14 ms·

I think at a certain point someone needs to be held criminally liable for situations such as this one. A VW engineer is likely going to jail over dieselgate.

I think at a certain point someone needs to be held criminally liable for situations such as this one. A VW engineer is likely going to jail over dieselgate. We have already seen that such insecure internet connected devices can be easily and quickly assembled into a botnet. The operators of such a network can direct the attacks at healthcare institutions, national infrastructure, and other safety critical systems. At some point, there has to be stricter consequences for companies than simply a fine. C-levels won't start paying attention to security until there's the real possibility that their ass will end up in jail for this kind of insecurity.

QUFB 9y ago
What laws would you propose to eliminate insecure software?
- marcoperaza 9y ago
  Bruce Schneier has speculated about creating mandatory legal liability for software vendors and service providers. Liability regimes are a major reason why physical products are so safe. https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html https://www.schneier.com/essays/archives/2003/11/liability_c...
  - ryandrake 9y ago
    Say goodbye to open source, then, unless he proposes a special carve-out for it.
    - marcoperaza 9y ago
      He has some commentary on this well: https://www.schneier.com/blog/archives/2008/07/software_liabil.html https://www.schneier.com/blog/archives/2008/07/software_liab... In summary, there wouldn't be liability for open source developers because there is no business contract. But if you run a website with open source software, you of course would still be liable for anything that happens to your customers' data. So you would probably want to buy that same open source software from someone (e.g. Red Hat), who would also be liable.
      - smsm42 9y ago
        Which means, hosting/supporting open source would quickly become not worth it for any major company representing a large target for opportunistic lawyers. When you make millions from a product, you can afford a team of lawyers setting up contacts just right and fighting liability trolls. When you make zero profit, you cut the losses. Such law would spell very quick end to any corporate support of free and open source software, for liability reasons. There's a reason why all such software is accompanied with "NO WARRANTY" texts, and enforcing liability will make the corporate world to run from it. Nobody wants to be sued because they use OpenSSL and there was a vulnerability there, and that's exactly what would happen with any commercial vendor using OpenSSL if liability laws would be introduced. It doesn't matter the company didn't write OpenSSL - as soon as they use it, they are on the hook. IBM was sued not because they made Linux, but because they used it and had tons of money. And I do not see any business model that could allow companies to charge enough to cover such liabilities. Maybe for established powerhouses like Linux or for corporate foundational projects like Chrome and Darwin, but not for any lesser projects and surely not for any starting up open source with unclear revenue potential. It won't kill all open source, but it would severely hurt the ecosystem and turn it into two worlds - pure hobbyist geekery which nobody with money would touch, and formally open-source projects with strict corporate governance that has no ecosystem beyond the founding corporation. One of the worst ideas I've heard lately, and I am genuinely baffled how a person as smart and experienced as Schneier could support it.
        marcoperaza 9y ago
        I'm not sure you're envisioning the same thing I am. You would only be liable for something that you sell or otherwise make money from. You would be free to publish software, open source or not, without incurring liability as long as you don't make money from it. Whoever then uses that software for a commercial product would be incurring the full liability, and would not be able to turn around and sue up the chain. The currently widespread practice of trusting sensitive user data to open source code without an audit (either internally or via a third-party, e.g. Red Hat) is horrifying and incredibly negligent.
        9y ago
    - JoshTriplett 9y ago
      I've actually had discussions with several people, separately and at a legal summit that specifically discussed the topic of software liability, that proposed a good solution to this: Make the liability proportional to the degree to which you've given them the degree to find and fix any issues that might arise. If you give someone FOSS software to solve some particular problem, even a potentially-high-liability problem, you've given them everything they need to both analyze the software for potential issues, and fix them themselves. (Auto manufacturers like FOSS because it means they can always support it themselves if the vendor won't, and they have far longer support lifetimes than many other products.) So disclaiming all liability there seems reasonable, for anything short of intentional malice (e.g. backdoors). On the other hand, if you give someone a piece of opaque proprietary software, then you're selling them a solution to a problem, and it'd better work because they can't do anything but go to you if it doesn't. They also can't introspect it, and black-box testing only goes so far. So this should increase liability. Even more so if you supply it in an obfuscated form that's difficult to reverse-engineer or test, or if you lock it down to make it irreplaceable. The same thing would go for changing software yourself, on a high-liability device. If you don't change it, it's not your fault; if you change it, it might be your fault.
      - sitharus 9y ago
        New Zealand consumer law has a requirement that goods must be 'fit for purpose'. This means that if a company sells you a clothes washer for example it must clean clothes, but if you try to wash your shoes and it breaks it's not the manufacturer's fault (unless they said it could of course). I think something like this could apply very well to software. If someone uploads source code to github they haven't sold it to you with any purpose in mind, but commercial sales have functionality promises so they could be held to them.
        DannyBee 9y ago
        warranty of merchantability and fitness for a particular purpose exist in the US. Whether it can be disclaimed is per-state though. (Some states allow disclaiming implied warranties, some do not).
  - trapperkeeper74 9y ago
    Another, less chilling effects way would be to have an Underwriters' Laboratories (UL) or CE for software. Any government, company or customer could then have that as a requirement.
    - marcoperaza 9y ago
      That's what would effectively emerge from the liability system. Companies would buy insurance from liability, and the insurance companies would demand some kind of certification process.
    - kabdib 9y ago
      Certification programs, when they exist, tend to become political creatures and tools of destruction. You wind up with byzantine and arbitrary rules, often put in place for horse-trading reasons, often to exclude competition and drive up prices. Want a seat at the standards table? Pony up tons of time, plenty of money for travel to cities where meetings are held, and be prepared for the big software consulting firms to crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. Want to contribute to Python? Sure hope you have that degree, plus an engineering certificate from your local/state/national government. Your dues are paid up and you've passed the most recent set of exams, right? Oh, and let's talk about your toolchain. You can license a certified compiler for $15,000 a seat. Per year. I can't imagine anything more chilling, other than an outright ban on people writing software.
      - colejohnson66 9y ago
        > ...crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. And good luck knowing what the actual requirements of that standard are; PDFs of ISO standards cost hundreds of dollars.
        kabdib 9y ago
        Yup, that's part of the racket.
  - travmatt 9y ago
    I believe Dan Geer also gave a keynote a year or so ago at Blackhat (or Defcon) arguing for a similar framework.
- kogepathic 9y ago
  CTO is criminally liable for technical breaches involving their company. They're supposed to be responsible for this anyway, but given that at worst they receive a slap on the wrist and their company gets fined, clearly more needs to be done. You might counter: well no one will be willing to be CTO if it involves such personal risk. I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough, or they can show sufficient due diligence that they won't end up in jail. I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure and not a minimum viable product full of holes like this.
  - jacquesm 9y ago
    > well no one will be willing to be CTO if it involves such personal risk. Of course they would. Compensation would go up and the good ones would be readily employed. The hard part would be to make such liability stick.
  - smsm42 9y ago
    > CTO is criminally liable for technical breaches involving their company Which means CTOs would have huge incentive to conceal such breaches and persecute anybody who would report them. Also, CTOs would require huge money to cover the risks, and probably wide insurance coverage like medical malpractice insurance. Which is five-figure number at least. I wonder which startup could afford that. > I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough They surely can spend money on lawyers writing tricky contracts and acquiring various expensive certifications. As for whether it'd make their software any more secure - this is much more doubtful. > I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure That implicitly assumes right now the problem in software being insecure is because not enough money is spent on it, and if software would be more expensive, it would be more secure. This assumption does not seem to be true.
- Nursie 9y ago
  Depends, but there's insecurity by bad design, or bad implementation, and then there's stuff like this. I would say that some sort of negligence laws would be appropriate here, with a defence being that good practice was followed. Accidents will happen even with the best of intent; but there's a line somewhere.
- jacquesm 9y ago
  Step 1 is mandatory reporting of breaches. Step 2 would be the creation of an actual software engineering profession complete with the equivalent of the 'iron ring' and a pledge to go with it. Maybe the ring could be made of ferrite ;) Step 3 is attaching a figure to compensating victims of breaches over and beyond some credit score bs. Step 4 would be actual legal liability for service providers and shrink wrap software manufacturers which they could not get you to waive. Step 5 would be criminal liability for producers of faulty software and especially the management layers above them. Applied sequentially until it starts to hurt would improve software quality in a hurry and would most likely result in massive retraining of a large number of people now employed as programmers as well as their management.
  - protomyth 9y ago
    In your scenario, does all software now requires a certified software engineer?
    - jacquesm 9y ago
      No, you're fine to do whatever you want. But companies will likely want to hire people that reduce their exposure to lawsuits that will stick. So if your software is going to affect lives and you feel that you can handle the fall-out in case it does not and you are not certified then you're more than welcome to make that combination work.
      - protomyth 9y ago
        So, basically no non-certified programmers because Apple, etc. will just not give you a developer certificate because of a possible lawsuit.
        jacquesm 9y ago
        Apple isn't in the business of providing critical software where such liability would make much sense beyond when: (1) their phones given enough charge refuse to call 9/11 as mandated by law at the present anyway (2) their authentication details are leaked (3) their operating systems suffer security bugs At most other levels the damage could easily be contained. Note that even at present they could be sued for any and all of the above, whether such a lawsuit is winnable is beyond my expertise to evaluate but it would certainly be interesting to see the arguments both sides put forth. So plenty of opportunity to be employed for 'non certified programmers'. Note that almost every big software provider already has a certification program of sorts but at the moment these are just used as either a revenue stream or a way to get people to invest in the eco system.
- deleted 9y ago
  [deleted]
- _rpd 9y ago
  A few professional negligence lawsuits wouldn't hurt.
- tejtm 9y ago
  Laws that stripped resources from share holders. Blaming a programmer for a culture they are not responsible for creating or maintaining is far too late in the process. If a venture has no reason to exist if cannot produce secure products a culture of building secure products will emerge. It may be that every MBA with a NDA will not be able to afford the competent programmers required, but as they are weeded out we will have fewer less than useless things.
exabrial 9y ago
Ironic how the VW engineer is going to jail... yet the middle management is escaping scot free
- jacquesm 9y ago
  The 'VW engineer going to jail' is actually an exec.
  - kogepathic 9y ago
    That's only in America. Thus far it seems that no one from VW Europe will face criminal prosecution for the scandal. Germany is too scared of hurting their economy in an election year to consider further actions against VW.
    - jacquesm 9y ago
      It goes a lot further than that, the VW saga in Germany is intricately intertwined with the political situation and since 20% of the shares are held by Lower Saxony they'd essentially invite scrutiny of their own position in the whole ordeal.
- criddell 9y ago
  I'm okay with that. Middle management can ask an engineer to do something and that engineer has a responsibility to say "no".
  - exabrial 9y ago
    That lead to my firing at a previous job :/ I think people should be held accountable for ordering engineers to do questionably ethical things like this situation
    - criddell 9y ago
      Sure. I'll never argue against holding people accountable. But even when that doesn't happen, engineers don't get to say "I was just following orders".
jl6 9y ago
Or follow the automotive model: put greater liability on the end user. End user is then obliged to pay for insurance, incentivized to pick safer suppliers, and feels the consequences of their own bad behaviour (it's not the ISP's fault that you keep opening .exe email attachments).
- wahern 9y ago
  The automotive model is split. The end user pays insurance because he's the least cost avoider for the most obvious types of accidents. And you want him to internalize the cost of such easily avoidable errors. But the producer is also regulated and required to include certain safety features because individual consumers are poorly equipped to select cars based on complex safety features. And in any event most consumers are very price sensitive; many people (perhaps most, actually) don't have the luxury of choosing a car based on safety features. seat belts, air bags, crumple zones, ABS, and rear-view cameras have all become mandatory thanks to regulation. (In some cases voluntarily with the understanding that they'd be involuntary if industry didn't cooperate). Collision avoidance systems are already scheduled to be mandatory, again by voluntary agreement. When it comes to tech, consumers just aren't sophisticated enough to know how to choose products. And the insurance industry doesn't know how to solve that problem, either. It's really only the _commercial_ insurance industry where the insurers work with the policy purchasers to help them select the safest products and procedures. Anyone who has worked in tech support knows that it's a lost cause trying to educate individual consumers.
- mysterydip 9y ago
  What about in this case? Some areas only have one internet provider. Are the users liable because they chose "have internet" over not?
- mjevans 9y ago
  How's the customer going to pick when their market, if they're lucky, has only two fixed link ISPs? When most have only one (really crappy cable one) that if they're lucky provides more than 25Mbit down and who knows what up. (Yeah it's nearly 2018 and those speeds would have been 'OK' 15 years ago.) A lot of the reason Americans are in this mess is the complete lack of competition in 99+% of the country. /That/ lack of competition comes from a broken investment model. Like roads, water/sewer, and other systems regulated as utilities the physical plant is a natural monopoly; it isn't effective for society or companies to build parallel infrastructures. If the base platform (last mile 'wires') were owned by the community and competition occurred on top of it (like with package delivery) then the context of your comment would make more sense.
mrpippy 9y ago
Agreed. I think that point was also reached with the tens of thousands of Dodge/Chrysler/Jeep car radios/head units that were wide open to the Internet over cellular. The staggering incompetence responsible up and down the chain for that should have been investigated fully and publicly, and certainly would have been if anyone had been injured/killed.
- posguy 9y ago
  Its the internet of vulnerable things! Most of which will never see an update to resolve the security vulns that crop up with time, let alone receive proper software stack maintenance for more than a brief period of time.
cmurf 9y ago
We don't yet have cybersecurity expertise in government that approaches the environmental science expertise in the EPA (or California's equivalent). And thus far we have a Congress that doesn't recognize the importance, or see a role for the government to regulate these aspects, so they just let the industry write their own rules. And so we've got exactly the system everybody who isn't a consumer wants us to have. Update: 4 of 535 members of Congress have computer science degrees.
- ktRolster 9y ago
  Update: 4 of 535 members of Congress have computer science degrees. That's higher than I expected.
  - justinjlynn 9y ago
    But is it lower than a representative sample of the population?
    - ktRolster 9y ago
      I have no idea
- colejohnson66 9y ago
  > Update: 4 of 535 members of Congress have computer science degrees. But how many of the remaining 531 know how computers work?
floatingatoll 9y ago
I agree with all of your points except one, the severity of your listed "corollary" situation: Dieselgate is tentatively assessed to have resulted in thousands of human deaths due to air pollution. AT&T modem vulnerabilities have not been assessed similarly. While I concur with everything else you've said, I encourage selecting a different example with a more evenly-matched fatality rate.
- stanleydrew 9y ago
  Why is fatality rate the only legitimate metric on which to judge prison sentences? People are put in prison for all sorts of lesser offences all the time.
  - floatingatoll 9y ago
    [Original question altered to break apart "why?" and "it shouldn't be".] Q: Is fatality rate the only legitimate metric on which to judge prison sentences? No. Fatality rate is not the sole legitimate metric. Q: Then why is fatality rate relevant? People are put in prison for all sorts of lesser offences all the time. It's a "hot-button" metric. Its use inflames emotion and skews human behavior away from rational. When drawing an analogy between two things, introducing "fatality rate" when not already present muddies the waters of conversation. If done accidentally, this can lead to serious "foot in mouth" scenarios. If done intentionally, it's typically used to encourage fearful decisions instead of careful decisions.
deleted 9y ago
[deleted]
feelin_googley 9y ago
"... someone needs to be held criminally liable for situations such as this one." What is the crime that "someone" should be charged with? In the VW case the media reports it was fraud against the government and violation of the Clean Air Act. To do what you suggest, one first needs an applicable criminal statute. What is it? (Not implying this is impossible. Only trying to focus the discussion beyond the usual rants.)
- Nomentatus 9y ago
  Great question, I agree. Criminal negligence might be one possibility; fraud in selling something not suitable for purpose might be another. Obviously it's going to be very difficult to draw such lines in the (continuous) sand; but we might as well start now. How many corners can you cut before the courts need to be involved (beyond civil lawsuits?) How much of the net do you need to imperil to trigger criminal consequences? Maybe something like certification for electronics is needed and is possible here? Where manufacturers pay for a fairly decent inspection of their work in return for a mark of inspection? (I don't mean to take a side re this particular crap-storm.)
  - ryan-c 9y ago
    AT&T doesn't sell these modems, they require customers to rent them.
    - kurthr 9y ago
      And they restrict all updates to them... those must be downloaded from AT&T. I have one.
      - ryan-c 9y ago
        They even require the damn things on their gigabit fiber service (there is a separate media converter, so it's not about the physical interface), and enforce using it by doing wired 802.1x.
- 9y ago

QUFB 9y ago

What laws would you propose to eliminate insecure software?

marcoperaza 9y ago
Bruce Schneier has speculated about creating mandatory legal liability for software vendors and service providers. Liability regimes are a major reason why physical products are so safe. https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html https://www.schneier.com/essays/archives/2003/11/liability_c...
- ryandrake 9y ago
  Say goodbye to open source, then, unless he proposes a special carve-out for it.
  - marcoperaza 9y ago
    He has some commentary on this well: https://www.schneier.com/blog/archives/2008/07/software_liabil.html https://www.schneier.com/blog/archives/2008/07/software_liab... In summary, there wouldn't be liability for open source developers because there is no business contract. But if you run a website with open source software, you of course would still be liable for anything that happens to your customers' data. So you would probably want to buy that same open source software from someone (e.g. Red Hat), who would also be liable.
    - smsm42 9y ago
      Which means, hosting/supporting open source would quickly become not worth it for any major company representing a large target for opportunistic lawyers. When you make millions from a product, you can afford a team of lawyers setting up contacts just right and fighting liability trolls. When you make zero profit, you cut the losses. Such law would spell very quick end to any corporate support of free and open source software, for liability reasons. There's a reason why all such software is accompanied with "NO WARRANTY" texts, and enforcing liability will make the corporate world to run from it. Nobody wants to be sued because they use OpenSSL and there was a vulnerability there, and that's exactly what would happen with any commercial vendor using OpenSSL if liability laws would be introduced. It doesn't matter the company didn't write OpenSSL - as soon as they use it, they are on the hook. IBM was sued not because they made Linux, but because they used it and had tons of money. And I do not see any business model that could allow companies to charge enough to cover such liabilities. Maybe for established powerhouses like Linux or for corporate foundational projects like Chrome and Darwin, but not for any lesser projects and surely not for any starting up open source with unclear revenue potential. It won't kill all open source, but it would severely hurt the ecosystem and turn it into two worlds - pure hobbyist geekery which nobody with money would touch, and formally open-source projects with strict corporate governance that has no ecosystem beyond the founding corporation. One of the worst ideas I've heard lately, and I am genuinely baffled how a person as smart and experienced as Schneier could support it.
      - marcoperaza 9y ago
        I'm not sure you're envisioning the same thing I am. You would only be liable for something that you sell or otherwise make money from. You would be free to publish software, open source or not, without incurring liability as long as you don't make money from it. Whoever then uses that software for a commercial product would be incurring the full liability, and would not be able to turn around and sue up the chain. The currently widespread practice of trusting sensitive user data to open source code without an audit (either internally or via a third-party, e.g. Red Hat) is horrifying and incredibly negligent.
        9y ago
  - JoshTriplett 9y ago
    I've actually had discussions with several people, separately and at a legal summit that specifically discussed the topic of software liability, that proposed a good solution to this: Make the liability proportional to the degree to which you've given them the degree to find and fix any issues that might arise. If you give someone FOSS software to solve some particular problem, even a potentially-high-liability problem, you've given them everything they need to both analyze the software for potential issues, and fix them themselves. (Auto manufacturers like FOSS because it means they can always support it themselves if the vendor won't, and they have far longer support lifetimes than many other products.) So disclaiming all liability there seems reasonable, for anything short of intentional malice (e.g. backdoors). On the other hand, if you give someone a piece of opaque proprietary software, then you're selling them a solution to a problem, and it'd better work because they can't do anything but go to you if it doesn't. They also can't introspect it, and black-box testing only goes so far. So this should increase liability. Even more so if you supply it in an obfuscated form that's difficult to reverse-engineer or test, or if you lock it down to make it irreplaceable. The same thing would go for changing software yourself, on a high-liability device. If you don't change it, it's not your fault; if you change it, it might be your fault.
    - sitharus 9y ago
      New Zealand consumer law has a requirement that goods must be 'fit for purpose'. This means that if a company sells you a clothes washer for example it must clean clothes, but if you try to wash your shoes and it breaks it's not the manufacturer's fault (unless they said it could of course). I think something like this could apply very well to software. If someone uploads source code to github they haven't sold it to you with any purpose in mind, but commercial sales have functionality promises so they could be held to them.
      - DannyBee 9y ago
        warranty of merchantability and fitness for a particular purpose exist in the US. Whether it can be disclaimed is per-state though. (Some states allow disclaiming implied warranties, some do not).
- trapperkeeper74 9y ago
  Another, less chilling effects way would be to have an Underwriters' Laboratories (UL) or CE for software. Any government, company or customer could then have that as a requirement.
  - marcoperaza 9y ago
    That's what would effectively emerge from the liability system. Companies would buy insurance from liability, and the insurance companies would demand some kind of certification process.
  - kabdib 9y ago
    Certification programs, when they exist, tend to become political creatures and tools of destruction. You wind up with byzantine and arbitrary rules, often put in place for horse-trading reasons, often to exclude competition and drive up prices. Want a seat at the standards table? Pony up tons of time, plenty of money for travel to cities where meetings are held, and be prepared for the big software consulting firms to crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. Want to contribute to Python? Sure hope you have that degree, plus an engineering certificate from your local/state/national government. Your dues are paid up and you've passed the most recent set of exams, right? Oh, and let's talk about your toolchain. You can license a certified compiler for $15,000 a seat. Per year. I can't imagine anything more chilling, other than an outright ban on people writing software.
    - colejohnson66 9y ago
      > ...crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. And good luck knowing what the actual requirements of that standard are; PDFs of ISO standards cost hundreds of dollars.
      - kabdib 9y ago
        Yup, that's part of the racket.
- travmatt 9y ago
  I believe Dan Geer also gave a keynote a year or so ago at Blackhat (or Defcon) arguing for a similar framework.
kogepathic 9y ago
CTO is criminally liable for technical breaches involving their company. They're supposed to be responsible for this anyway, but given that at worst they receive a slap on the wrist and their company gets fined, clearly more needs to be done. You might counter: well no one will be willing to be CTO if it involves such personal risk. I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough, or they can show sufficient due diligence that they won't end up in jail. I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure and not a minimum viable product full of holes like this.
- jacquesm 9y ago
  > well no one will be willing to be CTO if it involves such personal risk. Of course they would. Compensation would go up and the good ones would be readily employed. The hard part would be to make such liability stick.
- smsm42 9y ago
  > CTO is criminally liable for technical breaches involving their company Which means CTOs would have huge incentive to conceal such breaches and persecute anybody who would report them. Also, CTOs would require huge money to cover the risks, and probably wide insurance coverage like medical malpractice insurance. Which is five-figure number at least. I wonder which startup could afford that. > I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough They surely can spend money on lawyers writing tricky contracts and acquiring various expensive certifications. As for whether it'd make their software any more secure - this is much more doubtful. > I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure That implicitly assumes right now the problem in software being insecure is because not enough money is spent on it, and if software would be more expensive, it would be more secure. This assumption does not seem to be true.
Nursie 9y ago
Depends, but there's insecurity by bad design, or bad implementation, and then there's stuff like this. I would say that some sort of negligence laws would be appropriate here, with a defence being that good practice was followed. Accidents will happen even with the best of intent; but there's a line somewhere.
jacquesm 9y ago
Step 1 is mandatory reporting of breaches. Step 2 would be the creation of an actual software engineering profession complete with the equivalent of the 'iron ring' and a pledge to go with it. Maybe the ring could be made of ferrite ;) Step 3 is attaching a figure to compensating victims of breaches over and beyond some credit score bs. Step 4 would be actual legal liability for service providers and shrink wrap software manufacturers which they could not get you to waive. Step 5 would be criminal liability for producers of faulty software and especially the management layers above them. Applied sequentially until it starts to hurt would improve software quality in a hurry and would most likely result in massive retraining of a large number of people now employed as programmers as well as their management.
- protomyth 9y ago
  In your scenario, does all software now requires a certified software engineer?
  - jacquesm 9y ago
    No, you're fine to do whatever you want. But companies will likely want to hire people that reduce their exposure to lawsuits that will stick. So if your software is going to affect lives and you feel that you can handle the fall-out in case it does not and you are not certified then you're more than welcome to make that combination work.
    - protomyth 9y ago
      So, basically no non-certified programmers because Apple, etc. will just not give you a developer certificate because of a possible lawsuit.
      - jacquesm 9y ago
        Apple isn't in the business of providing critical software where such liability would make much sense beyond when: (1) their phones given enough charge refuse to call 9/11 as mandated by law at the present anyway (2) their authentication details are leaked (3) their operating systems suffer security bugs At most other levels the damage could easily be contained. Note that even at present they could be sued for any and all of the above, whether such a lawsuit is winnable is beyond my expertise to evaluate but it would certainly be interesting to see the arguments both sides put forth. So plenty of opportunity to be employed for 'non certified programmers'. Note that almost every big software provider already has a certification program of sorts but at the moment these are just used as either a revenue stream or a way to get people to invest in the eco system.
deleted 9y ago
[deleted]
_rpd 9y ago
A few professional negligence lawsuits wouldn't hurt.
tejtm 9y ago
Laws that stripped resources from share holders. Blaming a programmer for a culture they are not responsible for creating or maintaining is far too late in the process. If a venture has no reason to exist if cannot produce secure products a culture of building secure products will emerge. It may be that every MBA with a NDA will not be able to afford the competent programmers required, but as they are weeded out we will have fewer less than useless things.

exabrial 9y ago

Ironic how the VW engineer is going to jail... yet the middle management is escaping scot free

jacquesm 9y ago
The 'VW engineer going to jail' is actually an exec.
- kogepathic 9y ago
  That's only in America. Thus far it seems that no one from VW Europe will face criminal prosecution for the scandal. Germany is too scared of hurting their economy in an election year to consider further actions against VW.
  - jacquesm 9y ago
    It goes a lot further than that, the VW saga in Germany is intricately intertwined with the political situation and since 20% of the shares are held by Lower Saxony they'd essentially invite scrutiny of their own position in the whole ordeal.
criddell 9y ago
I'm okay with that. Middle management can ask an engineer to do something and that engineer has a responsibility to say "no".
- exabrial 9y ago
  That lead to my firing at a previous job :/ I think people should be held accountable for ordering engineers to do questionably ethical things like this situation
  - criddell 9y ago
    Sure. I'll never argue against holding people accountable. But even when that doesn't happen, engineers don't get to say "I was just following orders".

jl6 9y ago

Or follow the automotive model: put greater liability on the end user. End user is then obliged to pay for insurance, incentivized to pick safer suppliers, and feels the consequences of their own bad behaviour (it's not the ISP's fault that you keep opening .exe email attachments).

wahern 9y ago
The automotive model is split. The end user pays insurance because he's the least cost avoider for the most obvious types of accidents. And you want him to internalize the cost of such easily avoidable errors. But the producer is also regulated and required to include certain safety features because individual consumers are poorly equipped to select cars based on complex safety features. And in any event most consumers are very price sensitive; many people (perhaps most, actually) don't have the luxury of choosing a car based on safety features. seat belts, air bags, crumple zones, ABS, and rear-view cameras have all become mandatory thanks to regulation. (In some cases voluntarily with the understanding that they'd be involuntary if industry didn't cooperate). Collision avoidance systems are already scheduled to be mandatory, again by voluntary agreement. When it comes to tech, consumers just aren't sophisticated enough to know how to choose products. And the insurance industry doesn't know how to solve that problem, either. It's really only the _commercial_ insurance industry where the insurers work with the policy purchasers to help them select the safest products and procedures. Anyone who has worked in tech support knows that it's a lost cause trying to educate individual consumers.
mysterydip 9y ago
What about in this case? Some areas only have one internet provider. Are the users liable because they chose "have internet" over not?
mjevans 9y ago
How's the customer going to pick when their market, if they're lucky, has only two fixed link ISPs? When most have only one (really crappy cable one) that if they're lucky provides more than 25Mbit down and who knows what up. (Yeah it's nearly 2018 and those speeds would have been 'OK' 15 years ago.) A lot of the reason Americans are in this mess is the complete lack of competition in 99+% of the country. /That/ lack of competition comes from a broken investment model. Like roads, water/sewer, and other systems regulated as utilities the physical plant is a natural monopoly; it isn't effective for society or companies to build parallel infrastructures. If the base platform (last mile 'wires') were owned by the community and competition occurred on top of it (like with package delivery) then the context of your comment would make more sense.

mrpippy 9y ago

Agreed. I think that point was also reached with the tens of thousands of Dodge/Chrysler/Jeep car radios/head units that were wide open to the Internet over cellular. The staggering incompetence responsible up and down the chain for that should have been investigated fully and publicly, and certainly would have been if anyone had been injured/killed.

posguy 9y ago
Its the internet of vulnerable things! Most of which will never see an update to resolve the security vulns that crop up with time, let alone receive proper software stack maintenance for more than a brief period of time.

cmurf 9y ago

We don't yet have cybersecurity expertise in government that approaches the environmental science expertise in the EPA (or California's equivalent). And thus far we have a Congress that doesn't recognize the importance, or see a role for the government to regulate these aspects, so they just let the industry write their own rules. And so we've got exactly the system everybody who isn't a consumer wants us to have. Update: 4 of 535 members of Congress have computer science degrees.

ktRolster 9y ago
Update: 4 of 535 members of Congress have computer science degrees. That's higher than I expected.
- justinjlynn 9y ago
  But is it lower than a representative sample of the population?
  - ktRolster 9y ago
    I have no idea
colejohnson66 9y ago
> Update: 4 of 535 members of Congress have computer science degrees. But how many of the remaining 531 know how computers work?

floatingatoll 9y ago

I agree with all of your points except one, the severity of your listed "corollary" situation: Dieselgate is tentatively assessed to have resulted in thousands of human deaths due to air pollution. AT&T modem vulnerabilities have not been assessed similarly. While I concur with everything else you've said, I encourage selecting a different example with a more evenly-matched fatality rate.

stanleydrew 9y ago
Why is fatality rate the only legitimate metric on which to judge prison sentences? People are put in prison for all sorts of lesser offences all the time.
- floatingatoll 9y ago
  [Original question altered to break apart "why?" and "it shouldn't be".] Q: Is fatality rate the only legitimate metric on which to judge prison sentences? No. Fatality rate is not the sole legitimate metric. Q: Then why is fatality rate relevant? People are put in prison for all sorts of lesser offences all the time. It's a "hot-button" metric. Its use inflames emotion and skews human behavior away from rational. When drawing an analogy between two things, introducing "fatality rate" when not already present muddies the waters of conversation. If done accidentally, this can lead to serious "foot in mouth" scenarios. If done intentionally, it's typically used to encourage fearful decisions instead of careful decisions.

deleted 9y ago

[deleted]

feelin_googley 9y ago

"... someone needs to be held criminally liable for situations such as this one." What is the crime that "someone" should be charged with? In the VW case the media reports it was fraud against the government and violation of the Clean Air Act. To do what you suggest, one first needs an applicable criminal statute. What is it? (Not implying this is impossible. Only trying to focus the discussion beyond the usual rants.)

Nomentatus 9y ago
Great question, I agree. Criminal negligence might be one possibility; fraud in selling something not suitable for purpose might be another. Obviously it's going to be very difficult to draw such lines in the (continuous) sand; but we might as well start now. How many corners can you cut before the courts need to be involved (beyond civil lawsuits?) How much of the net do you need to imperil to trigger criminal consequences? Maybe something like certification for electronics is needed and is possible here? Where manufacturers pay for a fairly decent inspection of their work in return for a mark of inspection? (I don't mean to take a side re this particular crap-storm.)
- ryan-c 9y ago
  AT&T doesn't sell these modems, they require customers to rent them.
  - kurthr 9y ago
    And they restrict all updates to them... those must be downloaded from AT&T. I have one.
    - ryan-c 9y ago
      They even require the damn things on their gigabit fiber service (there is a separate media converter, so it's not about the physical interface), and enforce using it by doing wired 802.1x.
9y ago