5 ms·

>software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. TIL: No warranty == impunity. Nobody

by danjoc 9y ago

>software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. TIL: No warranty == impunity. Nobody MADE Equifax use Struts. The source is open to inspection. The bug existed there for 8 years. Let's see how many audits Equifax did on the source code with no warranty. >If the costs of failure in production due to bugs were higher, businesses would make different decisions in hiring and how much time was dedicated to security and bug fixing. Do you disagree? If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software. He'd find a different line of work. If he did write it, he would never release it for the world to use for free. Who would do that? "Here's this thing I worked on for over a decade. You can use it for free. Please sue me if you have any issues. Thanks."

grzm 9y ago
I'm sorry. I really think we're talking past each other. At this point I'm having a really hard time figuring out what you're trying to say. I see you equating Struts and software practices with the businesses that use software. I see those as two separate things. > Nobody MADE Equifax use Struts. Yup. > The source is open to inspection. Yup. > Let's see how many audits Equifax did on the source code with no warranty. I'm not sure why you're including this. I think they should have done source code audits in accordance with how they weighed the costs/revenues. Do you disagree? I personally tend to lean towards more tests and code analysis, but I understand others weigh this differently. > If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software. I place the responsibly with the company using Struts in their product, not the Struts dev. I'm not sure how you're getting the impression I (or Zufrekci, for that matter) place this on the Struts dev. I'm responsible for the results of the applications I put into production, including the libraries I choose to use in that application. I don't hold generally hold the devs who wrote those libraries responsible. Like I said, I think we're talking past each other. I still think you're reading too much into (and too little close reading of) Zufrekci, but I'm not sure how better to express what I'm trying to say. I've now read the piece through 3 times fully and I really don't see her making any of the points you're arguing against. If you've got specific questions about what I've written, please ask. Otherwise, I'll sign off. Have a good evening!
- danjoc 9y ago
  >I place the responsibly Nobody cares where you, or I, place it. You don't write for the NYTimes. You don't have that sort of sphere of influence. >with the company using Struts in their product, not the Struts dev. They don't. http://nypost.com/2017/09/08/equifax-blames-giant-breach-on-vendor-software-flaw/ http://nypost.com/2017/09/08/equifax-blames-giant-breach-on-... It's very easy to explain to the public. "Those software hacker people did this to you. Look, here he is. He made the faulty software. Burn him at the stake." Zufrekci is with them, blaming the developer. Developer licensure, here we come. Illegal to write open source software. Another one of those crazy Richard Stallman predictions that comes true while you guys sleepwalk into the dystopia. https://www.gnu.org/philosophy/right-to-read.html https://www.gnu.org/philosophy/right-to-read.html
  - gipp 9y ago
    Your line of comments is maddening, because you're clearly in total agreement with the article, yet seem to somehow be reading in almost the precise opposite of what its point was. The author was not blaming the Struts guy. She was blaming Equifax, 100%. She would blame the decision to use Struts and assume the unavoidable risk associated with such a decision, not the development of Struts itself. Literally every single point made in the article is about Equifax dodging accountability for their choices, and Struts is never mentioned. What on Earth makes you assert with such total certainty that she's blaming the Struts developer?
    - danjoc 9y ago
      "No software system can be free from bugs (or intruders), and users must be mindful of the risks. But the inherent lack of perfect automotive safety doesn’t mean we don’t try to make cars safer. Obviously, people should drive more carefully, but seatbelts, airbags and better car design reduce injury enormously, and that has been great for the industry as well as consumers. The software industry should be no different." Let me translate that: Software users, like people who use compilers, should need licenses. Obviously, people need to compile more carefully. Software needs the equivalent of seatbelts, airbags, and other government mandated safety standards. Software cannot JUST ship to github with no warranty or guarantees of safety. These licenses which absolve the developer of responsibility cannot continue to be allowed. Those open source developers should not just produce software for free, but they need to accept responsibility for it. They need to pass government mandated, Apple App store style, approval for all software shipped. Including regulations for safety and compliance with other laws like copyright infringement and decency standards. She's attacking the foundation of the software freedom movement.

by danjoc 9y ago

grzm 9y ago

I'm sorry. I really think we're talking past each other. At this point I'm having a really hard time figuring out what you're trying to say. I see you equating Struts and software practices with the businesses that use software. I see those as two separate things. > Nobody MADE Equifax use Struts. Yup. > The source is open to inspection. Yup. > Let's see how many audits Equifax did on the source code with no warranty. I'm not sure why you're including this. I think they should have done source code audits in accordance with how they weighed the costs/revenues. Do you disagree? I personally tend to lean towards more tests and code analysis, but I understand others weigh this differently. > If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software. I place the responsibly with the company using Struts in their product, not the Struts dev. I'm not sure how you're getting the impression I (or Zufrekci, for that matter) place this on the Struts dev. I'm responsible for the results of the applications I put into production, including the libraries I choose to use in that application. I don't hold generally hold the devs who wrote those libraries responsible. Like I said, I think we're talking past each other. I still think you're reading too much into (and too little close reading of) Zufrekci, but I'm not sure how better to express what I'm trying to say. I've now read the piece through 3 times fully and I really don't see her making any of the points you're arguing against. If you've got specific questions about what I've written, please ask. Otherwise, I'll sign off. Have a good evening!

danjoc 9y ago
>I place the responsibly Nobody cares where you, or I, place it. You don't write for the NYTimes. You don't have that sort of sphere of influence. >with the company using Struts in their product, not the Struts dev. They don't. http://nypost.com/2017/09/08/equifax-blames-giant-breach-on-vendor-software-flaw/ http://nypost.com/2017/09/08/equifax-blames-giant-breach-on-... It's very easy to explain to the public. "Those software hacker people did this to you. Look, here he is. He made the faulty software. Burn him at the stake." Zufrekci is with them, blaming the developer. Developer licensure, here we come. Illegal to write open source software. Another one of those crazy Richard Stallman predictions that comes true while you guys sleepwalk into the dystopia. https://www.gnu.org/philosophy/right-to-read.html https://www.gnu.org/philosophy/right-to-read.html
- gipp 9y ago
  Your line of comments is maddening, because you're clearly in total agreement with the article, yet seem to somehow be reading in almost the precise opposite of what its point was. The author was not blaming the Struts guy. She was blaming Equifax, 100%. She would blame the decision to use Struts and assume the unavoidable risk associated with such a decision, not the development of Struts itself. Literally every single point made in the article is about Equifax dodging accountability for their choices, and Struts is never mentioned. What on Earth makes you assert with such total certainty that she's blaming the Struts developer?
  - danjoc 9y ago
    "No software system can be free from bugs (or intruders), and users must be mindful of the risks. But the inherent lack of perfect automotive safety doesn’t mean we don’t try to make cars safer. Obviously, people should drive more carefully, but seatbelts, airbags and better car design reduce injury enormously, and that has been great for the industry as well as consumers. The software industry should be no different." Let me translate that: Software users, like people who use compilers, should need licenses. Obviously, people need to compile more carefully. Software needs the equivalent of seatbelts, airbags, and other government mandated safety standards. Software cannot JUST ship to github with no warranty or guarantees of safety. These licenses which absolve the developer of responsibility cannot continue to be allowed. Those open source developers should not just produce software for free, but they need to accept responsibility for it. They need to pass government mandated, Apple App store style, approval for all software shipped. Including regulations for safety and compliance with other laws like copyright infringement and decency standards. She's attacking the foundation of the software freedom movement.