<div dir="ltr">Being in Vendor land right now, I'll keep my comments brief, because they are just that my comments from just me.<div><br></div><div>On the subject of regulation however, I just want to be clear. I was, and to an extend, still am in the camp of 'regulation'. I know that the <span style="font-size:12.8px">Wassenaar</span> arrangement was far from what I had in mind. The proposed legislation was rather sickening. When I think of maturity in our field, or even just playing in the big leagues, I try and think of what other professions look like. </div><div><br></div><div>Just for a moment, suspend belief and think about the basic mechanism of getting from onto our tables. For us Americans on the list, lets just consider the FDA. Consumers want to have confidence in the product that they are buying. They want to know that the Blue Bell Ice Cream they are consuming is going to be maybe not as good as Cherry Garcia(<a href="http://www.benjerry.com/flavors/cherry-garcia-ice-cream">http://www.benjerry.com/flavors/cherry-garcia-ice-cream</a>), but still edible, one would hope: </div><div><br></div><div><a href="http://www.fda.gov/Food/RecallsOutbreaksEmergencies/Outbreaks/ucm438104.htm">http://www.fda.gov/Food/RecallsOutbreaksEmergencies/Outbreaks/ucm438104.htm</a></div><div><br></div><div>Interesting story found here: (<a href="http://www.marketplace.org/topics/health-care/who-pays-new-fda-food-safety-rules">http://www.marketplace.org/topics/health-care/who-pays-new-fda-food-safety-rules</a>) which claims:</div><div><br></div><div> "Federal officials put the cost of compliance at about $380 million for an industry that generates about $1.1 trillion in retail food sales."<br></div><div><br></div><div>Confidence breeds markets to grow in a sustainable way, or at a minimum just grow. But of course, Wassenar-like regulatory changes, could always happen in the Food industry, even if all we want is to be not poisoned, and for things like this you have associations. This is where our industry, probably lacks a bit of guidance, but stroll through any state capital and you will see these types of association buildings: (<a href="http://www.ffva.com/">http://www.ffva.com/</a>).</div><div><br></div><div>Even though we can understand why this would be important in the age of say, Wassanar, what does this have to do with vendors and their attempts to shutdown research? I think what we need to understand as an industry is that just like the car manufacturers from time to time will take an actuarial approach to safety and try and avoid correcting issues, we may find the same in our lines of work. Safety, maybe even, regulatory style safety, will eventually happen. It's just the way we have to mature. We probably will not see if some time until there is a sudden event that forces is, because our trajectory of growing the software segments and our industry will really slow. </div><div><br></div><div>But then again, confidence breeds growth in markets, so who is going to buy the car with the lowest safety rating? And who will buy the food that will poison them the most?[1]</div><div><br></div><div><br></div><div>[1] we do. (<a href="http://www.nbcnews.com/id/11992264/ns/health-fitness/t/should-you-defrost-your-diet/">http://www.nbcnews.com/id/11992264/ns/health-fitness/t/should-you-defrost-your-diet/</a>)</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Sep 11, 2015 at 9:27 AM, Dave Aitel <span dir="ltr"><<a href="mailto:dave@immunityinc.com" target="_blank">dave@immunityinc.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The real question in security is always how to play Poker against an<br>
opponent who can see all your cards.<br>
<br>
<a href="http://www.forbes.com/sites/thomasbrewster/2015/09/10/fireeye-slammed-over-injunction/" rel="noreferrer" target="_blank">http://www.forbes.com/sites/thomasbrewster/2015/09/10/fireeye-slammed-over-injunction/</a><br>
<a href="https://lists.immunityinc.com/pipermail/dailydave/2013-March/000353.html" rel="noreferrer" target="_blank">https://lists.immunityinc.com/pipermail/dailydave/2013-March/000353.html</a><br>
<br>
In a way our "IP" laws have confused a lot of us about security. What if<br>
NOBODY TALKED ABOUT OUR WEAKNESSES BECAUSE IT WAS ILLEGAL, the<br>
management teams say. This, of course, directly relates to the<br>
"regulation is GOING to happen" Wassenaar crowd because it's the exact<br>
same fundamental psychology at work. "We're going to regulate away the<br>
threat" is as useless as saying "hackers won't buy our boxes to find out<br>
how to bypass our defenses".<br>
<span class="HOEnZb"><font color="#888888"><br>
-dave<br>
<br>
<br>
</font></span><br>_______________________________________________<br>
Dailydave mailing list<br>
<a href="mailto:Dailydave@lists.immunityinc.com">Dailydave@lists.immunityinc.com</a><br>
<a href="https://lists.immunityinc.com/mailman/listinfo/dailydave" rel="noreferrer" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a><br>
<br></blockquote></div><br></div>