7 ms·

What laws would you propose to eliminate insecure software?

by QUFB 9y ago

marcoperaza 9y ago
Bruce Schneier has speculated about creating mandatory legal liability for software vendors and service providers. Liability regimes are a major reason why physical products are so safe. https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html https://www.schneier.com/essays/archives/2003/11/liability_c...
- ryandrake 9y ago
  Say goodbye to open source, then, unless he proposes a special carve-out for it.
  - marcoperaza 9y ago
    He has some commentary on this well: https://www.schneier.com/blog/archives/2008/07/software_liabil.html https://www.schneier.com/blog/archives/2008/07/software_liab... In summary, there wouldn't be liability for open source developers because there is no business contract. But if you run a website with open source software, you of course would still be liable for anything that happens to your customers' data. So you would probably want to buy that same open source software from someone (e.g. Red Hat), who would also be liable.
    - smsm42 9y ago
      Which means, hosting/supporting open source would quickly become not worth it for any major company representing a large target for opportunistic lawyers. When you make millions from a product, you can afford a team of lawyers setting up contacts just right and fighting liability trolls. When you make zero profit, you cut the losses. Such law would spell very quick end to any corporate support of free and open source software, for liability reasons. There's a reason why all such software is accompanied with "NO WARRANTY" texts, and enforcing liability will make the corporate world to run from it. Nobody wants to be sued because they use OpenSSL and there was a vulnerability there, and that's exactly what would happen with any commercial vendor using OpenSSL if liability laws would be introduced. It doesn't matter the company didn't write OpenSSL - as soon as they use it, they are on the hook. IBM was sued not because they made Linux, but because they used it and had tons of money. And I do not see any business model that could allow companies to charge enough to cover such liabilities. Maybe for established powerhouses like Linux or for corporate foundational projects like Chrome and Darwin, but not for any lesser projects and surely not for any starting up open source with unclear revenue potential. It won't kill all open source, but it would severely hurt the ecosystem and turn it into two worlds - pure hobbyist geekery which nobody with money would touch, and formally open-source projects with strict corporate governance that has no ecosystem beyond the founding corporation. One of the worst ideas I've heard lately, and I am genuinely baffled how a person as smart and experienced as Schneier could support it.
      - marcoperaza 9y ago
        I'm not sure you're envisioning the same thing I am. You would only be liable for something that you sell or otherwise make money from. You would be free to publish software, open source or not, without incurring liability as long as you don't make money from it. Whoever then uses that software for a commercial product would be incurring the full liability, and would not be able to turn around and sue up the chain. The currently widespread practice of trusting sensitive user data to open source code without an audit (either internally or via a third-party, e.g. Red Hat) is horrifying and incredibly negligent.
        smsm42 9y ago
        > You would only be liable for something that you sell or otherwise make money from If your business includes software in any meaningful function, you are making money from it. Any competent lawyer would be able to successfully argue that. Charging money for a license is not the only way, otherwise everybody would just switch to charging for "consultancy service", which coincidentally provides free software license, and avoid any liability. > You would be free to publish software, open source or not, without incurring liability as long as you don't make money from it. You as a private person would be. That's my point - that would be the only way to do open source, any corporate support of open source projects would imply full liability, which would be impossible for a product the company gets to revenue from. It would be much harder for a business to justify supporting an open source project when liability costs are added to the equation. > The currently widespread practice of trusting sensitive user data to open source code without an audit (either internally or via a third-party, e.g. Red Hat) is horrifying Audits cost money. Tons of money. And they don't guarantee anything - bugs in OpenSSL have not been discovered for years despite thousands of people using the code, poring over it and billions depending on it. There's no magic in "audit" that allows code to be bug-free after it - if there was such a magical procedure people would already be using it, but there's no indication anybody has invented "audit" procedure that allows to eliminate all bugs. Existing flawed procedures are already being used - every company that produces software that I ever heard about uses them - and they are not enough. So what would happen is drastically raising the costs (to the point where having a website would no longer be affordable to an average person) while not significantly improving security.
    - icelancer 9y ago
      >>But if you run a website with open source software, you of course would still be liable for anything that happens to your customers' data. So you would probably want to buy that same open source software from someone (e.g. Red Hat), who would also be liable. As others have said, this idea is really bad. Red Hat will start charging obscene amounts to support the legal side of the license, especially if it is used in eCommerce platforms. What about the wife and husband who want to sell hand-knitted socks online, or small businesses who do less than $250k/year online? Will they be able to afford an alternative to the LAMP stack and fully shield themselves from legal liability and the horde of lawyers who will gladly step into any loophole? Like many, my servers were affected by Heartbleed. So if I ran OpenSSL and someone found out before I patched it (took me 24h to do so), I could be sued in that window if I hadn't bought the license to Red Hat - oh, and how about all the licenses to all the open source software that depends on it underneath, OpenSSL being one of about a hundred of those projects? Do we license GNU toolchain? What if there are buffer overflow exploits found in various tools?
      - Xylakant 9y ago
        > What about the wife and husband who want to sell hand-knitted socks online, or small businesses who do less than $250k/year online? Will they be able to afford an alternative to the LAMP stack and fully shield themselves from legal liability and the horde of lawyers who will gladly step into any loophole? If mom and pop want to sell hand-knitted socks on the internet I usually recommend them to use a hosted shop solution such as shopify and its ilk. They want to sell socks, not become an expert in hosting a LAMP stack. This is how liability works for brick and mortar stores as well: They're liable if a customer electrocutes himself because some dork attached the wrong wire to the wrong metal part. That's why mom and pop stores in the brick and mortar part of the world usually don't do the electrical installation or any parts that's covered under a builder code. They hire people supposed to be experts in that field to do that work and in in turn, they get to discharge the liability to them. It's about time we treat software the same. If you want to host something, either own up to it or hire someone to do it.
  - JoshTriplett 9y ago
    I've actually had discussions with several people, separately and at a legal summit that specifically discussed the topic of software liability, that proposed a good solution to this: Make the liability proportional to the degree to which you've given them the degree to find and fix any issues that might arise. If you give someone FOSS software to solve some particular problem, even a potentially-high-liability problem, you've given them everything they need to both analyze the software for potential issues, and fix them themselves. (Auto manufacturers like FOSS because it means they can always support it themselves if the vendor won't, and they have far longer support lifetimes than many other products.) So disclaiming all liability there seems reasonable, for anything short of intentional malice (e.g. backdoors). On the other hand, if you give someone a piece of opaque proprietary software, then you're selling them a solution to a problem, and it'd better work because they can't do anything but go to you if it doesn't. They also can't introspect it, and black-box testing only goes so far. So this should increase liability. Even more so if you supply it in an obfuscated form that's difficult to reverse-engineer or test, or if you lock it down to make it irreplaceable. The same thing would go for changing software yourself, on a high-liability device. If you don't change it, it's not your fault; if you change it, it might be your fault.
    - sitharus 9y ago
      New Zealand consumer law has a requirement that goods must be 'fit for purpose'. This means that if a company sells you a clothes washer for example it must clean clothes, but if you try to wash your shoes and it breaks it's not the manufacturer's fault (unless they said it could of course). I think something like this could apply very well to software. If someone uploads source code to github they haven't sold it to you with any purpose in mind, but commercial sales have functionality promises so they could be held to them.
      - DannyBee 9y ago
        warranty of merchantability and fitness for a particular purpose exist in the US. Whether it can be disclaimed is per-state though. (Some states allow disclaiming implied warranties, some do not).
- trapperkeeper74 9y ago
  Another, less chilling effects way would be to have an Underwriters' Laboratories (UL) or CE for software. Any government, company or customer could then have that as a requirement.
  - marcoperaza 9y ago
    That's what would effectively emerge from the liability system. Companies would buy insurance from liability, and the insurance companies would demand some kind of certification process.
  - kabdib 9y ago
    Certification programs, when they exist, tend to become political creatures and tools of destruction. You wind up with byzantine and arbitrary rules, often put in place for horse-trading reasons, often to exclude competition and drive up prices. Want a seat at the standards table? Pony up tons of time, plenty of money for travel to cities where meetings are held, and be prepared for the big software consulting firms to crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. Want to contribute to Python? Sure hope you have that degree, plus an engineering certificate from your local/state/national government. Your dues are paid up and you've passed the most recent set of exams, right? Oh, and let's talk about your toolchain. You can license a certified compiler for $15,000 a seat. Per year. I can't imagine anything more chilling, other than an outright ban on people writing software.
    - colejohnson66 9y ago
      > ...crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. And good luck knowing what the actual requirements of that standard are; PDFs of ISO standards cost hundreds of dollars.
      - kabdib 9y ago
        Yup, that's part of the racket.
- travmatt 9y ago
  I believe Dan Geer also gave a keynote a year or so ago at Blackhat (or Defcon) arguing for a similar framework.
kogepathic 9y ago
CTO is criminally liable for technical breaches involving their company. They're supposed to be responsible for this anyway, but given that at worst they receive a slap on the wrist and their company gets fined, clearly more needs to be done. You might counter: well no one will be willing to be CTO if it involves such personal risk. I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough, or they can show sufficient due diligence that they won't end up in jail. I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure and not a minimum viable product full of holes like this.
- jacquesm 9y ago
  > well no one will be willing to be CTO if it involves such personal risk. Of course they would. Compensation would go up and the good ones would be readily employed. The hard part would be to make such liability stick.
- smsm42 9y ago
  > CTO is criminally liable for technical breaches involving their company Which means CTOs would have huge incentive to conceal such breaches and persecute anybody who would report them. Also, CTOs would require huge money to cover the risks, and probably wide insurance coverage like medical malpractice insurance. Which is five-figure number at least. I wonder which startup could afford that. > I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough They surely can spend money on lawyers writing tricky contracts and acquiring various expensive certifications. As for whether it'd make their software any more secure - this is much more doubtful. > I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure That implicitly assumes right now the problem in software being insecure is because not enough money is spent on it, and if software would be more expensive, it would be more secure. This assumption does not seem to be true.
Nursie 9y ago
Depends, but there's insecurity by bad design, or bad implementation, and then there's stuff like this. I would say that some sort of negligence laws would be appropriate here, with a defence being that good practice was followed. Accidents will happen even with the best of intent; but there's a line somewhere.
jacquesm 9y ago
Step 1 is mandatory reporting of breaches. Step 2 would be the creation of an actual software engineering profession complete with the equivalent of the 'iron ring' and a pledge to go with it. Maybe the ring could be made of ferrite ;) Step 3 is attaching a figure to compensating victims of breaches over and beyond some credit score bs. Step 4 would be actual legal liability for service providers and shrink wrap software manufacturers which they could not get you to waive. Step 5 would be criminal liability for producers of faulty software and especially the management layers above them. Applied sequentially until it starts to hurt would improve software quality in a hurry and would most likely result in massive retraining of a large number of people now employed as programmers as well as their management.
- protomyth 9y ago
  In your scenario, does all software now requires a certified software engineer?
  - jacquesm 9y ago
    No, you're fine to do whatever you want. But companies will likely want to hire people that reduce their exposure to lawsuits that will stick. So if your software is going to affect lives and you feel that you can handle the fall-out in case it does not and you are not certified then you're more than welcome to make that combination work.
    - protomyth 9y ago
      So, basically no non-certified programmers because Apple, etc. will just not give you a developer certificate because of a possible lawsuit.
      - jacquesm 9y ago
        Apple isn't in the business of providing critical software where such liability would make much sense beyond when: (1) their phones given enough charge refuse to call 9/11 as mandated by law at the present anyway (2) their authentication details are leaked (3) their operating systems suffer security bugs At most other levels the damage could easily be contained. Note that even at present they could be sued for any and all of the above, whether such a lawsuit is winnable is beyond my expertise to evaluate but it would certainly be interesting to see the arguments both sides put forth. So plenty of opportunity to be employed for 'non certified programmers'. Note that almost every big software provider already has a certification program of sorts but at the moment these are just used as either a revenue stream or a way to get people to invest in the eco system.
deleted 9y ago
[deleted]
_rpd 9y ago
A few professional negligence lawsuits wouldn't hurt.
tejtm 9y ago
Laws that stripped resources from share holders. Blaming a programmer for a culture they are not responsible for creating or maintaining is far too late in the process. If a venture has no reason to exist if cannot produce secure products a culture of building secure products will emerge. It may be that every MBA with a NDA will not be able to afford the competent programmers required, but as they are weeded out we will have fewer less than useless things.

What laws would you propose to eliminate insecure software?

by QUFB 9y ago

What laws would you propose to eliminate insecure software?

Bruce Schneier has speculated about creating mandatory legal liability for software vendors and service providers. Liability regimes are a major reason why physical products are so safe. https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html https://www.schneier.com/essays/archives/2003/11/liability_c...

ryandrake 9y ago
Say goodbye to open source, then, unless he proposes a special carve-out for it.
- marcoperaza 9y ago
  He has some commentary on this well: https://www.schneier.com/blog/archives/2008/07/software_liabil.html https://www.schneier.com/blog/archives/2008/07/software_liab... In summary, there wouldn't be liability for open source developers because there is no business contract. But if you run a website with open source software, you of course would still be liable for anything that happens to your customers' data. So you would probably want to buy that same open source software from someone (e.g. Red Hat), who would also be liable.
  - smsm42 9y ago
    Which means, hosting/supporting open source would quickly become not worth it for any major company representing a large target for opportunistic lawyers. When you make millions from a product, you can afford a team of lawyers setting up contacts just right and fighting liability trolls. When you make zero profit, you cut the losses. Such law would spell very quick end to any corporate support of free and open source software, for liability reasons. There's a reason why all such software is accompanied with "NO WARRANTY" texts, and enforcing liability will make the corporate world to run from it. Nobody wants to be sued because they use OpenSSL and there was a vulnerability there, and that's exactly what would happen with any commercial vendor using OpenSSL if liability laws would be introduced. It doesn't matter the company didn't write OpenSSL - as soon as they use it, they are on the hook. IBM was sued not because they made Linux, but because they used it and had tons of money. And I do not see any business model that could allow companies to charge enough to cover such liabilities. Maybe for established powerhouses like Linux or for corporate foundational projects like Chrome and Darwin, but not for any lesser projects and surely not for any starting up open source with unclear revenue potential. It won't kill all open source, but it would severely hurt the ecosystem and turn it into two worlds - pure hobbyist geekery which nobody with money would touch, and formally open-source projects with strict corporate governance that has no ecosystem beyond the founding corporation. One of the worst ideas I've heard lately, and I am genuinely baffled how a person as smart and experienced as Schneier could support it.
    - marcoperaza 9y ago
      I'm not sure you're envisioning the same thing I am. You would only be liable for something that you sell or otherwise make money from. You would be free to publish software, open source or not, without incurring liability as long as you don't make money from it. Whoever then uses that software for a commercial product would be incurring the full liability, and would not be able to turn around and sue up the chain. The currently widespread practice of trusting sensitive user data to open source code without an audit (either internally or via a third-party, e.g. Red Hat) is horrifying and incredibly negligent.
      - smsm42 9y ago
        > You would only be liable for something that you sell or otherwise make money from If your business includes software in any meaningful function, you are making money from it. Any competent lawyer would be able to successfully argue that. Charging money for a license is not the only way, otherwise everybody would just switch to charging for "consultancy service", which coincidentally provides free software license, and avoid any liability. > You would be free to publish software, open source or not, without incurring liability as long as you don't make money from it. You as a private person would be. That's my point - that would be the only way to do open source, any corporate support of open source projects would imply full liability, which would be impossible for a product the company gets to revenue from. It would be much harder for a business to justify supporting an open source project when liability costs are added to the equation. > The currently widespread practice of trusting sensitive user data to open source code without an audit (either internally or via a third-party, e.g. Red Hat) is horrifying Audits cost money. Tons of money. And they don't guarantee anything - bugs in OpenSSL have not been discovered for years despite thousands of people using the code, poring over it and billions depending on it. There's no magic in "audit" that allows code to be bug-free after it - if there was such a magical procedure people would already be using it, but there's no indication anybody has invented "audit" procedure that allows to eliminate all bugs. Existing flawed procedures are already being used - every company that produces software that I ever heard about uses them - and they are not enough. So what would happen is drastically raising the costs (to the point where having a website would no longer be affordable to an average person) while not significantly improving security.
  - icelancer 9y ago
    >>But if you run a website with open source software, you of course would still be liable for anything that happens to your customers' data. So you would probably want to buy that same open source software from someone (e.g. Red Hat), who would also be liable. As others have said, this idea is really bad. Red Hat will start charging obscene amounts to support the legal side of the license, especially if it is used in eCommerce platforms. What about the wife and husband who want to sell hand-knitted socks online, or small businesses who do less than $250k/year online? Will they be able to afford an alternative to the LAMP stack and fully shield themselves from legal liability and the horde of lawyers who will gladly step into any loophole? Like many, my servers were affected by Heartbleed. So if I ran OpenSSL and someone found out before I patched it (took me 24h to do so), I could be sued in that window if I hadn't bought the license to Red Hat - oh, and how about all the licenses to all the open source software that depends on it underneath, OpenSSL being one of about a hundred of those projects? Do we license GNU toolchain? What if there are buffer overflow exploits found in various tools?
    - Xylakant 9y ago
      > What about the wife and husband who want to sell hand-knitted socks online, or small businesses who do less than $250k/year online? Will they be able to afford an alternative to the LAMP stack and fully shield themselves from legal liability and the horde of lawyers who will gladly step into any loophole? If mom and pop want to sell hand-knitted socks on the internet I usually recommend them to use a hosted shop solution such as shopify and its ilk. They want to sell socks, not become an expert in hosting a LAMP stack. This is how liability works for brick and mortar stores as well: They're liable if a customer electrocutes himself because some dork attached the wrong wire to the wrong metal part. That's why mom and pop stores in the brick and mortar part of the world usually don't do the electrical installation or any parts that's covered under a builder code. They hire people supposed to be experts in that field to do that work and in in turn, they get to discharge the liability to them. It's about time we treat software the same. If you want to host something, either own up to it or hire someone to do it.
- JoshTriplett 9y ago
  I've actually had discussions with several people, separately and at a legal summit that specifically discussed the topic of software liability, that proposed a good solution to this: Make the liability proportional to the degree to which you've given them the degree to find and fix any issues that might arise. If you give someone FOSS software to solve some particular problem, even a potentially-high-liability problem, you've given them everything they need to both analyze the software for potential issues, and fix them themselves. (Auto manufacturers like FOSS because it means they can always support it themselves if the vendor won't, and they have far longer support lifetimes than many other products.) So disclaiming all liability there seems reasonable, for anything short of intentional malice (e.g. backdoors). On the other hand, if you give someone a piece of opaque proprietary software, then you're selling them a solution to a problem, and it'd better work because they can't do anything but go to you if it doesn't. They also can't introspect it, and black-box testing only goes so far. So this should increase liability. Even more so if you supply it in an obfuscated form that's difficult to reverse-engineer or test, or if you lock it down to make it irreplaceable. The same thing would go for changing software yourself, on a high-liability device. If you don't change it, it's not your fault; if you change it, it might be your fault.
  - sitharus 9y ago
    New Zealand consumer law has a requirement that goods must be 'fit for purpose'. This means that if a company sells you a clothes washer for example it must clean clothes, but if you try to wash your shoes and it breaks it's not the manufacturer's fault (unless they said it could of course). I think something like this could apply very well to software. If someone uploads source code to github they haven't sold it to you with any purpose in mind, but commercial sales have functionality promises so they could be held to them.
    - DannyBee 9y ago
      warranty of merchantability and fitness for a particular purpose exist in the US. Whether it can be disclaimed is per-state though. (Some states allow disclaiming implied warranties, some do not).
trapperkeeper74 9y ago
Another, less chilling effects way would be to have an Underwriters' Laboratories (UL) or CE for software. Any government, company or customer could then have that as a requirement.
- marcoperaza 9y ago
  That's what would effectively emerge from the liability system. Companies would buy insurance from liability, and the insurance companies would demand some kind of certification process.
- kabdib 9y ago
  Certification programs, when they exist, tend to become political creatures and tools of destruction. You wind up with byzantine and arbitrary rules, often put in place for horse-trading reasons, often to exclude competition and drive up prices. Want a seat at the standards table? Pony up tons of time, plenty of money for travel to cities where meetings are held, and be prepared for the big software consulting firms to crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. Want to contribute to Python? Sure hope you have that degree, plus an engineering certificate from your local/state/national government. Your dues are paid up and you've passed the most recent set of exams, right? Oh, and let's talk about your toolchain. You can license a certified compiler for $15,000 a seat. Per year. I can't imagine anything more chilling, other than an outright ban on people writing software.
  - colejohnson66 9y ago
    > ...crush you anyway with requirements like ISO-<somethingStartingWith9> before you can make a project on github public. And good luck knowing what the actual requirements of that standard are; PDFs of ISO standards cost hundreds of dollars.
    - kabdib 9y ago
      Yup, that's part of the racket.
travmatt 9y ago
I believe Dan Geer also gave a keynote a year or so ago at Blackhat (or Defcon) arguing for a similar framework.

kogepathic 9y ago

CTO is criminally liable for technical breaches involving their company. They're supposed to be responsible for this anyway, but given that at worst they receive a slap on the wrist and their company gets fined, clearly more needs to be done. You might counter: well no one will be willing to be CTO if it involves such personal risk. I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough, or they can show sufficient due diligence that they won't end up in jail. I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure and not a minimum viable product full of holes like this.

jacquesm 9y ago
> well no one will be willing to be CTO if it involves such personal risk. Of course they would. Compensation would go up and the good ones would be readily employed. The hard part would be to make such liability stick.
smsm42 9y ago
> CTO is criminally liable for technical breaches involving their company Which means CTOs would have huge incentive to conceal such breaches and persecute anybody who would report them. Also, CTOs would require huge money to cover the risks, and probably wide insurance coverage like medical malpractice insurance. Which is five-figure number at least. I wonder which startup could afford that. > I would counter: companies will find a way, through certification or lawyers, of ensuring that their products are secure enough They surely can spend money on lawyers writing tricky contracts and acquiring various expensive certifications. As for whether it'd make their software any more secure - this is much more doubtful. > I personally think making execs criminally liable for this kind of insecurity would really force companies to start spending money on ensuring they ship something secure That implicitly assumes right now the problem in software being insecure is because not enough money is spent on it, and if software would be more expensive, it would be more secure. This assumption does not seem to be true.

Nursie 9y ago

Depends, but there's insecurity by bad design, or bad implementation, and then there's stuff like this. I would say that some sort of negligence laws would be appropriate here, with a defence being that good practice was followed. Accidents will happen even with the best of intent; but there's a line somewhere.

jacquesm 9y ago

Step 1 is mandatory reporting of breaches. Step 2 would be the creation of an actual software engineering profession complete with the equivalent of the 'iron ring' and a pledge to go with it. Maybe the ring could be made of ferrite ;) Step 3 is attaching a figure to compensating victims of breaches over and beyond some credit score bs. Step 4 would be actual legal liability for service providers and shrink wrap software manufacturers which they could not get you to waive. Step 5 would be criminal liability for producers of faulty software and especially the management layers above them. Applied sequentially until it starts to hurt would improve software quality in a hurry and would most likely result in massive retraining of a large number of people now employed as programmers as well as their management.

protomyth 9y ago
In your scenario, does all software now requires a certified software engineer?
- jacquesm 9y ago
  No, you're fine to do whatever you want. But companies will likely want to hire people that reduce their exposure to lawsuits that will stick. So if your software is going to affect lives and you feel that you can handle the fall-out in case it does not and you are not certified then you're more than welcome to make that combination work.
  - protomyth 9y ago
    So, basically no non-certified programmers because Apple, etc. will just not give you a developer certificate because of a possible lawsuit.
    - jacquesm 9y ago
      Apple isn't in the business of providing critical software where such liability would make much sense beyond when: (1) their phones given enough charge refuse to call 9/11 as mandated by law at the present anyway (2) their authentication details are leaked (3) their operating systems suffer security bugs At most other levels the damage could easily be contained. Note that even at present they could be sued for any and all of the above, whether such a lawsuit is winnable is beyond my expertise to evaluate but it would certainly be interesting to see the arguments both sides put forth. So plenty of opportunity to be employed for 'non certified programmers'. Note that almost every big software provider already has a certification program of sorts but at the moment these are just used as either a revenue stream or a way to get people to invest in the eco system.

deleted 9y ago

[deleted]

_rpd 9y ago

A few professional negligence lawsuits wouldn't hurt.

tejtm 9y ago

Laws that stripped resources from share holders. Blaming a programmer for a culture they are not responsible for creating or maintaining is far too late in the process. If a venture has no reason to exist if cannot produce secure products a culture of building secure products will emerge. It may be that every MBA with a NDA will not be able to afford the competent programmers required, but as they are weeded out we will have fewer less than useless things.