Re: Recent Attacks

[daw () cs berkeley edu (David A. Wagner)]

In article <Pine.GSO.4.10.10002161333580.5110-100000 () www securityfocus com>,
Ryan Russell  <ryan () securityfocus com> wrote:
> It's not (IMO) fair to try to charge for potential lost customers.

Why not?

> There's no way to tell exactly how much business would have been done,
> whether the customers came back later to buy the same item, etc..

Aww, come on.  These money guys are very good at understanding how much
revenue they see on a typical day, what their cash flow looks like, etc.
Why do you think this is so hard?  There will be some margin for error
in any estimate, but this is surely quantifiable with elementary statistics.

Maybe you are reacting to the fact that media reports of damages ($1.2B)
are vastly over-exaggerated.  Sure, of course -- that's how these things
work.  But that doesn't mean we can't get a very good scientific estimate
of the damages -- it just means that the media rewards good copy over
careful science, no big surprise there.