Because it’s mostly about checking compliance boxes than really caring about security.
replyCorporation are not able to "care". It's the boxes's fault. That is, legislation and/or enforcement.
replyBy that logic governments are not able to "care" either.
replyBut both are examples of cybernetic entities, if they don't care then their control loops aren't correctly aligned.
This meme again? Corporations are not capable of anything, but corporations are made of people, and people can care.
replyCall me cynical, but I would rather rely on written regulations and systems of checks than human altruism.
replyTrue. Those who only care about meeting regulatory requirements are not going to care if the regulatory requirements cease to exist. Those who care about security may be dismissive of regulatory requirements, but they will do so primarily when they are insufficient or when they conflict with their opinion. In the former case, they probably have the ability to go beyond the regulatory requirements. In the latter case: while I won't claim that regulations are perfect, I would trust them over the an anonymous person who may be going on anything from their personal opinion to legitimate research.
replyCurrently, besides if you use cryptocurrencies, I don't think you can rely solely on "written regulations and systems of checks", somewhere along those processes there are a bunch of humans with their altruism (or lack of), taste and daily life moving those processes along. And judging by the state of the cryptocurrency ecosystem, this is probably a good thing more than a bad thing.
replyWe need a graph of empathy vs number of people in organization
replyLmao, it's never legislation and/or enforcement. It's the checkboxes that their insurances told them they had to check or they wouldn't be covered. Half of the problem goes back to insurances being thieves who would do anything to not pay up, the other half goes to upper management not giving a shit about people.
replyYep. I used to work for an FQHC, and the only thing that improved our network security was the insurance premiums we'd incur without proving compliance. Ofc course, HIPAA is a thing, but that was simply the baseline.
replyIts not like govt agencies care about security either. Its just "compliance" bs. Most european eID stuff works like that.
reply