I agree with your sentiment, but I am unclear as to how to actually implement it. An imperative to cancel the product in the absence of a court judgment seems a

I agree with your sentiment, but I am unclear as to how to actually implement it. An imperative to cancel the product in the absence of a court judgment seems a bit extreme. I think a series of escalation steps is in order. Escalation steps inevitably involve a 'nuclear option' whose size and expense relegate it to just the most sure and most aggrieved wrong parties. These days that option is a class-action lawsuit. It seems to work best when deterrence is the primary goal, plaintiffs rarely ever get anything of value out of it. It works as you would expect, but one really wants a pathway to punish negligence without having to get lawyers involved. I believe this is usually done with market solutions to make 'buyer beware' less awful on the ignorant. But the sheer scale of the stated problem, forcing all web service developers everywhere, to consider possible lines of attack on their software, under pain of loss of livelihood, seems too general and too unenforceable to be useful.