5 ms·

>Okay, but a service and product has a warranty, and most software comes with a limited warranty Products have warranties, but this isn't really what I'm talki

>Okay, but a service and product has a warranty, and most software comes with a limited warranty Products have warranties, but this isn't really what I'm talking about. That was just an example of who is responsible: the person that you deal with is responsible. You buy a product or a service? The person you bought it from is 100% responsible. >If Apache has a 0-day, what you want the bank to do about it if their website gets hacked? The bank shouldn't be relying on software that it can't be sure is secure. If it's using Apache, and Apache has a 0-day, that shouldn't let people get all the way into their cluster and then into all their systems. They should have security in depth. The bank is responsible for the security of their customers' data. If they rely on Apache, an open source software product that they have put no funding into, have no security checked, have not audited and have not actually put any real effort into securing, then that's their responsibility. If they don't want to be susceptible to Apache 0-day vulnerabilities, they should figure out what they need to do to not be susceptible to a 0-day. That's their problem, not mine. Never mine. Always theirs. That's how responsibility works. That's how it's always worked. If a lawyer provides poor legal advice because a contracted investigator got something wrong, the responsibility lies with the lawyer.

ksk 10y ago
>You buy a product or a service? The person you bought it from is 100% responsible. They are only responsible to the extent that their contract with you allows for. Taking the example of safety deposit boxes, banks will make you sign a contract that removes liability, except in the case of gross negligence. What constitutes gross negligence is up to a court to decide. Applying that to being the victim of a cyber-attack or robbery, I don't recall a court ever not siding with a bank. Of course I don't know every single case, but maybe you can dig one up, since you seem quite motivated here.
- milesrout 10y ago
  >They are only responsible to the extent that their contract with you allows for. The law doesn't allow you to sign away consumer guarantees act or sale of goods act rights (at least here in NZ). So a bank cannot make you sign a contract that removes their liability to keep things in a safety deposit box safe, because in fact keeping them safe is the entire point of a safety deposit box. That's their responsibility. If a bank gets hacked, and loses customer information, then it is because of poor security practices, and that is gross negligence.

ksk 10y ago

>You buy a product or a service? The person you bought it from is 100% responsible. They are only responsible to the extent that their contract with you allows for. Taking the example of safety deposit boxes, banks will make you sign a contract that removes liability, except in the case of gross negligence. What constitutes gross negligence is up to a court to decide. Applying that to being the victim of a cyber-attack or robbery, I don't recall a court ever not siding with a bank. Of course I don't know every single case, but maybe you can dig one up, since you seem quite motivated here.

milesrout 10y ago
>They are only responsible to the extent that their contract with you allows for. The law doesn't allow you to sign away consumer guarantees act or sale of goods act rights (at least here in NZ). So a bank cannot make you sign a contract that removes their liability to keep things in a safety deposit box safe, because in fact keeping them safe is the entire point of a safety deposit box. That's their responsibility. If a bank gets hacked, and loses customer information, then it is because of poor security practices, and that is gross negligence.