Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
I love Mickens&#x27; work, and think this is overall a great presentation, but I feel like it misses (or maybe just doesn&#x27;t fully explore) an important point.<p>Start with the Internet of Things example. He chalks up the abysmal security record of IoT devices to two factors: it keeps IoT devices cheap, and IoT vendors don&#x27;t understand history. And there&#x27;s a lot of truth in both these assertions! But they are both just expressing facets of a deeper, more fundamental reason: IoT devices aren&#x27;t secure because <i>their customers don&#x27;t demand security.</i><p>This deeper problem completely explains why the two higher-level problems he observes exist. Making your product secure makes it more expensive and slower to come to market than just leaving it wide open, and the IoT vendors know their customers care about cost and availability and don&#x27;t care about security. So they do the rational (in the <i>homo economicus</i> sense of the term) thing and optimize for things their customers are actually willing to pay for.<p>The same causality can be observed in the ML world. Mickens asks why people are hooking ML systems whose operation isn&#x27;t fully understood to important things like financial decisionmaking and criminal justice systems. The answer is that <i>the customers demand it.</i> ML is trendy and buzzworthy, so if you&#x27;re a vendor of (say) financial systems, and you can find some way to incorporate ML into your offerings with a straight face, now you have an attractive new checkbox on the feature list your salespeople dangle in front of potential customers. And once the effectiveness of having that box checked becomes clear, you kind of <i>have</i> to do it, even if you know it&#x27;ll be ineffective or even worse, or risk losing business to a competitor with fewer scruples.<p>All of which is to say that what we see playing out in both these scenarios isn&#x27;t really the vendors&#x27; fault. They are instead classic examples of market failure. People end up buying shoddy products because spotting their shoddiness requires technical expertise they don&#x27;t have; responsible vendors who try not to make shoddy products lose sales to irresponsible vendors who don&#x27;t; eventually all the responsible vendors are out of business and the only products available to buy are shoddy ones. There are lessons to learn from this, but they&#x27;re economic rather than technological.