they probably have the ability to go beyond the regulatory requirements. In the latter case: while I won't claim that regulations are perfect, I would trust them over the an anonymous person who may be going on anything from their personal opinion to legitimate research.

Currently, besides if you use cryptocurrencies, I don't think you can rely solely on "written regulations and systems of checks", somewhere along those processes there are a bunch of humans with their altruism (or lack of), taste and daily life moving those processes along. And judging by the state of the cryptocurrency ecosystem, this is probably a good thing more than a bad thing.

I feel that corporations are made of people in the same sense that computers are made of transistors...

By that logic governments are not able to "care" either.

But both are examples of cybernetic entities, if they don't care then their control loops aren't correctly aligned.

Its not like govt agencies care about security either. Its just "compliance" bs. Most european eID stuff works like that.

Lmao, it's never legislation and/or enforcement. It's the checkboxes that their insurances told them they had to check or they wouldn't be covered. Half of the problem goes back to insurances being thieves who would do anything to not pay up, the other half goes to upper management not giving a shit about people.

Yep. I used to work for an FQHC, and the only thing that improved our network security was the insurance premiums we'd incur without proving compliance. Ofc course, HIPAA is a thing, but that was simply the baseline.

In my experience, banks are among the worst at following email standards. Why would we expect more sophisticated security protections from them?

Reply on news.ycombinator.com