Thanks for expanding on this issue, I almost didn't include that line because I thought the idea demanded a more nuanced and lengthy discussion, but I'm glad I got to read and learned from both your inputs about it and especially from those articles linked by clarry. Nevertheless, even if the law is relatively malleable when it comes to a company having certain leeway on its decisions regarding profit-making, it seems the capacity for finding the necessary loopholes to accomplish morally-reprehensible practices still remains a possibility (even if it's only one available to the few). Absolutely shamefur dispray if you ask me.

Customers to the extent there is healthy competition (they tend to suffer under monopolies, especially once a corporation has built a moat around its business).

Employees, to the extent that they have leverage (are needed and hard to replace) or otherwise that strong unions and labor laws protect their rights. In my experience, companies, especially once they become larger, have a tendency to give their employees the minimum they can get away with.

Having worked both as an unskilled worker and a specialist for a lot of companies (at over 20 places now), I speak from a significant amount of personal observation there. I'm well treated right now because I have hard to find skills. The staff at the hospital and city bus drivers are well treated because they work under a strong union in the public sector. Employees at large grocery store chains operating in my area struggle, because they are unskilled worker and their union is weak. Mostly part-time workers earning supplementary income for their better paid spouse or students work there now because a full time employee working there wouldn't earn enough to live on his own, let alone support a family.

True, you can have moral investors, but I think the vast majority are of the "hands off and maximize my returns please" variety. People who directly manage their funds are uncommon and companies that manage people's funds for them tend to have a mandate to get the most bang for the buck (within the specified risk margin).

Fair enough, except in the most extreme cases, they would probably just oust him/her if they felt he/she wasn't acting in a way that maximizes profits (taking the company's image into consideration as part of the profit equation of course).

True, the company can reinvest in itself, though fundamentally, the company tends to do so to maximize investor long term financial returns (either grow or secure the current profit margin if it is under assault from competition or circumstances).

I disagree. You have a security expert here with a lot of experience who clearly illustrates that the profit imperative here go against what would otherwise be a significant sustainable social good.

There are countless other examples, but this is just one I'm familiar with because of my field of work. The software industry is still very much the wild west in terms of security. Getting a product out there fast is usually way more important than making reasonably sure that the product cannot be subverted by ill-intentioned users.

Sure, we have crown corporations here which are stated owned and you can have a 100% private corporation where the will of one or few owners dictate the agenda, but here I'm mostly talking about publicly traded investor-driven corporations.

which off course means that for example most EA or UBI games are indie games, as they are self published.

I wanted to say Valve. The perfect example of true indie company.

Both EA and Ubi are public companies so technically they depend on shareholders.

Being a security expert does not make them an authority on corporate law. On the contrary, I would totally expect most software & security people to completely buy the often parroted myth that corporations are legally bound to maximize shareholder value. I would expect this to slowly change as companies come out of the 70s and start thinking different: https://opportunity.businessroundtable.org/ourcommitment/

Even if he did not believe that myth, I could see him taking the viewpoint of a greedy board member whose bonuses do not depend on doing the right thing (or doing security right) but on making more money. Do you happen to have one example of actual legal text rather than opinion?

It sounds like you're arguing a different point now. You're arguing that companies cut corners because doing everything right costs time and money. I'm 100% with you on that. It's a question of time, resources, and incentives. It's decidedly not a question of "literally bound to do everything in their power to maximize investor revenue." I was specifically talking about publicly traded corporations. Theories made up by economists are not law. The business judgement rule effectively is, but I don't think it really even applies to private or state owned companies.

However the "investor-driven" term is yet another red herring which would lead us to argue about what exactly it means. I would suggest that most publicly traded companies are not driven by investors but I don't know if I have the patience to argue that point too. Well, I'll give a few points:

0) the primary decision an investor makes is whether to invest in a company or not (company is already expected to be on the right growth trajectory or ethical standard by the time the decision to invest is made)

1) investors are in the business of trading, not in the business of running a company. they don't have time and field expertise to be sitting in meetings and making decisions for the company

2) hence, expertise is deferred to the executives (and to their subordinates, recursively)

3) executives have the duty to keep shareholders in the loop, but this is mainly about the big picture and financials; investors want to know how the company is doing so they can make the right trading decisions. these are all public reports and briefs and calls

4) shareholders vote in elections and if shit really hits the fan, they can replace board members.. but these decisions are very far removed from day to day operations and the general way in which the business behaves

There will be no meeting with shareholders where the shareholders decide that let's neglect security and use the saved monies to pay us bigger dividends.

The situation can be a little different for small companies and startups funded by private money, but we weren't talking about those anyway so..

Are Valve, EA or UBI small, financially lacking companies?
Do they depend on some bigger publishing company to get their games published?
No?
Well then their games are not indie games.

Some people...SMH

Edit:
Are they themselves the big publisher behind their games?
Yes?
Could they produce the same games without the financial and technical support that their companies themselves offer?
No?
Well...

so indie games are games made by poor people? if a rich person (who do not lack self-funding) make a game by himself in his basement, that means he did not make an indie game?

Clearly, for me anyway, there are levels of being Indie.

I mean you can take the word Indie and lock onto that as just meaning independent, but for me the independence needs context.

So while cost is certainly a factor for an Indie game, it is also about lack of experience and support. At least that is how I have always seen it. I'd also add number of developers and their experience to the mix, while at the same time suggesting that there is quite a degree of flexibility and some variability.

Take the Double Fine studio for instance, and their record-breaking use of Kickstarter. I would not call them an Indie game developer, though you could posit they are independent ... at least to some degree. They are a largish experienced team.

On another end of the many headed stick, a single developer, even if very experienced, would mostly have to be considered an Indie game developer ... at least to my mind. But then again, that might depend on the level of support they have from the gaming industry and what assistance if any they leverage from other developers & resources etc.

For some folk no doubt, an Indie game developer, would just be some person or company, that isn't one of those from the big end of town, that have been around for years, that most of us are aware of. So not the the likes of MS, Valve, Epic, Sony, Nintendo, Bethesda, Ubisoft, EA, etc etc. That's too simplistic for me, especially as many developers have associations with and have come from those companies.

I think what should define a indie developer is whether most or all the people working on the game jointly own the game. I am not sure how common this is though, like how would someone even know if this was the case most of the time.

To the contrary, I think that outside of management, software people are among the people who are in the best of positions to observe the contradictions between the image corporations project and what it actually prioritizes when pushes comes to shove. As a software developer, I've seen a lot of things.

And as someone who helps manage security for a lot more companies, Bruce has seen even more.

After all, even when they are not selling software themselves, all companies depend on software to manage the minutae of their operations and people developing/operating the software are in a good position to understand the company pretty intimately (the good, the bad and the ugly) in a way that most outside analysts might not be able to.

In the same way that royalty could not hide a whole lot from their servants, you can't hide a whole lot from people who manage your software which is an important reason why they tend to have to sign NDAs.

Working for a lot of software companies have given me significant insight into the plans of various companies I worked for and how they tend to think in general.

Similarly, you can bet that while the community was taken aback over the years by certain choices GOG made, the software developer working on GOG's website and Galaxy knew all along where this was going. Having been in a similar position, I've sometimes wished I could talk to their developers to know where all this was going honestly. They know.

I have a lot of juicy morsels as an insider, yes, but NDAs tie my hands here. Trust me, it's not good.

Otherwise, it's really really hard to defend that publicly traded companies are not primarily profit-driven entities if you follow things. However, giving more specific examples would lead to a more political discussion (ie, it would make certain places and certain companies look bad), so I won't go there here. It's not the right forum for that discussion.

Well, maximizing revenues has two important components: Maximizing the revenues themselves and cutting costs.

So yes, cutting corners is to maximize profits.

Precisely. The investors tend not to be be invested in the minutae of managing the company. The investors tend to be invested in profits (either in the form of growth of dividens).

This in turns push the agenda all the way down from the boad members to executives to lower-level managers that tell the software engineers to cut corner with security (and everybody is watching everybody else to push that agenda forward). Again, I can't give you specifics, but I know, I've had a front row seat to observe some truly horrible decision-making there. The software industry is the wild west right now and I really hope that regulators eventually come down hard on it, but for the most part, that push won't come from software companies.

Its usually most common for the studio to own the game itself.

On the four titles I've worked on I've only provided licence for the assets I've made. Generally though the "work for hire" mentality prevails and studios expect to own things. Granted, if you're being paid well enough, thats not an issue.

Aside from that most studios I know tend to give pretty decent packages alongside pay - even including things like gym memberships and self improvement bursaries (learn a language, a new skill, play an instrument etc). Thats offtopic though I suppose.

At any rate, each studio is a little different in all things.

At this point it sounds like you don't understand the point I am trying to make, so let me spell it once more: "They are literally bound to do everything in their power to maximize investor revenue" is MYTH unless you can point at a LAW or a case that contradicts what I'm saying. Laws and cases are not under NDA. Bruce thinking that as a board member he would prefer profit over security doesn't make it law either.

Companies making shitty decisions is a completely different point. Yes, it happens all the time -- most companies are trash -- and no, it is for most part not enshrined in law. That's just humans being humans, and the software industry isn't really special in this regard. No need to tell me about it, I work in the industry too. But it's not just the software industry. Pretty much everything that involves large numbers of people has a tendancy to devolve and become a shitshow as it grows, whether there's a profit motive or not. I'm afraid even our laws and governments are susceptible too, and these are much harder to replace than software products..

And for my part, I'm more interested in making the point that regardless of the exact method, publicly trade corporations tend to play the part of a profit generated automaton.

We just have different interests in this discussion.

I agree with the first part, but not the last. I think humans can, and should, aspire to more.

Shitty things happen all over the world, but some organizations and places do take care of their people better, on average. While harbouring no illusion that we'll ever have paradise on earth, that's my interest.

Overall, as things become large and centralized, they become problematic, yes. However, not quite at the same rate I'd argue. Your basic organisational structure is a big factor as to at what size and to what degree things turn to sh*t.

I'm saying if a "studio" owns the game itself, then it's not "indie" IMO.

Indie is a group with complete freedom to make what they want because they have no boss, no obligations, no time frame requirements. Pure programmers and such making what they want for their own sake and their creations sake.

This can be sometimes not work out, just saying that's what makes something "indie" or not

That said, I believe everyone should be able to own the fruits of their labor. Whether a Studio pays good wages or not, that's still a bad way to do things, very capitalist to steal other peoples labor value like that.

It also means if the Studio owns the work, then why should I give any consideration to paying extra for a game since it's not like the employees will be paid more, generally speaking.

You do realise theres things like profit shares, royalties and so on that i didnt mention.

and you should be considering studios in the case here to be like bands. indie bands!