Vote with your feet or prepare for your eventual breach notification and data loss event. You control who you choose to do business with, and who custodians and processes your data, it is a choice. Make good choices.
The problem is, ultimately, most companies have this mindset. Certainly the ones you've heard of do.
Charlie Munger once said, "Show me the incentives, and I'll show you the outcomes." There are very, very, very few actual incentives to operate a real infosec effort at most companies. Think about it: how many companies have you heard of going out-of-business because of breaches? If you're like most Americans, you've probably received at least one letter from some company you did business with telling you that their systems were compromised and your data may or may not have been stolen as a result. They'll usually close out the letter with an offer of free credit monitoring for some finite length of time. Since that's useless and a lawsuit is a pain in the ass with no guarantee of benefit, the vast majority of people simply sigh and toss the letter in the trash.
There's no real way to pin identity theft or other consequences on a given data breach, so it's hard to make any sort of claim that way.
At the end of the day, the company has saved money by not instituting best InfoSec practices and red-teaming their software on a routine basis. There are no civil or criminal penalties for them not doing so.
Which is why the recent movements for cybersecurity liabilities are so relevant, they are the incentives.
Now in some countries those with data security office role have more to worry about than only losing their job, if they sign off on something that isn't qualified to be out there in first place.
I've been doing a bit of research, and mailbox.org looks like a winner. It's in Europe and it supports IMAP. Those are pretty much my main requirements, I think.
Moving faster is good. But only if it means sending more agents (and humans, that part is important) to do the same amount of testing in less time. Dropping critical work is not that.
I want my encrypted email company to move slow, deliberately, and very carefully.
I'd like most software in general to move slower. Some, I'd like to not move at all. I hate churn for churn's sake, or piling useless features just so you pretend you did something to justify your subscription pricing, both of which were already the norm before AI and are worse now.
To speak in Apple terms, we don't miss more and faster crap novelties. We miss the Snow Leopard releases.
No, not necessarily. Sometimes, yes. For anything important, the last thing I want is a company that's moving too fast.
An email company? The base protocol RFC was written in the 70s. It's as mature as computer technology gets. There is zero value in moving fast here, all the value is in building an absolutely rock solid and secure solution.
> That's the sort of thing you really don't want to hear from your encrypted mail company.
Tone deaf award of the decade surely goes to that guy.
If it were some social game app or something, I guess it wouldn't be as tragic, but for a company whose sole reason to exist is to provide security... wow. Goodbye any trust ever again.
Vote with your feet or prepare for your eventual breach notification and data loss event. You control who you choose to do business with, and who custodians and processes your data, it is a choice. Make good choices.
The problem is, ultimately, most companies have this mindset. Certainly the ones you've heard of do.
Charlie Munger once said, "Show me the incentives, and I'll show you the outcomes." There are very, very, very few actual incentives to operate a real infosec effort at most companies. Think about it: how many companies have you heard of going out-of-business because of breaches? If you're like most Americans, you've probably received at least one letter from some company you did business with telling you that their systems were compromised and your data may or may not have been stolen as a result. They'll usually close out the letter with an offer of free credit monitoring for some finite length of time. Since that's useless and a lawsuit is a pain in the ass with no guarantee of benefit, the vast majority of people simply sigh and toss the letter in the trash.
There's no real way to pin identity theft or other consequences on a given data breach, so it's hard to make any sort of claim that way.
At the end of the day, the company has saved money by not instituting best InfoSec practices and red-teaming their software on a routine basis. There are no civil or criminal penalties for them not doing so.
So they don't.
Which is why the recent movements for cybersecurity liabilities are so relevant, they are the incentives.
Now in some countries those with data security office role have more to worry about than only losing their job, if they sign off on something that isn't qualified to be out there in first place.
https://germancomplianceinstitute.com/blogs/news/personal-li...
I can imagine people are quickly looking for an alternative now. I wouldn't want to hear this from any company I'm a customer of.
FWIW, Fastmail is awesome.
I've been doing a bit of research, and mailbox.org looks like a winner. It's in Europe and it supports IMAP. Those are pretty much my main requirements, I think.
Do they have a free tier?
Moving faster is good. But only if it means sending more agents (and humans, that part is important) to do the same amount of testing in less time. Dropping critical work is not that.
> Moving faster is good.
Says who? For what purpose? To whose benefit?
I want my encrypted email company to move slow, deliberately, and very carefully.
I'd like most software in general to move slower. Some, I'd like to not move at all. I hate churn for churn's sake, or piling useless features just so you pretend you did something to justify your subscription pricing, both of which were already the norm before AI and are worse now.
To speak in Apple terms, we don't miss more and faster crap novelties. We miss the Snow Leopard releases.
> Moving faster is good.
No, not necessarily. Sometimes, yes. For anything important, the last thing I want is a company that's moving too fast.
An email company? The base protocol RFC was written in the 70s. It's as mature as computer technology gets. There is zero value in moving fast here, all the value is in building an absolutely rock solid and secure solution.
The very opposite of move fast and break things.
Oblig. Simpsons:
Homer: “There’s three ways to do things. The right way, the wrong way, and the Max Power way!
Lisa: "Isn’t that also the wrong way?"
Homer: "Yeah, but... faster.”
Why is moving faster good? I don’t see much benefit to it, unless I am a shareholder.
Even if you're a shareholder, the long term gains of an investment are much higher than the short term ones.
The trouble is that executives are bonused on much shorter time scales, and they run the company.
> That's the sort of thing you really don't want to hear from your encrypted mail company.
Tone deaf award of the decade surely goes to that guy.
If it were some social game app or something, I guess it wouldn't be as tragic, but for a company whose sole reason to exist is to provide security... wow. Goodbye any trust ever again.