4 ms·

Some devil's advocate thoughts - Proportional to how much damage they can do doesn't seem like a possible/reasonable measure. Should every car manufacturer now

by zild3d 9y ago

Some devil's advocate thoughts - Proportional to how much damage they can do doesn't seem like a possible/reasonable measure. Should every car manufacturer now be responsible for insuring the cost of every car on the road causing a synchronized collision around the world? Should airplane manufacturers have to be insured for every airplane being in the sky, full of VIPs, and dropping onto the X most expensive buildings on earth, also full of prized possessions and more VIPs? About giving white hats legal immunity to hack devices and be paid. How do you determine who is a white hat? Why wouldn't every black hat attempt to play the part of a white hat, gaining free range to play around with a system without any legal concerns. And if they find a crippling vulnerability, being able to sell it in a black market / partner with other black hats, and pretend they found nothing?

groby_b 9y ago
Yes, they should. Those of us that worked in regulated industries (health, nuclear, etc.) had to do that for a long time now, at least based on my experience in Germany. If your system has the potential to bring down the entire airfleet you sold, yes, you're on the hook for that event. Try building systems that are resilient in the face of failure, make that case to the insurer, premiums will go down. I'm tired of the argument "well, we can break A LOT of shit in one go, so we shouldn't be held liable for our sloppiness". It's "too big to fail" in disguise.
- zild3d 9y ago
  It doesn't seem that clear cut to me, from what I see insurance liabilities in the US and throughout Europe are capped at a dollar amount or up to the corporate equity, not the full damage costs. Nuclear disasters like Fukushima or Chernobyl have cost estimates that are each well over $200 billion. What insurance policy or company can foot that bill? http://www.theecologist.org/blogs_and_comments/commentators/2265605/the_true_cost_of_disaster_insurance_makes_nuclear_power_uncompetitive.html http://www.theecologist.org/blogs_and_comments/commentators/...
- joncrocks 9y ago
  I think the difference is that the types of problems caused are kind of second-order effects based on co-ordination, rather than individual actions that each device is taking that is 'bad'. So yes, air plane manufacturers might have insurance to cover them for all of their planes being down, but it's probably limited to the first-order damages of all of the planes being down, rather than the potential extra due to the fact they are all down at the same time. e.g. If I own a mail-order business and I ship my stuff via air (with no contracts in place etc.), and suddenly no air planes can fly, so my business folds, I probably can't sue the air plane manufacturers. In a similar way, the individual 'damages' that are attributed in a DDOS attack are due to the coordinated nature, rather than each device doing actual harm/damage.
  - groby_b 9y ago
    Yes, second-order effects are harder to insure against, because the actuarial computations are harder. But introduce liability for the issue, and insurance will follow. "It's hard to do things right" is not an excuse for not doing them right.
pjc50 9y ago
Car drivers are currently required to carry insurance against the damage they might do to third parties, although there's usually a (high) cap on the amount. I don't see why self-driving cars shouldn't be required to be insured either.

by zild3d 9y ago

groby_b 9y ago

Yes, they should. Those of us that worked in regulated industries (health, nuclear, etc.) had to do that for a long time now, at least based on my experience in Germany. If your system has the potential to bring down the entire airfleet you sold, yes, you're on the hook for that event. Try building systems that are resilient in the face of failure, make that case to the insurer, premiums will go down. I'm tired of the argument "well, we can break A LOT of shit in one go, so we shouldn't be held liable for our sloppiness". It's "too big to fail" in disguise.

zild3d 9y ago
It doesn't seem that clear cut to me, from what I see insurance liabilities in the US and throughout Europe are capped at a dollar amount or up to the corporate equity, not the full damage costs. Nuclear disasters like Fukushima or Chernobyl have cost estimates that are each well over $200 billion. What insurance policy or company can foot that bill? http://www.theecologist.org/blogs_and_comments/commentators/2265605/the_true_cost_of_disaster_insurance_makes_nuclear_power_uncompetitive.html http://www.theecologist.org/blogs_and_comments/commentators/...
joncrocks 9y ago
I think the difference is that the types of problems caused are kind of second-order effects based on co-ordination, rather than individual actions that each device is taking that is 'bad'. So yes, air plane manufacturers might have insurance to cover them for all of their planes being down, but it's probably limited to the first-order damages of all of the planes being down, rather than the potential extra due to the fact they are all down at the same time. e.g. If I own a mail-order business and I ship my stuff via air (with no contracts in place etc.), and suddenly no air planes can fly, so my business folds, I probably can't sue the air plane manufacturers. In a similar way, the individual 'damages' that are attributed in a DDOS attack are due to the coordinated nature, rather than each device doing actual harm/damage.
- groby_b 9y ago
  Yes, second-order effects are harder to insure against, because the actuarial computations are harder. But introduce liability for the issue, and insurance will follow. "It's hard to do things right" is not an excuse for not doing them right.

pjc50 9y ago

Car drivers are currently required to carry insurance against the damage they might do to third parties, although there's usually a (high) cap on the amount. I don't see why self-driving cars shouldn't be required to be insured either.