nathas

> Arguably

That's doing a lot of lifting.

I think you could make a 50/50 decision at the CEO level for most decisions, and merely by making a decision faster the org would have better profit outcomes.

It's everything you mention in the second paragraph, and additionally just the ability to turn them off.

Imagine everyone had their routers disabled simultaneously. I don't know if the cell networks could function with the surge in standard traffic that would happen, and then you've effectively plunged all or part of the country into a communication blackout.

I think "turn it off permanently by bricking it" is almost as bad as "leverage for DDoS".

I worked on Bot Mitigation at Amazon, and we once saw a ton of traffic that was heavily distributed amongst consumer devices world-wide, but surprisingly in the US too. We suspected compromised routers that were using the home page as a health check. There was a lot of investigation I did, and the short realization after talking with the network engineers is that the amount of traffic, and distribution of sources, would be impossible to stop. There merely isn't enough bandwidth in the world to stop so many residential device if it hits a specific target. To be clear, this was coming from less than half of active Amazon customers, not everyone in the US.

Anyway, it wasn't routers, but it was a consumer device, and it wasn't nefarious, it was incompetence (in code), as usual.

> Small organization (< 20 people): $10/mo

If you went to 100k/year and still a solo dev, that's just 0.12% of your ARR. The percentages here are meaningless; $10/month should be doable for anyone that wants to run a business, even someone solo.

This probably refers to the fact that Windows XP still has support contracts. Microsoft commonly calls their software EOL and then supports it for 5+ years. I don't think that's a bad thing, but they tend to use it more as a marketing term than a true hard line where security fixes stop going out.

Thanks for the detailed explanation! I think it would be great to drop this (or something like this) in the project README.

Have you looked at FolioHD? It's geared towards photographers and artistic types that want a really nice portfolio website.

Paying an amount that is just-above-market-rate for a domain and not needing to understand how to configure DNS for someone non-technical seems like an absolutely worth-while reseller case.

Hear hear. Everyone arguing against this seems to want the permanent, forever solution. There isn't one. This isn't software - it's reducing harm over time as best we can, and it's a fight that will take approximately the rest of human time.

The argument that we created a bioweapon is like... and? We also have nerve agents and gas and nukes. It's like everyone posting here exists in some other reality where they never talked to another human in a grocery store. We all get along as best we can.

Strong agree. I'll tell you the other reason not cited: it slows down organizations. Doing things right to avoid the (seemingly) small chance at being massively wrong is the inverse of the bet that doing many different things quickly has a small chance at a massive payout.

Let's say I'm an executive and I think there's a 1% chance of a breach that costs me 100x and a 1% chance of a 100x payout on every project.

I have 2 projects that each make $X. Let's say $X is $1000. 1 project will go from $X to $X/100 based on breach, so it's now worth $10. 1 project will go from $X to $X*100. It's now worth $100,000.

I went from making $2000 to $99,990.

This goes back to the argument about fines. They aren't NEARLY severe enough. If I'm an executive at a big company, I may enforce greater security on the "cash cow" projects (e.g. ad revenue and GSuite at Google [but not the Pixel or GCloud], AWS and Retail at Amazon [but not Alexa, Kindle, etc]) but the rest? I need to get ANOTHER cash cow. If my service that's only netting me $1M/year goes to $0, and I needed a service that would make $1B, I literally do not care.

If adding in-depth security to the $1M/year project makes delivery 2x slower, I've now spent 2x on something that probably wasn't even worth it. This is a game of stats; businesses and features as cattle not pets. I'd rather have 2 projects and another dice roll than 1 project that's just "meh".

That's not how I operate, but if you're playing this game as an executive, that's the most logical outcome.

Now I want to read an article about the economics of selling game hacks. I just assumed they weren't really worth the investment to build since the number of people that want to cheat seems low.

After typing that I realize this is like coming to understand just how many people are on steroids to get a physique they want. It's like nah no one takes steroids except EVERY HUGE PERSON you've ever seen, barring the extremely rare genetic outliers.

Fascinating.