I would prefer not having these cameras at all. If you need to read license plates, hire people to do the jobs. If it's that important, it's worth paying for.

But that's not going to happen.

So, I can live with destroying all images within seconds unless there was an actual need to keep them, then keeping them and the data gathered from them in an encrypted, non-network-accessible location only for as long as they are needed, with strong oversight to make sure images really are deleted when no longer needed. Any supposed "need" to keep these images beyond, say, the time it takes to send out a you-didn't-pay-your-toll-bill invoice and give the recipient an opportunity to pay or protest should require court oversight.

In rare cases where the police are "on the lookout" for car matching a general description ("driver in green station wagon kidnapped small child from Springfield Kwik-E-Mart, no license plate"), keeping all images within a small targeted search area for hours instead of seconds may be tolerable, with the police keeping only those images that are useful for the investigation after the several hours have expired. In any case, keep the images offline.

In any case, keep the images encrypted and offline. I don't want some overseas black-hat group collecting a dossier of my car's travels.

You are confusing the police department's FLOCK camera with my across-the-street-nosy-neighbor's doorbell camera that stores data unencrypted on a weak- or no-password-required web site that the cops happen to be watching and recording 24/7.

There are ways to do just that. Minimal drivers, all compiled in. No loadable modules. Secure/trusted boot environment. Minimal access to I/O with strong input sanitization and very likely a read-only filesystem so a reboot is a true fresh start. This won't be your general-purpose computer though.

Comprehensive testing is expensive.

Formal verification is also very difficult, but at least one formally verified microkernel, SeL4, is in production. Having a formally verified microkernel is NOT the same as having a formally verified computing environment.

Interestingly, just this week a major American fast food chain is offering a "be a beta tester for our app and get a discount on your next order" promotion.

The developers may know about them but don't have the resources to fix ALL of the known bugs.

More likely, the developers are careful not to go on an internal "bug hunt" that will find bugs faster than they can fix, because someone out there will be "injured" by the one bug they prioritized as "fix later" and sue. "Because lawyers."

If you write your diary on paper owned by someone else and the rental agreement says they are allowed to look at it and report suspicious content to the police ....

If you need a confessional that won't record, put the Eliza AI chat bot on a bootable USB stick and have fun.

Back in the last quarter of the 20th century, many POTS telephone switches had an A side and a B side.

During software upgrades - and yes those were a thing - they would route all new calls to the A side and wait until the last call on the B side ended before they would take the B side down for the upgrade.

Then they would do some testing before bringing up the B side.

Only after they were confident that the B side was working would they upgrade the A side.

This worked in part because they could schedule upgrades when the load was low enough to be handled only by half of the switch's capacity.

Johnny: I'm going to City Junior College!
Jimmy: I'm going to be a Space Cadet!

If you read a lot of computer-generated writing, it shouldn't be any surprise when you writing looks a little more like it was written by a computer than it did a few years ago.

Fair insight, unfortunately.

Unfortunately that makes my point theoretical instead of actual in this instance - ultimately, they (we) can't be so short-sighted to believe that the 'accidental' damage will always be limited to a 'friendly' target. If they CAN escape boundaries (esp if they are testing in the wild) eventually they're going to hit a 3M or P&G who doesn't give a fuck, or who suffers major political/consumer fallout that isn't so easily firewalled within 'interested actors'.

But my original point persists: if we legally set '10x damages' as the precedent, even the wild valuations of these shareholders would have to be tempered (I guess I'm assuming SOME sense of reality in the process) to recognize the catastrophic/explosive liabilities & maybe invest with a little more trepidation?

I realize as I'm typing this it even sounds naive to me.

Then again, there is the little-remembered bit of Eisenhower's farewell address.
https://www.archives.gov/miles...

Immediately after his (much repeated) warning about the dangers of the military-industrial complex, he them went on:

Akin to, and largely responsible for the sweeping changes in our industrial-military posture, has been the technological revolution during recent decades.

In this revolution, research has become central; it also becomes more formalized, complex, and costly. A steadily increasing share is conducted for, by, or at the direction of, the Federal government.

Today, the solitary inventor, tinkering in his shop, has been over shadowed by task forces of scientists in laboratories and testing fields. In the same fashion, the free university, historically the fountainhead of free ideas and scientific discovery, has experienced a revolution in the conduct of research. Partly because of the huge costs involved, a government contract becomes virtually a substitute for intellectual curiosity. For every old blackboard there are now hundreds of new electronic computers.

The prospect of domination of the nation's scholars by Federal employment, project allocations, and the power of money is ever present and is gravely to be regarded.

Yet, in holding scientific research and discovery in respect, as we should, we must also be alert to the equal and opposite danger that public policy could itself become the captive of a scientific-technological elite.

Funny few people remember that one. It sure looks like these scholars are chasing the money.

Because "get it coded fast, we'll worry about resource-related problems in a future release" is a winning strategy if you expect to never hit your resource limits.

... when you have to prove your identity to submit a job application, much like how banks in the United States are required to verify identity before opening an account for a new customer.