5 ms·

But the ease of creating companies and abandoning them or otherwise obfuscating their liabilities says that they won't be the ones paying dearly. In short, I t

But the ease of creating companies and abandoning them or otherwise obfuscating their liabilities says that they won't be the ones paying dearly. In short, I think regulations will prevent more damage than post-hoc legal retribution.

nickpsecurity 10y ago
"In short, I think regulations will prevent more damage than post-hoc legal retribution." Time has proven that wrong so far. We got a lot of highly-secure products after DOD's Computer Security Initiative giving clear guidance plus financial incentive. DO-178B and other safety-critical markets are cranking out lots of them on safety side. So is segment of smartcard industry focused on high-security. Regulation works so long as it has effective standards, they're clear, evaluated against product, and must be followed to sell the product. As in TCSEC era and DO-178B, reusable components for common cases show up to reduce the evaluation cost or risk. Open-source security would likely get a boost, too, as companies sponsoring it would sponsor certifiable versions with the higher QA.
- 0xCMP 10y ago
  You're mentioning an industry funded by about 1/6th[0] of the Federal Budget related to war and consequences if things go wrong (like losing/death/geo poltical problems). Just cause it worked for the DOD doesn't mean it'll work everywhere else. [0]: https://www.cbo.gov/taxonomy/term/17/featured https://www.cbo.gov/taxonomy/term/17/featured
  - nickpsecurity 10y ago
    The LOCK project reported high-assurance cost them 30-40% over a regular development. Altran/Praxis does it regularly for a 50% premium. You don't need the DOD's budget to get even high-assurance software. High-quality stuff usually just cost a bit more upfront followed by savings in maintenance.
- ridgeguy 10y ago
  I read what you wrote as affirming my thought. The constraints of DoD CSI, DO-178B, and the smart card industry focus are all embodied in regulations, which precede legal retribution. If a company busts the regs, it can be sued. But the first line of defense is that companies are required to do it right - by the regulations. I agree regulation needs clear definition and followup to be effective. I continue to regard regulation as a better mitigator of damage than post-hoc penalties. Regulation is about preventing a mess. Litigation is about cleaning it up. I'd rather not have the mess to begin with.
  - nickpsecurity 10y ago
    "Regulation is about preventing a mess. Litigation is about cleaning it up. I'd rather not have the mess to begin with." That's exactly it. Although, I did propose possibility in this thread of defining regulations that aren't immediately applied but apply in court after harm is alleged. The reason being evaluation costs and time can be a big problem, esp for startups. This lets them simply follow guidelines with evidence produced during development & they only pay the cost if they screw up. The cost goes up with level of deviation and harm it caused.
chopin 10y ago
I'd rather put the burden on the owner of the device. If someone puts a device on the internet, he is resposible for its actions. Don't want to be liable? Better buy a safe device. Can't buy a safe device? Don't put it on the internet.
- dorolow 10y ago
  I'm not sure I'm comfortable with the idea of my grandmother being held responsible for the botnet that her coffee maker is a node of.
  - BlackFly 10y ago
    Which is insecure because the creator of the coffee maker didn't consider security to be a necessary feature. The true liability lies with the person that made that decision and should not be transferable.
    - chopin 10y ago
      If we transfer the liability to the consumer, he _will_ consider this a necessary feature. And ask for it. It takes one serious conviction of a consumer and the company selling him crap will go out of business.

nickpsecurity 10y ago

"In short, I think regulations will prevent more damage than post-hoc legal retribution." Time has proven that wrong so far. We got a lot of highly-secure products after DOD's Computer Security Initiative giving clear guidance plus financial incentive. DO-178B and other safety-critical markets are cranking out lots of them on safety side. So is segment of smartcard industry focused on high-security. Regulation works so long as it has effective standards, they're clear, evaluated against product, and must be followed to sell the product. As in TCSEC era and DO-178B, reusable components for common cases show up to reduce the evaluation cost or risk. Open-source security would likely get a boost, too, as companies sponsoring it would sponsor certifiable versions with the higher QA.

0xCMP 10y ago
You're mentioning an industry funded by about 1/6th[0] of the Federal Budget related to war and consequences if things go wrong (like losing/death/geo poltical problems). Just cause it worked for the DOD doesn't mean it'll work everywhere else. [0]: https://www.cbo.gov/taxonomy/term/17/featured https://www.cbo.gov/taxonomy/term/17/featured
- nickpsecurity 10y ago
  The LOCK project reported high-assurance cost them 30-40% over a regular development. Altran/Praxis does it regularly for a 50% premium. You don't need the DOD's budget to get even high-assurance software. High-quality stuff usually just cost a bit more upfront followed by savings in maintenance.
ridgeguy 10y ago
I read what you wrote as affirming my thought. The constraints of DoD CSI, DO-178B, and the smart card industry focus are all embodied in regulations, which precede legal retribution. If a company busts the regs, it can be sued. But the first line of defense is that companies are required to do it right - by the regulations. I agree regulation needs clear definition and followup to be effective. I continue to regard regulation as a better mitigator of damage than post-hoc penalties. Regulation is about preventing a mess. Litigation is about cleaning it up. I'd rather not have the mess to begin with.
- nickpsecurity 10y ago
  "Regulation is about preventing a mess. Litigation is about cleaning it up. I'd rather not have the mess to begin with." That's exactly it. Although, I did propose possibility in this thread of defining regulations that aren't immediately applied but apply in court after harm is alleged. The reason being evaluation costs and time can be a big problem, esp for startups. This lets them simply follow guidelines with evidence produced during development & they only pay the cost if they screw up. The cost goes up with level of deviation and harm it caused.

chopin 10y ago

I'd rather put the burden on the owner of the device. If someone puts a device on the internet, he is resposible for its actions. Don't want to be liable? Better buy a safe device. Can't buy a safe device? Don't put it on the internet.

dorolow 10y ago
I'm not sure I'm comfortable with the idea of my grandmother being held responsible for the botnet that her coffee maker is a node of.
- BlackFly 10y ago
  Which is insecure because the creator of the coffee maker didn't consider security to be a necessary feature. The true liability lies with the person that made that decision and should not be transferable.
  - chopin 10y ago
    If we transfer the liability to the consumer, he _will_ consider this a necessary feature. And ask for it. It takes one serious conviction of a consumer and the company selling him crap will go out of business.