3 ms·

> People writing software need to take responsibility for how the software is used There is an old joke that it's almost impossible to get someone to understan

> People writing software need to take responsibility for how the software is used There is an old joke that it's almost impossible to get someone to understand a problem that would result in a threat to their livliehood. I don't think people need to "take responsibility" I think organisations need to be made to take responsibility. In the UK when you purchase a physical good from the retailer the warranty for that good is between you and the retailer, the retailer then has to deal with problems up the line from suppliers, it's not perfect but it's workable. I think software should be the same, I think if I pay Foo for a system then Foo should be responsible for the system even if it's made of parts from Bar, Fizz and Buzz, if Foo has an issue with Fizz they need to take it up with Fizz. There is so much crap software out there in every field and the acceleration towards a world run on software continues.

acbabis 10y ago
I'm not saying it's not a good idea, but that system's gonna be really tough on the software industry. Consider what would happen when a famous third-party API has security flaw. Most third-party libraries' licenses have an "as-is" clause and even mature third-party software has exploits sometimes (e.g. Java applets). If you wanted to use a library in a project, you would have to - a) read the entire thing to see if you can find any bugs that the devs missed, or - b) roll your own solution which will probably have even more bugs, or - c) find an equivalent library that has a paid version without the "as-is" clause. Imagine paying a monthly subscription fee just so you can offset the liability when Angular has a security hole. This would run a lot of small shops out of business.
- noir_lord 10y ago
  I own one of those small shops so I'm not unsympathetic but few other industries get away with 'as-is' disclaimers, Can you imagine it in the automotive,aeronautical, transport etc? The present system is a pass the parcel of blame with no one taking any responsibility, tonnes of shit, insecure systems written and designed poorly. Eventually something will give.
  - jonnathanson 10y ago
    "Can you imagine it in the automotive,aeronautical, transport etc?" This. This is the most important point I've read so far. The key word here is "imagine." I think even we, as an industry, don't quite grok the degree to which software truly has eaten the world -- and the degree to which it now is every bit as important, as life-or-death, as things like cars, airplane travel, or even medicine. We hold these goods to certain standards because we deem them extremely critical -- too important to be left to the de facto standards set by the operation of a wild-west market. It's about time the notion of standards-free software shocked people as much as the notion of standards-free engineering in any other systemically critical industry. I'd prefer self-established standards set by the industry to government-imposed standards set by lay bureaucrats. But the latter is coming eventually if the former never does.
- sedachv 10y ago
  > Imagine paying a monthly subscription fee just so you can offset the liability when Angular has a security hole. This would run a lot of small shops out of business. Surgeons are not liable for, for example, hip replacement implants from a decade ago that are now known to have problems, but they would be responsible if they continued using the implants after they were recalled. They also purchase malpractice insurance. How is this any different than following security advisories and purchasing liability insurance?

acbabis 10y ago

I'm not saying it's not a good idea, but that system's gonna be really tough on the software industry. Consider what would happen when a famous third-party API has security flaw. Most third-party libraries' licenses have an "as-is" clause and even mature third-party software has exploits sometimes (e.g. Java applets). If you wanted to use a library in a project, you would have to - a) read the entire thing to see if you can find any bugs that the devs missed, or - b) roll your own solution which will probably have even more bugs, or - c) find an equivalent library that has a paid version without the "as-is" clause. Imagine paying a monthly subscription fee just so you can offset the liability when Angular has a security hole. This would run a lot of small shops out of business.

noir_lord 10y ago
I own one of those small shops so I'm not unsympathetic but few other industries get away with 'as-is' disclaimers, Can you imagine it in the automotive,aeronautical, transport etc? The present system is a pass the parcel of blame with no one taking any responsibility, tonnes of shit, insecure systems written and designed poorly. Eventually something will give.
- jonnathanson 10y ago
  "Can you imagine it in the automotive,aeronautical, transport etc?" This. This is the most important point I've read so far. The key word here is "imagine." I think even we, as an industry, don't quite grok the degree to which software truly has eaten the world -- and the degree to which it now is every bit as important, as life-or-death, as things like cars, airplane travel, or even medicine. We hold these goods to certain standards because we deem them extremely critical -- too important to be left to the de facto standards set by the operation of a wild-west market. It's about time the notion of standards-free software shocked people as much as the notion of standards-free engineering in any other systemically critical industry. I'd prefer self-established standards set by the industry to government-imposed standards set by lay bureaucrats. But the latter is coming eventually if the former never does.
sedachv 10y ago
> Imagine paying a monthly subscription fee just so you can offset the liability when Angular has a security hole. This would run a lot of small shops out of business. Surgeons are not liable for, for example, hip replacement implants from a decade ago that are now known to have problems, but they would be responsible if they continued using the implants after they were recalled. They also purchase malpractice insurance. How is this any different than following security advisories and purchasing liability insurance?