Carl Fredrik Samson

SawStop is an interesting analogy for cybersecurity regulation. I once shoved my finger into a router (woodworking device that rounds edges). Luckily, the cutting edge hit the bone and kicked the finger back out, so I had only two deep cuts down to the bone without it having removed the tip of my finger. So I can understand the following video showing sawblades are unsafe at any speed. There is no way to "safely" use them. Accidents can always happen faster than your reaction speed. The following video shows SawStop in action: it's faster than human reaction time, instantly stopping the blade and saving the finger. This destroys the blade (and the SawStop module, but not the rest of the saw) in the process, but the blade does stop instantly. The current controversy is that government wants to make the technology mandatory. Stupid people want it mandatory because it'll save fingers. But this is something the market can figure out (people can judge risk-vs-reward for themselves). But smart people recognize that if you force the tech on all products, the tech becomes cheaper. In other words, people might not be willing to spend $500 extra for a saw, which is the price when only a few saws have it. But when all saws have it, mass production and competition means it'll only be $100 extra, and a lot more people will want it. We have the same dumb/smart issues in cybersecurity policy. Dumb people want government to mandate things because they think it'll make things even more secure -- even though customers don't want it. Smart people argue that that making things ubiquitous lowers the price: that while most customers aren't willing to pay for the high-priced security options, mass adoption will make the price low enough that most all customers would want to pay for it. This is especially true for things that have no marginal cost. In other words, while it's expense now, if adapted by everything, the marginal cost would be near $0. A good example is ASLR for IoT devices, ASLR is a trivial technique that automatically blocks many bugs from being exploited by hackers. It's as simple as turning on a switch when building software, but rarely it can cause problems in the build process. In the IoT market, it's often turned off, because many stages in the supply chain just don't want to be bothered with the small nuisances they'd have to fix. If government mandated it, then the supply chain would fix the nuisances, and then everything would have this protection for essentially no marginal cost. On the other hand, most of the policy proposals from dumb people have huge marginal costs. For example, one of the biggest proposals is that IoT devices need to be shipped without vulnerabilities and that their makers be responsible for providing regularly patches for when vulnerabilities are discovered. It's an impractical policy. While many IoT vendors enable ASLR, nobody does the other thing, because the marginal cost is too high. All such a law does is remove smaller, innovative IoT devices from the market. It's like how power supplies are separate devices. The cost of meeting government requirements is so high it's just easier for a company to buy a power supply from a third party than build their own. That's why Apple's "MacMini" has a built in power supply (they are a large company that can afford this regulatory expense), while competing x86/Windows mini-PCs have an external power supply. I'm just riffing here. I love SawStop and would never get near a circular saw without it. As a developer, I know there are a ton of things that trivially make software safer with no marginal cost. But I generally oppose the bulk of cybersecurity government policy, which is stupidly misguided.