4 ms·

All the more reason to emphasize security over the latest in features and upgradability. Why doesn't Microsoft get held accountable when a 0-day in Windows is

by Taek 10y ago

All the more reason to emphasize security over the latest in features and upgradability. Why doesn't Microsoft get held accountable when a 0-day in Windows is exploited that results in loss of user funds? Without that, there's no incentive to build secure software in the first place. How do we get society to have more of a security-first approach when it comes to things connected to the internet? A lot of these vulnerabilities are scary in a systemic way. Cyber warfare would likely be as damaging as dropping napalm on cities, and it's all preventable by having more security oriented infrastructure.

rtpg 10y ago
Another angle to this: Why does Apple get away with something like 2 year support windows for their OS? We now have a bunch of people on OS 10.6.8 who will stop getting updates, but even 10.9 will fall out of support before Win7 Though I suppose the best solution would be to get everyone on the upgrade treadmill
- mschuster91 10y ago
  > Though I suppose the best solution would be to get everyone on the upgrade treadmill No. The best solution would be to require Apple, Google and MS to split up their OSes into individual packages, that can be upgraded at will, and to unlink functionality from optics in all parts of the OS. The reason is simple: most people, especially corp environments, don't upgrade their software because they see on friends' machines (or phones) that the look and feel has changed too much for them / that retraining time for employees is too expensive. A good example is the clusterfuck MS committed with Win8 by replacing the taskbar, the unremovable phone-home/unstoppable auto updater in Win10 or the various "design improvements" / "performance improvements" Apple did on OS X/iOS. Oh, and with Apple there's the high risk of critical bugs or other incompatibilities with their newest OS. Software like the Adobe suite, music/video editor programs, and even office mainstream apps Lotus f..ing Notes and Cisco's programs tend to have boatloads of bugs each major OS X release. With MS, you can at least assume that you can run any old software that doesn't require drivers...
  - rtpg 10y ago
    "microkernels" I agree that it should be possible to upgrade the backend without having to upgrade the frontend (so to speak) of the OSes. In my experience, though, even the backend for OS X is massively changing. Networking, in particular, seems to be changing every release.
AnthonyMouse 10y ago
> Why doesn't Microsoft get held accountable when a 0-day in Windows is exploited that results in loss of user funds? Without that, there's no incentive to build secure software in the first place. There is nothing stopping you from entering into a contract with Microsoft that requires them to take on that liability. And there are some companies that have contracts like that with some software vendors -- presumably in aerospace and so on. And those companies pay $5000 or more for a piece of software that you would pay $10 for. If you asked a normal person to pay that much for every app in the store they would just laugh. If you made developers liable for vulnerabilities, that's what would need to happen. Software would have to cost enough to cover the liability. If you sell ten million copies of some code and you have one vulnerability (down from 75 before this), that vulnerability may cost 1% of your customers $20,000 each and you're suddenly on the hook for billions of dollars. And you better hope none of your customers are large corporations that could potentially suffer even bigger losses, even though the software developer has no control over that at all. A big part of the problem here is that we keep trying to shield the users from liability, but they're the ones who make the decisions. The user won't be willing to pay extra or suffer any inconvenience for better security if it's the credit card company or insurance company or software vendor that sustains the loss when they get hacked. Security is terrible because the party who decides how much to prioritize security is the party we give half a dozen ways to get out of suffering from the consequences of poor security.
- cm2187 10y ago
  But what would also happen is that for the software vendor to stay competitive, he would spend a lot of time and effort to harden the software to reduce the insurance premium. Very far away from Microsoft's "let's use consumers as beta testers" approach.
  - AnthonyMouse 10y ago
    > But what would also happen is that for the software vendor to stay competitive, he would spend a lot of time and effort to harden the software to reduce the insurance premium. That's not competitive though. When the user is at minimal risk the user wants the cheapest software, not the most secure software. In that situation you can't spend money improving security or buying insurance, that would make your software cost more than the competition. The winning competitive strategy would be to minimize the consequences of declaring bankruptcy. Take on debt financing instead of issuing stock, to minimize net assets. Develop the software as many pieces each owned by an independent business entity so there is no deep pocket to attract claims and there is a smaller loss when an owner has to write one off.
t0mas88 10y ago
Look at the costs of healthcare in the US compared to most other western countries. Liability and the related insurance is often listed as a big reason for the high costs. So you're not going to improve software with this, you're going to make it incredibly expensive in the US. The only groups benefiting from this will be lawyers and insurance companies.

by Taek 10y ago

rtpg 10y ago

Another angle to this: Why does Apple get away with something like 2 year support windows for their OS? We now have a bunch of people on OS 10.6.8 who will stop getting updates, but even 10.9 will fall out of support before Win7 Though I suppose the best solution would be to get everyone on the upgrade treadmill

mschuster91 10y ago
> Though I suppose the best solution would be to get everyone on the upgrade treadmill No. The best solution would be to require Apple, Google and MS to split up their OSes into individual packages, that can be upgraded at will, and to unlink functionality from optics in all parts of the OS. The reason is simple: most people, especially corp environments, don't upgrade their software because they see on friends' machines (or phones) that the look and feel has changed too much for them / that retraining time for employees is too expensive. A good example is the clusterfuck MS committed with Win8 by replacing the taskbar, the unremovable phone-home/unstoppable auto updater in Win10 or the various "design improvements" / "performance improvements" Apple did on OS X/iOS. Oh, and with Apple there's the high risk of critical bugs or other incompatibilities with their newest OS. Software like the Adobe suite, music/video editor programs, and even office mainstream apps Lotus f..ing Notes and Cisco's programs tend to have boatloads of bugs each major OS X release. With MS, you can at least assume that you can run any old software that doesn't require drivers...
- rtpg 10y ago
  "microkernels" I agree that it should be possible to upgrade the backend without having to upgrade the frontend (so to speak) of the OSes. In my experience, though, even the backend for OS X is massively changing. Networking, in particular, seems to be changing every release.

AnthonyMouse 10y ago

> Why doesn't Microsoft get held accountable when a 0-day in Windows is exploited that results in loss of user funds? Without that, there's no incentive to build secure software in the first place. There is nothing stopping you from entering into a contract with Microsoft that requires them to take on that liability. And there are some companies that have contracts like that with some software vendors -- presumably in aerospace and so on. And those companies pay $5000 or more for a piece of software that you would pay $10 for. If you asked a normal person to pay that much for every app in the store they would just laugh. If you made developers liable for vulnerabilities, that's what would need to happen. Software would have to cost enough to cover the liability. If you sell ten million copies of some code and you have one vulnerability (down from 75 before this), that vulnerability may cost 1% of your customers $20,000 each and you're suddenly on the hook for billions of dollars. And you better hope none of your customers are large corporations that could potentially suffer even bigger losses, even though the software developer has no control over that at all. A big part of the problem here is that we keep trying to shield the users from liability, but they're the ones who make the decisions. The user won't be willing to pay extra or suffer any inconvenience for better security if it's the credit card company or insurance company or software vendor that sustains the loss when they get hacked. Security is terrible because the party who decides how much to prioritize security is the party we give half a dozen ways to get out of suffering from the consequences of poor security.

cm2187 10y ago
But what would also happen is that for the software vendor to stay competitive, he would spend a lot of time and effort to harden the software to reduce the insurance premium. Very far away from Microsoft's "let's use consumers as beta testers" approach.
- AnthonyMouse 10y ago
  > But what would also happen is that for the software vendor to stay competitive, he would spend a lot of time and effort to harden the software to reduce the insurance premium. That's not competitive though. When the user is at minimal risk the user wants the cheapest software, not the most secure software. In that situation you can't spend money improving security or buying insurance, that would make your software cost more than the competition. The winning competitive strategy would be to minimize the consequences of declaring bankruptcy. Take on debt financing instead of issuing stock, to minimize net assets. Develop the software as many pieces each owned by an independent business entity so there is no deep pocket to attract claims and there is a smaller loss when an owner has to write one off.

t0mas88 10y ago

Look at the costs of healthcare in the US compared to most other western countries. Liability and the related insurance is often listed as a big reason for the high costs. So you're not going to improve software with this, you're going to make it incredibly expensive in the US. The only groups benefiting from this will be lawyers and insurance companies.