breached

The assumption is made that if you got breached, you must not have known what you were doing, and that's bullshit.

The idea that getting breached means you're incompetent is toxic and needs to stop; it just means that you're a sufficiently high-value target.

However, being breached does not mean that you did not take action.

Because you've been assuming that the database will be breached and that no other kind of attack can happen.

Maybe the company who was breached should also be in court, but that's a different matter entirely.

Even if you don't get breached, one of the unethical governments you sell to will get breached or have some sort of leak, and your relationship with them will be uncovered.

They get breached all the time in various ways while trying to hide it or obscure what exactly happened.

It is better to simply assume that all data has been breached unless incontrovertible proof is found to the contrary.

It's very possible (and quite likely) that many of those breached expended extensive efforts in defense.

Is it really the customer's responsibility to technically guarantee that the licensing cannot be breached?

So, apps on them will both get breached due to inherently broken architecture and can be isolated through microkernel architecture with interface protections, too.

I do emergency incident response for companies that get breached, and this is off the mark.

My tired point is that for many companies, they make a distinction between "them" getting breached vs their customers' data getting breached.

> “We take security seriously”, otherwise known as “We didn’t take it seriously enough” This implies that if only the companies that got breached had taken security more seriously, they wouldn't have gotten breached.

They breached their own covenant, which doesn't afford them the benefit of the doubt you might assign to 'knowledgeable researchers doing serious work': "We won't do anything life threatening." Then they did precisely that: they disabled the transmission on an uphill freeway ramp with no shoulder, with a very large truck bearing down on the Jeep.

It is entirely standard operating procedure in the startup industry to play fast and loose with customer data, ignore best practices, get breached, make a blog post about how "we take security seriously", fix one or two things, and continue like nothing happened.