Ross Anderson has good work looking at security as
a lemon market. Since you can not detect quality, you
buy the cheapest. Since no one buys more expensive
quality, only garbage is left.

Some of my students wanted to make a futures market
to counter this.

Sent from my Huawei Mobile


-------- Original Message --------
Subject: Re: [liberationtech] An ‘Off-the-Shelf, Skeleton Project’: Experts Analyze the App That Broke Iowa
From: Don Marti
To: Thomas Delrue
CC: LT

begin Thomas Delrue quotation of Sat, Feb 08, 2020 at 04:26:50PM -0500:

> Let's also not forget about the systemic issues that lead to the
> symptoms as described in the article. The problem is not the symptoms,
> the problem is why those symptoms are there in the first place...
>
> I don't remember where I found this, but this is very apt (and while I
> do not condone all viewpoints in this blurb, the gist of it, I think is
> accurate):

This is an interesting example of a market failure.

Developers would prefer to release software at a high
quality level. Users prefer to use software at a
high quality level. However, firms are incentivized
to release software at a lower quality level than
would be chosen by either developers or users.

How do you design a system that lets users quantify
and hedge the risks of low-quality software, while
compensating developers to do the extra work to bring
the software up to a higher quality level?

(I don't think this is a question of credentialism
or gatekeeping...if I needed a responsive, reliable
CRUD app I'd trust a code bootcamp graduate working
in a good QA and culture environment over someone
with the right piece of paper on their wall.)

A variety of systems have been proposed, including
subscriptions, bounties, and dominant assurance
contracts. Here's a paper (I'm a co-author) on another
possibility: futures contracts on bugs/tasks.

https://academic.oup.com/cybersecurity/article/5/1/tyz011/5580665

(A market based on this research is set to launch
around the begining of March. Anyone interested in
participating, please let me know.)

--
Don Marti
https://blog.zgp.org/
Are you safe from 3rd-party web tracking? https://www.aloodo.org/test/

--
Liberationtech is public & archives are searchable from any major commercial search engine. Violations of list guidelines will get you moderated: https://lists.ghserv.net/mailman/listinfo/lt. Unsubscribe, change to digest mode, or change password by emailing [email protected].
-- 
Liberationtech is public & archives are searchable from any major commercial 
search engine. Violations of list guidelines will get you moderated: 
https://lists.ghserv.net/mailman/listinfo/lt. Unsubscribe, change to digest 
mode, or change password by emailing [email protected].

Reply via email to