[TangoTrotFox]

As one aside on this, the main issue people have with regulations is not regulations in and of themselves, but the negative effect they have on small businesses and competition/entrepreneurship more generally. I think you'd find extremely few genuine voices against regulations that only start to apply once a company (and all associated entities) grosses in excess of e.g. $100 million annual revenue. By that point companies the costs (as a fraction of their total revenue) in ensuring compliance, and complying itself is only going to be a minuscule fraction of revenue. By contrast these same costs can, and do, destroy or simply prevent the formation of smaller companies that could greatly expand the market to the benefit of all.

[bredren]

Seems straight forward to write that compliance to certain measures is based on gaap annual revenue.

Though in practice, enforcement of regulations in general is already handled this way.

For example a new startup in the valley doesn’t get a note from the gov because they launched without a privacy policy.

Same in the App Store, a minor app breaking App Store rules doesn’t get knocked out because the downloads are too small to bother.

[fhbdukfrh]

So basically regulation that impacts them directly or materially?

The ideal of some arbitrary cut off point has been tried in lots of scenarios, and is gamed by all parties.

Example: Copyright will protect new works for x years, at which point Disney lobbies for the arbitrary goal posts to be moved.

[TangoTrotFox]

Exactly. Large companies love regulations when they affect everybody since they can easily abide the regulations while they help to destroy potential competitors.

Keeping regulations focused on big players serves the dual purpose of focusing regulation where its affect will be most significant, while also ensuring it doesn't negatively affect the market. But yeah, like you're mentioning the big problem is that once companies reach a certain size they begin to develop the political connections necessary for them to simply kill, or at least castrate, any potential regulation that might genuinely require them to behave in a way that is inconvenient - even if it's better for society.

[Apocryphon]

Libertarian hackers always think of regulations as pesky pinpricks from the nanny state but in this case, in their domain of software, regulations would actually serve more of something along the lines of industry standards to ensure that software is created up to code. Hackers want good code, don't they?

[TangoTrotFox]

I don't understand why people have to otherize each other. No, again opposition to regulations has nothing to do with some ambiguous opposition to nanny stating in and of itself. That is tangential to the real issue. Before getting to that, let's take a really quick digression.

Tax payer funded systems are one of the most controversial things we have. You'll find sharp disagreement on topics like e.g. public vs private funding for everything from education to medical and a wide array of other issues. Yet you'll find most of nobody that wants to privatize e.g. the fire department. This is because most of everybody would agree that the fire department does a good job, does it efficiently, and does it cheaply.

The point of this is that if there were a regulatory framework that was unambiguously and intrinsically superior to any alternative you'd find next to no opposition to it. Everybody wants the same thing in the end -- we just disagree on what's more likely to get you there. In many ways, I think lemonade stands are just a timeless and perfect example. In many states in the US today it is literally illegal, or at least unlawful, for a kid to go sell lemonade in their front yard. They can [and have] faced ticketing, confiscation, and so on. This is clearly idiotic by any standard, yet the very rules and regulations the produced this were all at some point created with good intentions. Perhaps ensuring food safety, or avoiding money laundering, or whatever other rule they happen to be breaking by selling a cup of lemonade for a quarter.

A rule that would generally stand to impose substantial penalties for writing bad code is something that would have unimaginably vast consequences at the lower level. And I think you're looking more at destroying small business in the tech industry than in suddenly having a world where all code is "good". By contrast the companies at the top can afford to greatly expand their staff and create factory lines of code review, extensive internal penetration testing, general audits, and so on. And perhaps most importantly, when they do end up violating the rule they have the resources to manage this just fine. And so it's very possible that the regulation could have an overall net positive effect there. But if it were applied to society as a whole (instead of just large companies), I think you'd be effectively killing off tech industry competition.