5 ms·

If you provide a product or service to your customers you are entirely responsible for it. If I buy a laptop and it craps out I don't send it back to the manuf

If you provide a product or service to your customers you are entirely responsible for it. If I buy a laptop and it craps out I don't send it back to the manufacturer, I take it back to the retailer.

ksk 10y ago
Okay, but a service and product has a warranty, and most software comes with a limited warranty allowing you to return it so I'm not sure what you mean. If Apache has a 0-day, what you want the bank to do about it if their website gets hacked?
- milesrout 10y ago
  >Okay, but a service and product has a warranty, and most software comes with a limited warranty Products have warranties, but this isn't really what I'm talking about. That was just an example of who is responsible: the person that you deal with is responsible. You buy a product or a service? The person you bought it from is 100% responsible. >If Apache has a 0-day, what you want the bank to do about it if their website gets hacked? The bank shouldn't be relying on software that it can't be sure is secure. If it's using Apache, and Apache has a 0-day, that shouldn't let people get all the way into their cluster and then into all their systems. They should have security in depth. The bank is responsible for the security of their customers' data. If they rely on Apache, an open source software product that they have put no funding into, have no security checked, have not audited and have not actually put any real effort into securing, then that's their responsibility. If they don't want to be susceptible to Apache 0-day vulnerabilities, they should figure out what they need to do to not be susceptible to a 0-day. That's their problem, not mine. Never mine. Always theirs. That's how responsibility works. That's how it's always worked. If a lawyer provides poor legal advice because a contracted investigator got something wrong, the responsibility lies with the lawyer.
  - ksk 10y ago
    >You buy a product or a service? The person you bought it from is 100% responsible. They are only responsible to the extent that their contract with you allows for. Taking the example of safety deposit boxes, banks will make you sign a contract that removes liability, except in the case of gross negligence. What constitutes gross negligence is up to a court to decide. Applying that to being the victim of a cyber-attack or robbery, I don't recall a court ever not siding with a bank. Of course I don't know every single case, but maybe you can dig one up, since you seem quite motivated here.
    - milesrout 10y ago
      >They are only responsible to the extent that their contract with you allows for. The law doesn't allow you to sign away consumer guarantees act or sale of goods act rights (at least here in NZ). So a bank cannot make you sign a contract that removes their liability to keep things in a safety deposit box safe, because in fact keeping them safe is the entire point of a safety deposit box. That's their responsibility. If a bank gets hacked, and loses customer information, then it is because of poor security practices, and that is gross negligence.
blackflame7000 10y ago
Let say I buy a RaspberryPi for use in an IoT product and then it comes out that there is a flaw in Broadcom's Wifi SoC. Who's fault is that?
- milesrout 10y ago
  If you sell an 'IoT product' to someone, and it doesn't work properly because of a wifi issue, then they will take it back to you and say 'the wifi don't work good'. Then it's your responsibility to either refund them or replace it. That's how the law works. Now you have a defective Raspberry Pi, the wifi chip in it doesn't work. So what do you do? You do the same thing: you take it back to the person/company you bought it from and demand a refund, a repair or a replacement depending on whether it's a systemic issue with the chip or a one-off or whatever. If Raspberry Pi then end up taking up issue with Broadcom and complaining to them, that's their problem not yours, just as it's not your customers' responsibility to know only where they got the device. Whose fault is it? It's probably nobody's fault. But there's still a clear chain of responsibility.
- Eridrus 10y ago
  It's everyone's fault, the question is whether RPi or Broadcom were negligent, or not, which has it's own legal standard already.
  - milesrout 10y ago
    Whether it's the fault of RPi or Broadcom is a matter for Broadcom and RPi, not the retailer of the RPi or the end-user.

If you provide a product or service to your customers you are entirely responsible for it. If I buy a laptop and it craps out I don't send it back to the manufacturer, I take it back to the retailer.

ksk 10y ago

Okay, but a service and product has a warranty, and most software comes with a limited warranty allowing you to return it so I'm not sure what you mean. If Apache has a 0-day, what you want the bank to do about it if their website gets hacked?

milesrout 10y ago
>Okay, but a service and product has a warranty, and most software comes with a limited warranty Products have warranties, but this isn't really what I'm talking about. That was just an example of who is responsible: the person that you deal with is responsible. You buy a product or a service? The person you bought it from is 100% responsible. >If Apache has a 0-day, what you want the bank to do about it if their website gets hacked? The bank shouldn't be relying on software that it can't be sure is secure. If it's using Apache, and Apache has a 0-day, that shouldn't let people get all the way into their cluster and then into all their systems. They should have security in depth. The bank is responsible for the security of their customers' data. If they rely on Apache, an open source software product that they have put no funding into, have no security checked, have not audited and have not actually put any real effort into securing, then that's their responsibility. If they don't want to be susceptible to Apache 0-day vulnerabilities, they should figure out what they need to do to not be susceptible to a 0-day. That's their problem, not mine. Never mine. Always theirs. That's how responsibility works. That's how it's always worked. If a lawyer provides poor legal advice because a contracted investigator got something wrong, the responsibility lies with the lawyer.
- ksk 10y ago
  >You buy a product or a service? The person you bought it from is 100% responsible. They are only responsible to the extent that their contract with you allows for. Taking the example of safety deposit boxes, banks will make you sign a contract that removes liability, except in the case of gross negligence. What constitutes gross negligence is up to a court to decide. Applying that to being the victim of a cyber-attack or robbery, I don't recall a court ever not siding with a bank. Of course I don't know every single case, but maybe you can dig one up, since you seem quite motivated here.
  - milesrout 10y ago
    >They are only responsible to the extent that their contract with you allows for. The law doesn't allow you to sign away consumer guarantees act or sale of goods act rights (at least here in NZ). So a bank cannot make you sign a contract that removes their liability to keep things in a safety deposit box safe, because in fact keeping them safe is the entire point of a safety deposit box. That's their responsibility. If a bank gets hacked, and loses customer information, then it is because of poor security practices, and that is gross negligence.

blackflame7000 10y ago

Let say I buy a RaspberryPi for use in an IoT product and then it comes out that there is a flaw in Broadcom's Wifi SoC. Who's fault is that?

milesrout 10y ago
If you sell an 'IoT product' to someone, and it doesn't work properly because of a wifi issue, then they will take it back to you and say 'the wifi don't work good'. Then it's your responsibility to either refund them or replace it. That's how the law works. Now you have a defective Raspberry Pi, the wifi chip in it doesn't work. So what do you do? You do the same thing: you take it back to the person/company you bought it from and demand a refund, a repair or a replacement depending on whether it's a systemic issue with the chip or a one-off or whatever. If Raspberry Pi then end up taking up issue with Broadcom and complaining to them, that's their problem not yours, just as it's not your customers' responsibility to know only where they got the device. Whose fault is it? It's probably nobody's fault. But there's still a clear chain of responsibility.
Eridrus 10y ago
It's everyone's fault, the question is whether RPi or Broadcom were negligent, or not, which has it's own legal standard already.
- milesrout 10y ago
  Whether it's the fault of RPi or Broadcom is a matter for Broadcom and RPi, not the retailer of the RPi or the end-user.