The Effectiveness of Publicly Shaming Bad Security
Troy&#x27;s stance makes me uneasy.  I&#x27;m sure publicly shaming these companies is effective, but where does the line get drawn?  In my experience the infosec community strongly believes security is the <i>most</i> important thing, full stop. So they feel no qualms about using every trick in the book to get their way.<p>But two things about this trouble me.  The first is, have we decided that the ends always justify the means?  It seems in other domains public shaming is unacceptable. Troy himself despises Donald Trump, but one of the things most heinous about 45 is his use of Twitter to publicly ridicule and shame companies and individuals.  And now Troy is engaging in exactly the same behavior.  But it&#x27;s &quot;OK&quot; this time?  What is different?<p>The second thing that troubles me is security &quot;best practices&quot; today may not be best practices tomorrow.  Some of his example companies are using practices that were &quot;best&quot; 10 years ago. What happens in another 10 years when Troy&#x27;s current advice is outdated?  More pitchforks?<p>The security treadmill is hard for even the most modern tech companies to stay on.  I think the infosec community could go a long way to helping itself by making easier to use tools, and writing canonical guides for common scenarios.  Setting up HTTPS to get an &quot;A&quot; from SSLLabs is non-trivial.  Securing SSH with perfect forward secrecy is near impossible for a mortal.  There&#x27;s no reason it has to be this complicated.<p>Edit:  To the people who couldn&#x27;t get past the first sentence of my last paragraph.  I&#x27;m not saying that because the security treadmill is hard the companies get a pass.  I&#x27;m saying the infosec community has a responsibility to make it easier to stay on it.  If the barrier to securing something appropriately was so low you could trip over it, we wouldn&#x27;t have this many problems.