4 ms·

"Both transparency and oversight are being threatened in the software world. Companies routinely fight making their code public and attempt to muzzle security r

"Both transparency and oversight are being threatened in the software world. Companies routinely fight making their code public and attempt to muzzle security researchers who find problems, citing the proprietary nature of the software. It's a fair complaint, but the public interests of accuracy and safety need to trump business interests." No one, I hope, thinks it's that simple. Businesses cannot be expected to put all their source code on github. Instead, this needs to follow the route that all other regulation goes. Instituting private but 3rd party review of the source code and testing, for which the manufacturer needs to pay a fee to support. I'm not saying this will catch 100% of the issues, but it's a lot better then what we have now and much more likely to work for businesses.

JoeAltmaier 11y ago
That's not obvious at all. Cars can make all of their control software open source with little impact on profitability. Who buys a car based on the software? Isn't the sole reason its kept secret, is to hid how incompetently its been written?
- penguat 11y ago
  It's more likely that it is kept secret to reduce potential liability and to maintain competitive advantage.
- abritishguy 11y ago
  >Who buys a car based on the software? I imagine in the next few years more and more people will. Tesla have just announced that they will have self driving cars in 3 years.
beat 11y ago
Electrical devices have UL certification. Underwriter Labs is an independent, private company (nonprofit until very recently) that evaluates products and provides a seal of approval. This model could be applied to software as well. An independent organization like UL could evaluate the source code, talk to the engineers, and grant (or deny) certification. The source code would still be under NDA or appropriate privacy, but consumers and governments would have more to go on than just some company's word that they're not making anything dangerous or illegal.
- kodablah 11y ago
  I wonder if this can already be done without waiting on government oversight. Essentially outsourced code review with liability protection up to a certain amount. All too often I see code reviews/projects that occur in an internal, self-reinforcing echo chamber. Even a tier of outsourced code review without liability protection but instead an accompanying seal of approval would make me feel better as an executive.
Zigurd 11y ago
> "Businesses cannot be expected to put all their source code on github" Similarly, businnesses cannot be expected to document every dollar of income and expense. Wait. No. We can and do expect that.

JoeAltmaier 11y ago

That's not obvious at all. Cars can make all of their control software open source with little impact on profitability. Who buys a car based on the software? Isn't the sole reason its kept secret, is to hid how incompetently its been written?

penguat 11y ago
It's more likely that it is kept secret to reduce potential liability and to maintain competitive advantage.
abritishguy 11y ago
>Who buys a car based on the software? I imagine in the next few years more and more people will. Tesla have just announced that they will have self driving cars in 3 years.

beat 11y ago

Electrical devices have UL certification. Underwriter Labs is an independent, private company (nonprofit until very recently) that evaluates products and provides a seal of approval. This model could be applied to software as well. An independent organization like UL could evaluate the source code, talk to the engineers, and grant (or deny) certification. The source code would still be under NDA or appropriate privacy, but consumers and governments would have more to go on than just some company's word that they're not making anything dangerous or illegal.

kodablah 11y ago
I wonder if this can already be done without waiting on government oversight. Essentially outsourced code review with liability protection up to a certain amount. All too often I see code reviews/projects that occur in an internal, self-reinforcing echo chamber. Even a tier of outsourced code review without liability protection but instead an accompanying seal of approval would make me feel better as an executive.

Zigurd 11y ago

> "Businesses cannot be expected to put all their source code on github" Similarly, businnesses cannot be expected to document every dollar of income and expense. Wait. No. We can and do expect that.