Comment by przmk

5 days ago

Because it’s mostly about checking compliance boxes than really caring about security.

Corporation are not able to "care". It's the boxes's fault. That is, legislation and/or enforcement.

  • By that logic governments are not able to "care" either.

    But both are examples of cybernetic entities, if they don't care then their control loops aren't correctly aligned.

  • Lmao, it's never legislation and/or enforcement. It's the checkboxes that their insurances told them they had to check or they wouldn't be covered. Half of the problem goes back to insurances being thieves who would do anything to not pay up, the other half goes to upper management not giving a shit about people.

    • Yep. I used to work for an FQHC, and the only thing that improved our network security was the insurance premiums we'd incur without proving compliance. Ofc course, HIPAA is a thing, but that was simply the baseline.

  • Its not like govt agencies care about security either. Its just "compliance" bs. Most european eID stuff works like that.