11 ms·

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

staticassertion 8y ago
> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are absolutely absurd.
- anf 8y ago
  Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?
  - deleted 8y ago
    [deleted]
  - chasil 8y ago
    I propose that hardware manufacturers be forced to divulge admin methods and encryption keys to their products 6 months after their software updates end. At least users can apply workarounds in that condition. As it stands, there are no options for the owner of the device.
    - staticassertion 8y ago
      This just shifts the burden to the users, I don't see this as a meaningful solution. I think that there would probably need to be classifications of software. Things like: 1) Is this infrastructure (routers, scada) 2) What level of user data is exposed to this software ? (unencrypted user data, credit card info, etc - we already do this to some extent) 3) What level of exposure exists? (NAT'd, routable, etc) And then start imposing restrictions on software in those cases. But this is very off-the-cuff, obviously it's far more complex than this. But someone needs to be responsible.
  - varjag 8y ago
    Is this sarcastic? Locks get picked and doors smashed by burglars multiple times a day.
    - staticassertion 8y ago
      Architects and civil engineers are held liable. I would imagine we would use a similar system, as someone with no idea how that system works.
      - namibj 8y ago
        The homeowner's insurance regulates the locks and doorframes to be used for external doors, maybe differentiation more or less.
  - PeterisP 8y ago
    Just as a door being breakable by sufficient force doesn't necessarily mean that the manufacturer is negligent, the fact that some software isn't perfect (i.e. contains bugs) doesn't necessarily mean that the developers are negligent.
    - mehrdadn 8y ago
      > Just as a door being breakable by sufficient force doesn't necessarily mean that the manufacturer is negligent, the fact that some software isn't perfect (i.e. contains bugs) doesn't necessarily mean that the developers are negligent. So you consider well-known and well-understood design limitations to be comparable to unknown defects?
      - Sacho 8y ago
        Should the manufacturers of locks exhibited in DEFCON's lockpick village be sued for negligence? Are they getting sued for it?
- tetha 8y ago
  This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a way to reliably enumerate a set of vulnerabilities, attribution of liability is even harder: - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. - What happens if that library is openssl and almost all webservers on the internet are vulnerable? - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? I dislike being so negative about it, but I wouldn't want to get sued for sticking an MIT license on a silly project 10 years ago someone necro'd and stuck into a router, so to say.
  - staticassertion 8y ago
    > Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them. > - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. Yes. > - What happens if that library is openssl and almost all webservers on the internet are vulnerable? Everyone deploying it is liable. > - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. The company doing so is liable. > - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? You are liable. As in, the person who produces the product is liable for what they put in the product. But, as I said elsewhere, this is all off the cuff and relies on a way to properly classify software, which is extremely hard. But yeah, to your points, none of those feel hard to deal with at all. I'm not a lawyer. This is not an area I'm so familiar with. But we already have some controls for CC info, and extending those further would be hard but a good start. This situation is extremely out of hand, whether I have the solution today or not.
- rootw0rm 8y ago
  We don't need to criminalize everything.
- WalterBright 8y ago
  > Yeah, definitely. Next time you get a prescription filled, ask yourself if you're willing to pay that much for a router.
- arkona3 8y ago
  Have you ever been involved in development or written software?
- AnthonyMouse 8y ago
  > Yeah, definitely. Especially for infrastructure. The problem is that this is entirely useless. There are basically two classes of software company. The first is the likes of Google or Mozilla. They, as a rule, do the right thing. All humans make mistakes but the mistakes are understandable and there isn't really much we can expect to incentivize them to do that they aren't already doing. The second is Fly By Night IoT Device Corporation. They make garbage, it has a million vulnerabilities, but they're judgment proof. If you sue them they just file for bankruptcy. Many of them don't even exist within your jurisdiction and the ones that do are likely to have gone out of business by the time you get around to filing a lawsuit. You might as well pass a law imposing liability on raccoons for spilling garbage. There is a much better solution to all of this. Fund a government agency to search for vulnerabilities in popular products and report the vulnerabilities to the developers. Then remove products from the market that have had known unpatched vulnerabilities for more than a limited amount of time, and require updates to be offered to any product sold in the past X number of years. Because it's a lot easier to get a company to spend $5000 in developer time to fix their garbage than to get them not to avoid a twelve billion dollar lawsuit by filing for bankruptcy -- which only leaves all their customers in the lurch with hardware that will then never be patched.
  - staticassertion 8y ago
    Cisco is a Fly By Night IOT Corporation? Linksys?
    - AnthonyMouse 8y ago
      > Cisco is a Fly By Night IOT Corporation? Linksys? Cisco hasn't owned Linksys in years and Linksys itself is tiny. This kind of liability absolutely could bankrupt them. And they're one of the major players. There are companies making this kind of hardware with like twelve employees. The barrier to entry is so low that even individuals commonly make one-offs from scratch for personal use.
      - staticassertion 8y ago
        > Cisco hasn't owned Linksys in years I didn't say they did... I was providing two examples. I wouldn't call linksys tiny, either. You're assuming a lot about the costs of this liability for a made up law with no defined penalty. Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial?
- yeukhon 8y ago
  Yes. But now you are liable. How many bugs have you fixed that were created by you?
- vinceguidry 8y ago
  I'm not sure what sort of liability you're wanting here. Criminal culpability for this sort of thing is simply against the American social contract. You go to jail for specific things that have been previously made illegal, not just for causing public ills. And you can already sue companies if you want civil liability.
  - contravariant 8y ago
    I agree that it's kind of hard to claim criminal negligence for software bugs, after all it's very hard to make something bug free and software is that weird edge case where you can tell someone exactly what it does, but not in a way that is useful for preventing problems. That said in extreme cases like e.g. airplanes I think it would be fair to consider it negligent when code is just brought into production without any kind of debugging or testing. I guess the stakes decide when something is or isn't negligent.
- posterboy 8y ago
  Since you cannot stop someone from using open source, the liability is on the user to verify the source. If the source is closed, guess what ...
bitwize 8y ago
> Do you really want liability for software bugs? GDPR has shown that inconveniencing tech companies with legal consequences for their negligence can be a net boon to society. So yes, liability for software bugs. Hell, we probably need to start licensing programmers.
losteric 8y ago
Companies should be liable for deficiencies in their commercial products... that's basic consumer protection. Samsung had to recall and repair dangerously defective hardware - why not Cisco? Does it matter whether the public risk is in the battery or router memory? And, imo, it follows that free OSS organizations are not liable for vulnerabilities. No money, no consumers. I think it's fair that businesses should expect to do their due diligence before blindly reusing public domain IP...
- dgzl 8y ago
  In Samsung's case, the defects could be directly responsible for damages to human lives. That's a far reach from software vulnerabilities. Not to mention that software bugs can be incredibly difficult to identify, and sometimes impossible until new exploitation methods are discovered, often times well after the creation of the software, and sometimes only due to new software and hardware tools that only later become available. If you ever wanted an example of how to stifle innovation, read the comment I'm replying to.
  - losteric 8y ago
    My admittedly ambiguous threshold is "significant impact to quality of life" Battery fires can kill so even a handful is significant, but a security vulnerability that impacts thousands of routers has lower but wider impact. Some companies will be targeted for DDoS or using the routers to probe and infect the company infrastructure... some consumers will end up paying ransomware, or having their finances hacked, or personal info leakes, or bandwidth siphoned.
tonyztan 8y ago
> Do you really want liability for software bugs? For free software? No. No payment, no obligation. For paid products? Yes. If you are selling a device, you should be liable for it, just like a car manufacturer would have liability if the brakes failed because they were improperly installed.
- rad_gruchalski 8y ago
  A lot of these routers contain tons of oss libraries. Would it then depend on which component caused the bug? It‘s a rabbit hole.
  - tonyztan 8y ago
    No matter which component caused the bug, the device vendor that made the final product should always be responsible, unless it has a contract outsourcing the responsibility for a specific component to another entity. If the vendor simply used open source libraries, then it needs to review and take responsibility for the code, or hire a contractor to do so. This might also incentivize them to provide timely security updates, in order to minimize damages.
    - namibj 8y ago
      You need to bundle mandatory, sizable insurance as a requirement for getting the license to sell/not selling illegally (i.e., treat the device as illegal as an insurance provider who is not licensed to sell insurance, not as an unlicensed medical doctor). The insurance would make the vendor fix his shit. And he can't just chicken out. Make some way for sufficiently large companies to self-insure, or they will be mad. If they don't get mad, they probably like the reduction in competition.
      - rad_gruchalski 8y ago
        At the end of the day, the end consumer will pay.
fulafel 8y ago
> If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? For some bugs, that count as negligence. Sw engineering as a field knows how to make much safer products than what is in these wormable boxes.
all_blue_chucks 8y ago
There shouldn't be liability for bugs; there should be liability for negligence. If you ship network-aware code you are negligent if you don't take reasonable steps to prevent bugs and have a reasonable process to patch bugs.
- WalterBright 8y ago
  > There shouldn't be liability for bugs; there should be liability for negligence. All bugs can be argued as being the result of negligence.
  - all_blue_chucks 8y ago
    Mistakes are inevitable. Deciding to ship without any upgrade capability is a choice. A deliberate, negligent choice.
    - WalterBright 8y ago
      On the other hand, remote upgradability is how malware gets itself installed in the first place.
      - all_blue_chucks 8y ago
        Most HTTP libraries verify certificates by default. That's all you really need to do...
        WalterBright 8y ago
        Doesn't look like that stopped the router malware from installing itself.
        all_blue_chucks 8y ago
        Citation that they have an auto-update that verifies certificates?
jokoon 8y ago
Free software is generally delivered as is, without any guarantees. Router software is part of something you actually pay for, so there should be liability.
- deleted 8y ago
  [deleted]
megamindbrian2 8y ago
Consider Target or Equifax, when they get hacked they are court ordered to notify their customers. Does someone want to maintain a list of customers for every piece of hardware for connected in case something goes awry?
- deleted 8y ago
  [deleted]
gwbas1c 8y ago
> Do you really want liability for software bugs? Depends on the nature of the bug, certain kinds of security holes are well known and should come with liability. Examples: SQL injection, default passwords, no encryption of sensitive information on the wire, no permission checks. Some of these kinds of bugs are so well known that I don't see how someone could argue against liability.

staticassertion 8y ago

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are absolutely absurd.

anf 8y ago
Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?
- deleted 8y ago
  [deleted]
- chasil 8y ago
  I propose that hardware manufacturers be forced to divulge admin methods and encryption keys to their products 6 months after their software updates end. At least users can apply workarounds in that condition. As it stands, there are no options for the owner of the device.
  - staticassertion 8y ago
    This just shifts the burden to the users, I don't see this as a meaningful solution. I think that there would probably need to be classifications of software. Things like: 1) Is this infrastructure (routers, scada) 2) What level of user data is exposed to this software ? (unencrypted user data, credit card info, etc - we already do this to some extent) 3) What level of exposure exists? (NAT'd, routable, etc) And then start imposing restrictions on software in those cases. But this is very off-the-cuff, obviously it's far more complex than this. But someone needs to be responsible.
- varjag 8y ago
  Is this sarcastic? Locks get picked and doors smashed by burglars multiple times a day.
  - staticassertion 8y ago
    Architects and civil engineers are held liable. I would imagine we would use a similar system, as someone with no idea how that system works.
    - namibj 8y ago
      The homeowner's insurance regulates the locks and doorframes to be used for external doors, maybe differentiation more or less.
- PeterisP 8y ago
  Just as a door being breakable by sufficient force doesn't necessarily mean that the manufacturer is negligent, the fact that some software isn't perfect (i.e. contains bugs) doesn't necessarily mean that the developers are negligent.
  - mehrdadn 8y ago
    > Just as a door being breakable by sufficient force doesn't necessarily mean that the manufacturer is negligent, the fact that some software isn't perfect (i.e. contains bugs) doesn't necessarily mean that the developers are negligent. So you consider well-known and well-understood design limitations to be comparable to unknown defects?
    - Sacho 8y ago
      Should the manufacturers of locks exhibited in DEFCON's lockpick village be sued for negligence? Are they getting sued for it?
tetha 8y ago
This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a way to reliably enumerate a set of vulnerabilities, attribution of liability is even harder: - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. - What happens if that library is openssl and almost all webservers on the internet are vulnerable? - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? I dislike being so negative about it, but I wouldn't want to get sued for sticking an MIT license on a silly project 10 years ago someone necro'd and stuck into a router, so to say.
- staticassertion 8y ago
  > Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them. > - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. Yes. > - What happens if that library is openssl and almost all webservers on the internet are vulnerable? Everyone deploying it is liable. > - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. The company doing so is liable. > - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? You are liable. As in, the person who produces the product is liable for what they put in the product. But, as I said elsewhere, this is all off the cuff and relies on a way to properly classify software, which is extremely hard. But yeah, to your points, none of those feel hard to deal with at all. I'm not a lawyer. This is not an area I'm so familiar with. But we already have some controls for CC info, and extending those further would be hard but a good start. This situation is extremely out of hand, whether I have the solution today or not.
rootw0rm 8y ago
We don't need to criminalize everything.
WalterBright 8y ago
> Yeah, definitely. Next time you get a prescription filled, ask yourself if you're willing to pay that much for a router.
arkona3 8y ago
Have you ever been involved in development or written software?
AnthonyMouse 8y ago
> Yeah, definitely. Especially for infrastructure. The problem is that this is entirely useless. There are basically two classes of software company. The first is the likes of Google or Mozilla. They, as a rule, do the right thing. All humans make mistakes but the mistakes are understandable and there isn't really much we can expect to incentivize them to do that they aren't already doing. The second is Fly By Night IoT Device Corporation. They make garbage, it has a million vulnerabilities, but they're judgment proof. If you sue them they just file for bankruptcy. Many of them don't even exist within your jurisdiction and the ones that do are likely to have gone out of business by the time you get around to filing a lawsuit. You might as well pass a law imposing liability on raccoons for spilling garbage. There is a much better solution to all of this. Fund a government agency to search for vulnerabilities in popular products and report the vulnerabilities to the developers. Then remove products from the market that have had known unpatched vulnerabilities for more than a limited amount of time, and require updates to be offered to any product sold in the past X number of years. Because it's a lot easier to get a company to spend $5000 in developer time to fix their garbage than to get them not to avoid a twelve billion dollar lawsuit by filing for bankruptcy -- which only leaves all their customers in the lurch with hardware that will then never be patched.
- staticassertion 8y ago
  Cisco is a Fly By Night IOT Corporation? Linksys?
  - AnthonyMouse 8y ago
    > Cisco is a Fly By Night IOT Corporation? Linksys? Cisco hasn't owned Linksys in years and Linksys itself is tiny. This kind of liability absolutely could bankrupt them. And they're one of the major players. There are companies making this kind of hardware with like twelve employees. The barrier to entry is so low that even individuals commonly make one-offs from scratch for personal use.
    - staticassertion 8y ago
      > Cisco hasn't owned Linksys in years I didn't say they did... I was providing two examples. I wouldn't call linksys tiny, either. You're assuming a lot about the costs of this liability for a made up law with no defined penalty. Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial?
yeukhon 8y ago
Yes. But now you are liable. How many bugs have you fixed that were created by you?
vinceguidry 8y ago
I'm not sure what sort of liability you're wanting here. Criminal culpability for this sort of thing is simply against the American social contract. You go to jail for specific things that have been previously made illegal, not just for causing public ills. And you can already sue companies if you want civil liability.
- contravariant 8y ago
  I agree that it's kind of hard to claim criminal negligence for software bugs, after all it's very hard to make something bug free and software is that weird edge case where you can tell someone exactly what it does, but not in a way that is useful for preventing problems. That said in extreme cases like e.g. airplanes I think it would be fair to consider it negligent when code is just brought into production without any kind of debugging or testing. I guess the stakes decide when something is or isn't negligent.
posterboy 8y ago
Since you cannot stop someone from using open source, the liability is on the user to verify the source. If the source is closed, guess what ...

bitwize 8y ago

> Do you really want liability for software bugs? GDPR has shown that inconveniencing tech companies with legal consequences for their negligence can be a net boon to society. So yes, liability for software bugs. Hell, we probably need to start licensing programmers.

losteric 8y ago

Companies should be liable for deficiencies in their commercial products... that's basic consumer protection. Samsung had to recall and repair dangerously defective hardware - why not Cisco? Does it matter whether the public risk is in the battery or router memory? And, imo, it follows that free OSS organizations are not liable for vulnerabilities. No money, no consumers. I think it's fair that businesses should expect to do their due diligence before blindly reusing public domain IP...

dgzl 8y ago
In Samsung's case, the defects could be directly responsible for damages to human lives. That's a far reach from software vulnerabilities. Not to mention that software bugs can be incredibly difficult to identify, and sometimes impossible until new exploitation methods are discovered, often times well after the creation of the software, and sometimes only due to new software and hardware tools that only later become available. If you ever wanted an example of how to stifle innovation, read the comment I'm replying to.
- losteric 8y ago
  My admittedly ambiguous threshold is "significant impact to quality of life" Battery fires can kill so even a handful is significant, but a security vulnerability that impacts thousands of routers has lower but wider impact. Some companies will be targeted for DDoS or using the routers to probe and infect the company infrastructure... some consumers will end up paying ransomware, or having their finances hacked, or personal info leakes, or bandwidth siphoned.

tonyztan 8y ago

> Do you really want liability for software bugs? For free software? No. No payment, no obligation. For paid products? Yes. If you are selling a device, you should be liable for it, just like a car manufacturer would have liability if the brakes failed because they were improperly installed.

rad_gruchalski 8y ago
A lot of these routers contain tons of oss libraries. Would it then depend on which component caused the bug? It‘s a rabbit hole.
- tonyztan 8y ago
  No matter which component caused the bug, the device vendor that made the final product should always be responsible, unless it has a contract outsourcing the responsibility for a specific component to another entity. If the vendor simply used open source libraries, then it needs to review and take responsibility for the code, or hire a contractor to do so. This might also incentivize them to provide timely security updates, in order to minimize damages.
  - namibj 8y ago
    You need to bundle mandatory, sizable insurance as a requirement for getting the license to sell/not selling illegally (i.e., treat the device as illegal as an insurance provider who is not licensed to sell insurance, not as an unlicensed medical doctor). The insurance would make the vendor fix his shit. And he can't just chicken out. Make some way for sufficiently large companies to self-insure, or they will be mad. If they don't get mad, they probably like the reduction in competition.
    - rad_gruchalski 8y ago
      At the end of the day, the end consumer will pay.

fulafel 8y ago

> If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? For some bugs, that count as negligence. Sw engineering as a field knows how to make much safer products than what is in these wormable boxes.

all_blue_chucks 8y ago

There shouldn't be liability for bugs; there should be liability for negligence. If you ship network-aware code you are negligent if you don't take reasonable steps to prevent bugs and have a reasonable process to patch bugs.

WalterBright 8y ago
> There shouldn't be liability for bugs; there should be liability for negligence. All bugs can be argued as being the result of negligence.
- all_blue_chucks 8y ago
  Mistakes are inevitable. Deciding to ship without any upgrade capability is a choice. A deliberate, negligent choice.
  - WalterBright 8y ago
    On the other hand, remote upgradability is how malware gets itself installed in the first place.
    - all_blue_chucks 8y ago
      Most HTTP libraries verify certificates by default. That's all you really need to do...
      - WalterBright 8y ago
        Doesn't look like that stopped the router malware from installing itself.
        all_blue_chucks 8y ago
        Citation that they have an auto-update that verifies certificates?

jokoon 8y ago

Free software is generally delivered as is, without any guarantees. Router software is part of something you actually pay for, so there should be liability.

deleted 8y ago
[deleted]

megamindbrian2 8y ago

Consider Target or Equifax, when they get hacked they are court ordered to notify their customers. Does someone want to maintain a list of customers for every piece of hardware for connected in case something goes awry?

deleted 8y ago
[deleted]

gwbas1c 8y ago

> Do you really want liability for software bugs? Depends on the nature of the bug, certain kinds of security holes are well known and should come with liability. Examples: SQL injection, default passwords, no encryption of sensitive information on the wire, no permission checks. Some of these kinds of bugs are so well known that I don't see how someone could argue against liability.