Security catastrophes are unlikely to be sufficient to make companies take security seriously. After all, the PR damage seems limited (it's hard to blame someone for not understanding something you don't understand yourself), and the damage is often largely to third parties (i.e: customers). The people taking the risks aren't the ones paying the costs. And those paying the costs can't really tell who's taking the risks, nor judge well how it impacts them.
It sort of reminds me of CO2 emmisions - and look how brilliantly that battle is going.
This shorting is much better, actually - it impacts metrics companies actually optimize for, so it may actually affect behavior. Not only that, it allocates money to security research, creating a virtuous circle.
But it's not all roses: it's only going to work as long as there's a stock market impact; and that's eventually dependent on security risks actually affecting the choices buyers make. That is uncertain. Most successful software has almost no competitors; software (well, and IP law) makes it trivial to create lock-in and software is trivial to mass-produce, so underdogs have a terrible time. For example: if you can effectively choose only between iOS and android, then you're likely to make that choice based on just a few of your top priorities (in CS terms: there's at most 1 bit of entropy here). Security may matter, but it's not going to have as much impact as it would in an actual proper market where there's sufficient choice for real competition to emerge.
It sort of reminds me of CO2 emmisions - and look how brilliantly that battle is going.
This shorting is much better, actually - it impacts metrics companies actually optimize for, so it may actually affect behavior. Not only that, it allocates money to security research, creating a virtuous circle.
But it's not all roses: it's only going to work as long as there's a stock market impact; and that's eventually dependent on security risks actually affecting the choices buyers make. That is uncertain. Most successful software has almost no competitors; software (well, and IP law) makes it trivial to create lock-in and software is trivial to mass-produce, so underdogs have a terrible time. For example: if you can effectively choose only between iOS and android, then you're likely to make that choice based on just a few of your top priorities (in CS terms: there's at most 1 bit of entropy here). Security may matter, but it's not going to have as much impact as it would in an actual proper market where there's sufficient choice for real competition to emerge.