4 ms·

We need civil penalties for failing to patch any serious vulnerability (that can be defined as RCE, priv. escalation, etc) within 30 days of disclosure. If you

We need civil penalties for failing to patch any serious vulnerability (that can be defined as RCE, priv. escalation, etc) within 30 days of disclosure. If you can't patch it, you must issue a patch that announces the vuln and disables the minimal set of functionality that enables it. Even if that's the whole program.

throwanem 9y ago
So, turn a nontrivial set of vulns into successful DoS attacks?
- aurelianito 9y ago
  Yes. That, in turn, will give the economic incentive to not have the vulnerabilities in the first place.
  - kobeya 9y ago
    Or for software not to get written in the first place.
    - goodplay 9y ago
      >Or for [buggy] software not to get written in the first place. FTFY We place too much trust and rely too much on computer systems these days to have the luxury to write software like we used to.
      - kobeya 9y ago
        No don't twist my words. I meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. It would kill innovation.
        goodplay 9y ago
        > meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. And I'm arguing that not doing so might be a good thing. I shudder to think how we'd be off if other infrastructure disciplines took the same approach we take to develop software. If you build something that people use in important infrastructure, prepare to be on the hook if it fails.
        kobeya 9y ago
        So if you write some toy PID controller for your kids LEGO project and post it to stack overflow, should you be held liable for all the places it is used?
        goodplay 9y ago
        I don't think a person should be held liable in this case because the solution was clearly labeled as a toy, and not as a serious solution. If this person presented it as a real solution, however, then yes I believe he should be held liable, as much as a lawyer would be for recklessly giving out legal advice. In either case, The developer who built upon the solution without validating it or verifying its correctness should bear most of the blame, regardless of how the answer was given.
    - aurelianito 9y ago
      If the security externalities impose on the society a burden that is bigger than the benefit provided by the software not writing it in the first place seems like a good idea.
deleted 9y ago
[deleted]
jaredklewis 9y ago
I don't the think we need this. It follows the strategy of "just create one rule and penalty for everything bad that can be done." The result is more regulations than can ever be learned, except by total specialists that devote their entire career to compliance in one particular area, huge enforcement costs, and typical government incompetence (we have clean water regulations, doesn't stop them from being broken constantly). IMHO, a better solution is to create legislation that forces software to be sold and distributed under a set of public, common terms. If the rest of the market worked the way software does, everytime you went into a restaurant, bought a book, or used a photocopier you first would sign a long contract freeing that business of any liability whatsoever. If I go to a restaurant and the Food poisoning kills my family, I can sue them. If I buy a book at the store, the store cannot mandate that I not read the book on Sunday. If you buy the book on Amazon Kindle, they are free to stipulate pretty much anything. If software and digital products were sold with universal, reasonable terms, companies and individuals that were damaged by grossly negligent behavior could sue and have those damages repaid to them. This incentivizes companies to behave better. It is also more general purpose. We don't have to add one new regulation for every way a company can possibly be grossly negligent.

throwanem 9y ago

So, turn a nontrivial set of vulns into successful DoS attacks?

aurelianito 9y ago
Yes. That, in turn, will give the economic incentive to not have the vulnerabilities in the first place.
- kobeya 9y ago
  Or for software not to get written in the first place.
  - goodplay 9y ago
    >Or for [buggy] software not to get written in the first place. FTFY We place too much trust and rely too much on computer systems these days to have the luxury to write software like we used to.
    - kobeya 9y ago
      No don't twist my words. I meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. It would kill innovation.
      - goodplay 9y ago
        > meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. And I'm arguing that not doing so might be a good thing. I shudder to think how we'd be off if other infrastructure disciplines took the same approach we take to develop software. If you build something that people use in important infrastructure, prepare to be on the hook if it fails.
        kobeya 9y ago
        So if you write some toy PID controller for your kids LEGO project and post it to stack overflow, should you be held liable for all the places it is used?
        goodplay 9y ago
        I don't think a person should be held liable in this case because the solution was clearly labeled as a toy, and not as a serious solution. If this person presented it as a real solution, however, then yes I believe he should be held liable, as much as a lawyer would be for recklessly giving out legal advice. In either case, The developer who built upon the solution without validating it or verifying its correctness should bear most of the blame, regardless of how the answer was given.
  - aurelianito 9y ago
    If the security externalities impose on the society a burden that is bigger than the benefit provided by the software not writing it in the first place seems like a good idea.

deleted 9y ago

[deleted]

jaredklewis 9y ago

I don't the think we need this. It follows the strategy of "just create one rule and penalty for everything bad that can be done." The result is more regulations than can ever be learned, except by total specialists that devote their entire career to compliance in one particular area, huge enforcement costs, and typical government incompetence (we have clean water regulations, doesn't stop them from being broken constantly). IMHO, a better solution is to create legislation that forces software to be sold and distributed under a set of public, common terms. If the rest of the market worked the way software does, everytime you went into a restaurant, bought a book, or used a photocopier you first would sign a long contract freeing that business of any liability whatsoever. If I go to a restaurant and the Food poisoning kills my family, I can sue them. If I buy a book at the store, the store cannot mandate that I not read the book on Sunday. If you buy the book on Amazon Kindle, they are free to stipulate pretty much anything. If software and digital products were sold with universal, reasonable terms, companies and individuals that were damaged by grossly negligent behavior could sue and have those damages repaid to them. This incentivizes companies to behave better. It is also more general purpose. We don't have to add one new regulation for every way a company can possibly be grossly negligent.