4 ms·
Yes. That, in turn, will give the economic incentive to not have the vulnerabilities in the first place.
by aurelianito 9y ago
Yes. That, in turn, will give the economic incentive to not have the vulnerabilities in the first place.
- kobeya 9y agoOr for software not to get written in the first place.
- goodplay 9y ago>Or for [buggy] software not to get written in the first place. FTFY We place too much trust and rely too much on computer systems these days to have the luxury to write software like we used to.
- kobeya 9y agoNo don't twist my words. I meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. It would kill innovation.
- goodplay 9y ago> meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. And I'm arguing that not doing so might be a good thing. I shudder to think how we'd be off if other infrastructure disciplines took the same approach we take to develop software. If you build something that people use in important infrastructure, prepare to be on the hook if it fails.
- kobeya 9y agoSo if you write some toy PID controller for your kids LEGO project and post it to stack overflow, should you be held liable for all the places it is used?
- goodplay 9y agoI don't think a person should be held liable in this case because the solution was clearly labeled as a toy, and not as a serious solution. If this person presented it as a real solution, however, then yes I believe he should be held liable, as much as a lawyer would be for recklessly giving out legal advice. In either case, The developer who built upon the solution without validating it or verifying its correctness should bear most of the blame, regardless of how the answer was given.
- aurelianito 9y agoIf the security externalities impose on the society a burden that is bigger than the benefit provided by the software not writing it in the first place seems like a good idea.