[uuoc]

> First, no one gives a crap about security until something like this happens to them. The incentives are not in place to require it. Time and resources spent on security are time and resources not spent on beating the competitor.

Exactly. I'm reminded about the tale about the two hikers and the bear. Two hikers are out hiking one day, when off in the distance they see a bear running their way to attack them. One starts to run, but the other stops to change his hiking boots to running shoes. The other says: "What are you doing? You can't outrun a bear!". To which the running shoe changer replies: "I don't have to outrun the bear, I just have to outrun you".

Same goes here. Don't have to really spend on security, just enough to not actually be the one of the two (or three or four) who suffer a breach.