7 ms·

Fault will be leveled against Bitcoin for facilitating the ransom, against Microsoft, against NHS budget underfunding... everywhere EXCEPT where the blame belon

by rrggrr 9y ago

Fault will be leveled against Bitcoin for facilitating the ransom, against Microsoft, against NHS budget underfunding... everywhere EXCEPT where the blame belongs. Products liability law applied to IT security would put a quick end to most vulnerabilities.

nopcode 9y ago
>Products liability law Wouldn't that hold Microsoft liable then?
- blowski 9y ago
  Depends. And that's exactly why it's easy to say "we need product liability law", but very difficult to say how it would work in practice.
- UK-AL 9y ago
  Maybe, but a patch for this issue being exploited has been out for quite some time. What's happened is that unpatched versions are being exploited.
gwright 9y ago
Seems strange to not mention the ransomers as having culpability. I'm 100% in favor of better systems/processes/technology to prevent exploits, but I'm also 100% in favor of blaming the perpetrators of the ransom also. In the real world we don't accept the argument that the victim is primarily at fault. * leaving your car unlocked doesn't mean that is OK for someone to steal it and demand a ransom for its return * leaving your house/apartment unlocked doesn't mean that it is OK for someone to swap out the locks and demand ransom for the new keys And it really isn't about being locked/unlocked. Doors and locks can generally be easily broken or bypassed, doesn't mean that everyone should have to purchase industrial strength doors and locking systems (and windows, and...).
- ryandrake 9y ago
  Leaving your car or house unlocked means that you're negligent, not that the attack is your fault.
  - kurthr 9y ago
    Exactly, and if you had someone's important confidential information sitting on the seat (or even on an un-encrypted laptop), you would be liable for that loss.
    - 21 9y ago
      The thief would still be hold accountable if caught. That is what g is saying, that we just gloss over the thief in this case.
- holyavengerone 9y ago
  Well said. +2 for that ;)
- harshreality 9y ago
  Of course the ransomware authors/controllers should be (and are) culpable. But when financially lucrative attacks can be carried out with very little risk of being caught, and the results are so bad, organizations who don't take security very seriously are at fault for not recognizing the threat landscape, and government is at fault for not recognizing that the market isn't solving this problem, stepping in and requiring higher quality assurance or liability for software.
- factsaresacred 9y ago
  > In the real world we don't accept the argument that the victim is primarily at fault. If you're worried about X, and Y promises to prevent X for a cost, you seek recourse against Y. X: I can't miss this flight. Y: Pay this surcharge to reserve a seat. Overbooking ensues. I'm blaming Y and not the other passengers. X: Really don't want this disease to kill me. Y: Take these pills to not die. Death ensues. I'm (well somebody else is) blaming Y and not the disease. In life we can't always control the cause so we aim to minimize the effect. Thus, while the ransomers are culpable for the blast, IT security are accountable for the size of the blast radius.
ethbro 9y ago
> everywhere EXCEPT where the blame belongs The NSA?
- 21 9y ago
  So if I lose my gun on the street and someone (18+) picks it up and shoots somebody, the blame belongs to me? Not saying that the NSA is innocent as a child, but please don't put all on them. If I would have a zero-day I wouldn't go out and encrypt people computers.
  - ethbro 9y ago
    I'd eschew the gun metaphor because rifht to bear arms, etc. But if you find a cooler with a vial of Ebola on the street, take it home instead of turning it in, then have it stolen and have that strain implicated in an outbreak? Yeah... that's definitely at least partly on your hands.
    - panzer_wyrm 9y ago
      The right to bear arms can also extend to cyber arms. And I mean it seriously.
      - ionised 9y ago
        I never thought about it like that before. Interesting. The 'arms' in 'right to bear arms' is not clearly defined, and the founders would not have had any concept of software or weaponised software, but I can't think of an argument against people owning malicious software if the argument for owning firearms is also in play.
  - tomschlick 9y ago
    > So if I lose my gun on the street and someone (18+) picks it up and shoots somebody, the blame belongs to me? I would say this is closer to having your guns stolen from your home while you're asleep and then used in a crime.
  - 9y ago
Teknoman117 9y ago
How do product liability laws cover vulnerabilities no one knew exist. Let's say it isn't a case of lack of forethought or ignoring bug and vulnerability reports, how do these laws treat it then?
DennisP 9y ago
Apparently some blame should also go to the NSA, whose leaked hacking tools were used for this: https://mobile.nytimes.com/2017/05/12/world/europe/uk-national-health-service-cyberattack.html https://mobile.nytimes.com/2017/05/12/world/europe/uk-nation...
ComodoHacker 9y ago
>Products liability law applied to IT security would put a quick end to most vulnerabilities No, it would make IT security about as expensive as good lawyers. Just to cover the losses. A method to reliably produce vulnerability-free software is not invented yet.
- DanWaterworth 9y ago
  > A method to reliably produce vulnerability-free software is not invented yet. I beg to differ. We have formal methods, ranging from type systems to full blown verification. This isn't a technical problem, it's an economic one.
  - ComodoHacker 9y ago
    Had these methods been applied to security aspect of software development? Any examples?
    - DanWaterworth 9y ago
      On the lower end of the spectrum, sound type systems prevent a class of vulnerabilities including buffer overflows. On the upper end, https://sel4.systems/ https://sel4.systems/, a formally verified microkernel, is used in security-critical systems.
- throwaway91111 9y ago
  > A method to reliably produce vulnerability-free software is not invented yet That's not the goal. Well it is, but it's unachievable. We need to get people to care about security beyond ensuring that teenagers can't trivially get in—the current state of affairs for enterprise IT. A law would at least require companies to give a fuck beyond the "can the CEO's niece break in" level.

by rrggrr 9y ago

nopcode 9y ago

>Products liability law Wouldn't that hold Microsoft liable then?

blowski 9y ago
Depends. And that's exactly why it's easy to say "we need product liability law", but very difficult to say how it would work in practice.
UK-AL 9y ago
Maybe, but a patch for this issue being exploited has been out for quite some time. What's happened is that unpatched versions are being exploited.

gwright 9y ago

Seems strange to not mention the ransomers as having culpability. I'm 100% in favor of better systems/processes/technology to prevent exploits, but I'm also 100% in favor of blaming the perpetrators of the ransom also. In the real world we don't accept the argument that the victim is primarily at fault. * leaving your car unlocked doesn't mean that is OK for someone to steal it and demand a ransom for its return * leaving your house/apartment unlocked doesn't mean that it is OK for someone to swap out the locks and demand ransom for the new keys And it really isn't about being locked/unlocked. Doors and locks can generally be easily broken or bypassed, doesn't mean that everyone should have to purchase industrial strength doors and locking systems (and windows, and...).

ryandrake 9y ago
Leaving your car or house unlocked means that you're negligent, not that the attack is your fault.
- kurthr 9y ago
  Exactly, and if you had someone's important confidential information sitting on the seat (or even on an un-encrypted laptop), you would be liable for that loss.
  - 21 9y ago
    The thief would still be hold accountable if caught. That is what g is saying, that we just gloss over the thief in this case.
holyavengerone 9y ago
Well said. +2 for that ;)
harshreality 9y ago
Of course the ransomware authors/controllers should be (and are) culpable. But when financially lucrative attacks can be carried out with very little risk of being caught, and the results are so bad, organizations who don't take security very seriously are at fault for not recognizing the threat landscape, and government is at fault for not recognizing that the market isn't solving this problem, stepping in and requiring higher quality assurance or liability for software.
factsaresacred 9y ago
> In the real world we don't accept the argument that the victim is primarily at fault. If you're worried about X, and Y promises to prevent X for a cost, you seek recourse against Y. X: I can't miss this flight. Y: Pay this surcharge to reserve a seat. Overbooking ensues. I'm blaming Y and not the other passengers. X: Really don't want this disease to kill me. Y: Take these pills to not die. Death ensues. I'm (well somebody else is) blaming Y and not the disease. In life we can't always control the cause so we aim to minimize the effect. Thus, while the ransomers are culpable for the blast, IT security are accountable for the size of the blast radius.

ethbro 9y ago

> everywhere EXCEPT where the blame belongs The NSA?

21 9y ago
So if I lose my gun on the street and someone (18+) picks it up and shoots somebody, the blame belongs to me? Not saying that the NSA is innocent as a child, but please don't put all on them. If I would have a zero-day I wouldn't go out and encrypt people computers.
- ethbro 9y ago
  I'd eschew the gun metaphor because rifht to bear arms, etc. But if you find a cooler with a vial of Ebola on the street, take it home instead of turning it in, then have it stolen and have that strain implicated in an outbreak? Yeah... that's definitely at least partly on your hands.
  - panzer_wyrm 9y ago
    The right to bear arms can also extend to cyber arms. And I mean it seriously.
    - ionised 9y ago
      I never thought about it like that before. Interesting. The 'arms' in 'right to bear arms' is not clearly defined, and the founders would not have had any concept of software or weaponised software, but I can't think of an argument against people owning malicious software if the argument for owning firearms is also in play.
- tomschlick 9y ago
  > So if I lose my gun on the street and someone (18+) picks it up and shoots somebody, the blame belongs to me? I would say this is closer to having your guns stolen from your home while you're asleep and then used in a crime.
- 9y ago

Teknoman117 9y ago

How do product liability laws cover vulnerabilities no one knew exist. Let's say it isn't a case of lack of forethought or ignoring bug and vulnerability reports, how do these laws treat it then?

DennisP 9y ago

Apparently some blame should also go to the NSA, whose leaked hacking tools were used for this: https://mobile.nytimes.com/2017/05/12/world/europe/uk-national-health-service-cyberattack.html https://mobile.nytimes.com/2017/05/12/world/europe/uk-nation...

ComodoHacker 9y ago

>Products liability law applied to IT security would put a quick end to most vulnerabilities No, it would make IT security about as expensive as good lawyers. Just to cover the losses. A method to reliably produce vulnerability-free software is not invented yet.

DanWaterworth 9y ago
> A method to reliably produce vulnerability-free software is not invented yet. I beg to differ. We have formal methods, ranging from type systems to full blown verification. This isn't a technical problem, it's an economic one.
- ComodoHacker 9y ago
  Had these methods been applied to security aspect of software development? Any examples?
  - DanWaterworth 9y ago
    On the lower end of the spectrum, sound type systems prevent a class of vulnerabilities including buffer overflows. On the upper end, https://sel4.systems/ https://sel4.systems/, a formally verified microkernel, is used in security-critical systems.
throwaway91111 9y ago
> A method to reliably produce vulnerability-free software is not invented yet That's not the goal. Well it is, but it's unachievable. We need to get people to care about security beyond ensuring that teenagers can't trivially get in—the current state of affairs for enterprise IT. A law would at least require companies to give a fuck beyond the "can the CEO's niece break in" level.