Hacker News Reader

Comment by simonra | Hacker News Reader

Sure, but at what cost? How quickly improvements are delivered is one thing, but the materials and chosen process also come at a premium. And while it probably is worth it in aviation due to life and health being highly irreplaceable, the value of for instance my chat history or photos is certainly finite and quite low. Should they be corrupted, leaked, or worst case gone, it would somewhat suck. But at the same time I've effectively concluded that safeguards are worth about 0.4% of my monthly take home after tax, and when the yearly bill comes due I'm each time increasingly questioning whether I actually do value them even that highly.

View on HN

"Sure, but at what cost?"

At the appropriate and necessary cost.

A less costly new engine design or less costly engine swap procedure that fails is worse than no airplane at all. If it's cheaper and fails, we don't want it. It wasn't cheaper, it was even worse than expensive.

It's not hyperbolic all or nothing. Sure infinite cost is just as useless as infinite failure, but there is no reason to talk about infinite.

At what cost? Some. At some cost.

> At what cost? Some. At some cost.

This doesn't address how the cost of safety related procedures versus the cost of risks mitigated is calculated (which is way harder than saying "some") so that the buyer can actually know what "some" cost is.

It's also not addressing the parent comment's point: the bad outcomes in aviation tend to be very impactful (both in human safety and financially), so the tolerance for mistakes is way lower.

Compared to cybersecurity for a brochureware website, where it takes a far larger stretch to go from "security incident" to "someone's dead". (Also, people in cybersecurity aren't going to accept "it has some cost, and you might buy it if it's not too expensive".)

For the commercial flight industry this is very easy to calculate: zero deaths are acceptable. This is not like car manufacturer recall calculations (famously, referenced in Fight Club: if the lawsuit costs the manufacturer less than the recall, they don't recall). The airline industry is built different thanks to heavy regulation.

You could ask: is it _worth_ making it that safe? But we don't ask that. We just make it that safe.

I think there is a good point to be made that this level of safety (it costs what it costs) is probably not worth it for cybersecurity, in general, even if it's largely considered worth it for commercial aviation.

Zero acceptable deaths is equivalent to zero acceptable breaches -- the only solution is to offline the system entirely. You simply can not get rid of all risk or even know if you've gotten rid of all risk.

https://assets.performance.gov/APG/files/2023/june/FY2023_Ju... states on page 5 that they're aiming to cut fatalities in half from 8.9 per 100M passengers in FY 2009 to 4.4 fatalities per 100M passengers in FY 2025. (It looks like they were doing way better than that goal.) "As low as reasonably practical" (ALARP) seems to be the term for aviation, which is very clearly not a zero fatalities goal.

> You could ask: is it _worth_ making it that safe? But we don't ask that. We just make it that safe.

They... Don't? Aviation accidents continue to happen and they will continue to happen. They've decided that a positive number of fatalities is worth it not because they want anyone to die, but because they know that perfection is impossible. You can't achieve it, and you can't know that you've achieved it.

As software intermediates more and more of the physical world, we're gonna end up at least as regulated as finance, and potentially as much as aviation.

The only real question is how much damage will be caused before that happens.

I think it's highly doubtful we're going to see software generally regulated as finance, which like aviation can facilitate damage to individuals on a scale they'll never be able to recover from by themselves (in terms of lifetime needed to (re)acquire the resources). Most of the world is quite insignificant and unimpactful, and already regulated as tightly as it is based on that. Software being a larger part of the services provided or goods transacted is not suddenly going to inspire tighter regulation of the quality of services and goods offered beyond what they already are, like for instance some minimums around certain things not catching fire and killing people, or some services being rendered in a mostly food safe way. If humanity desired to go beyond lazy minimums we'd see universal effective elimination of planned obsolescence, not just best cases of minimum warranty periods measured in a handful of years, and then being fine with products mysteriously failing within days of the sellers support obligations ending.

> I think it's highly doubtful we're going to see software generally regulated as finance,

Probably not all of software, but basically all of our financial infrastructure, operational infrastructure and communications infrastructure is either already critically dependent on software, or heading that way.

I think that the EU's DORA act is probably the way things will head. We'll regulate the outcomes and ensure that these services can be maintained.

Honestly, the only reason that this hasn't already happened is that the US government is wildly against basically all regulation of software. I figure that if we end up in some kind of cybersecurity crash (likely, given the current trajectory) that we'll get lots and lots of regulation.

And to be honest, this will be for the better in the long term, but it'll probably suck for all of us in the short term (but at least there'll be jobs).

We also need some way for a regular person to recognize cheap vs quality software on sight the way they can for a frying pan.

It's fine for cheap pans to exist because any user of one can see what it is and make an informed choice to use the junk one or the good one.

Reply on news.ycombinator.com