3 ms·
>Products liability law applied to IT security would put a quick end to most vulnerabilities No, it would make IT security about as expensive as good lawyers.
by ComodoHacker 9y ago
>Products liability law applied to IT security would put a quick end to most vulnerabilities
No, it would make IT security about as expensive as good lawyers. Just to cover the losses. A method to reliably produce vulnerability-free software is not invented yet.
- DanWaterworth 9y ago> A method to reliably produce vulnerability-free software is not invented yet. I beg to differ. We have formal methods, ranging from type systems to full blown verification. This isn't a technical problem, it's an economic one.
- ComodoHacker 9y agoHad these methods been applied to security aspect of software development? Any examples?
- DanWaterworth 9y agoOn the lower end of the spectrum, sound type systems prevent a class of vulnerabilities including buffer overflows. On the upper end, https://sel4.systems/ https://sel4.systems/, a formally verified microkernel, is used in security-critical systems.
- throwaway91111 9y ago> A method to reliably produce vulnerability-free software is not invented yet That's not the goal. Well it is, but it's unachievable. We need to get people to care about security beyond ensuring that teenagers can't trivially get in—the current state of affairs for enterprise IT. A law would at least require companies to give a fuck beyond the "can the CEO's niece break in" level.