8 ms·

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don'

> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are absolutely absurd.

anf 8y ago
Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?
- deleted 8y ago
  [deleted]
- chasil 8y ago
  I propose that hardware manufacturers be forced to divulge admin methods and encryption keys to their products 6 months after their software updates end. At least users can apply workarounds in that condition. As it stands, there are no options for the owner of the device.
  - staticassertion 8y ago
    This just shifts the burden to the users, I don't see this as a meaningful solution. I think that there would probably need to be classifications of software. Things like: 1) Is this infrastructure (routers, scada) 2) What level of user data is exposed to this software ? (unencrypted user data, credit card info, etc - we already do this to some extent) 3) What level of exposure exists? (NAT'd, routable, etc) And then start imposing restrictions on software in those cases. But this is very off-the-cuff, obviously it's far more complex than this. But someone needs to be responsible.
- varjag 8y ago
  Is this sarcastic? Locks get picked and doors smashed by burglars multiple times a day.
  - staticassertion 8y ago
    Architects and civil engineers are held liable. I would imagine we would use a similar system, as someone with no idea how that system works.
    - namibj 8y ago
      The homeowner's insurance regulates the locks and doorframes to be used for external doors, maybe differentiation more or less.
- PeterisP 8y ago
  Just as a door being breakable by sufficient force doesn't necessarily mean that the manufacturer is negligent, the fact that some software isn't perfect (i.e. contains bugs) doesn't necessarily mean that the developers are negligent.
  - mehrdadn 8y ago
    > Just as a door being breakable by sufficient force doesn't necessarily mean that the manufacturer is negligent, the fact that some software isn't perfect (i.e. contains bugs) doesn't necessarily mean that the developers are negligent. So you consider well-known and well-understood design limitations to be comparable to unknown defects?
    - Sacho 8y ago
      Should the manufacturers of locks exhibited in DEFCON's lockpick village be sued for negligence? Are they getting sued for it?
tetha 8y ago
This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a way to reliably enumerate a set of vulnerabilities, attribution of liability is even harder: - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. - What happens if that library is openssl and almost all webservers on the internet are vulnerable? - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? I dislike being so negative about it, but I wouldn't want to get sued for sticking an MIT license on a silly project 10 years ago someone necro'd and stuck into a router, so to say.
- staticassertion 8y ago
  > Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them. > - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. Yes. > - What happens if that library is openssl and almost all webservers on the internet are vulnerable? Everyone deploying it is liable. > - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. The company doing so is liable. > - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? You are liable. As in, the person who produces the product is liable for what they put in the product. But, as I said elsewhere, this is all off the cuff and relies on a way to properly classify software, which is extremely hard. But yeah, to your points, none of those feel hard to deal with at all. I'm not a lawyer. This is not an area I'm so familiar with. But we already have some controls for CC info, and extending those further would be hard but a good start. This situation is extremely out of hand, whether I have the solution today or not.
rootw0rm 8y ago
We don't need to criminalize everything.
WalterBright 8y ago
> Yeah, definitely. Next time you get a prescription filled, ask yourself if you're willing to pay that much for a router.
arkona3 8y ago
Have you ever been involved in development or written software?
AnthonyMouse 8y ago
> Yeah, definitely. Especially for infrastructure. The problem is that this is entirely useless. There are basically two classes of software company. The first is the likes of Google or Mozilla. They, as a rule, do the right thing. All humans make mistakes but the mistakes are understandable and there isn't really much we can expect to incentivize them to do that they aren't already doing. The second is Fly By Night IoT Device Corporation. They make garbage, it has a million vulnerabilities, but they're judgment proof. If you sue them they just file for bankruptcy. Many of them don't even exist within your jurisdiction and the ones that do are likely to have gone out of business by the time you get around to filing a lawsuit. You might as well pass a law imposing liability on raccoons for spilling garbage. There is a much better solution to all of this. Fund a government agency to search for vulnerabilities in popular products and report the vulnerabilities to the developers. Then remove products from the market that have had known unpatched vulnerabilities for more than a limited amount of time, and require updates to be offered to any product sold in the past X number of years. Because it's a lot easier to get a company to spend $5000 in developer time to fix their garbage than to get them not to avoid a twelve billion dollar lawsuit by filing for bankruptcy -- which only leaves all their customers in the lurch with hardware that will then never be patched.
- staticassertion 8y ago
  Cisco is a Fly By Night IOT Corporation? Linksys?
  - AnthonyMouse 8y ago
    > Cisco is a Fly By Night IOT Corporation? Linksys? Cisco hasn't owned Linksys in years and Linksys itself is tiny. This kind of liability absolutely could bankrupt them. And they're one of the major players. There are companies making this kind of hardware with like twelve employees. The barrier to entry is so low that even individuals commonly make one-offs from scratch for personal use.
    - staticassertion 8y ago
      > Cisco hasn't owned Linksys in years I didn't say they did... I was providing two examples. I wouldn't call linksys tiny, either. You're assuming a lot about the costs of this liability for a made up law with no defined penalty. Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial?
yeukhon 8y ago
Yes. But now you are liable. How many bugs have you fixed that were created by you?
vinceguidry 8y ago
I'm not sure what sort of liability you're wanting here. Criminal culpability for this sort of thing is simply against the American social contract. You go to jail for specific things that have been previously made illegal, not just for causing public ills. And you can already sue companies if you want civil liability.
- contravariant 8y ago
  I agree that it's kind of hard to claim criminal negligence for software bugs, after all it's very hard to make something bug free and software is that weird edge case where you can tell someone exactly what it does, but not in a way that is useful for preventing problems. That said in extreme cases like e.g. airplanes I think it would be fair to consider it negligent when code is just brought into production without any kind of debugging or testing. I guess the stakes decide when something is or isn't negligent.
posterboy 8y ago
Since you cannot stop someone from using open source, the liability is on the user to verify the source. If the source is closed, guess what ...

anf 8y ago

Is there no laws w.r.t. negligence that can be used to punish negligent actors? If a door manufacturer is negligent in their construction of the door and someone gets robbed as a result, in violation of how they expected their door to work, is there nothing currently in the law that could help them?

deleted 8y ago
[deleted]
chasil 8y ago
I propose that hardware manufacturers be forced to divulge admin methods and encryption keys to their products 6 months after their software updates end. At least users can apply workarounds in that condition. As it stands, there are no options for the owner of the device.
- staticassertion 8y ago
  This just shifts the burden to the users, I don't see this as a meaningful solution. I think that there would probably need to be classifications of software. Things like: 1) Is this infrastructure (routers, scada) 2) What level of user data is exposed to this software ? (unencrypted user data, credit card info, etc - we already do this to some extent) 3) What level of exposure exists? (NAT'd, routable, etc) And then start imposing restrictions on software in those cases. But this is very off-the-cuff, obviously it's far more complex than this. But someone needs to be responsible.
varjag 8y ago
Is this sarcastic? Locks get picked and doors smashed by burglars multiple times a day.
- staticassertion 8y ago
  Architects and civil engineers are held liable. I would imagine we would use a similar system, as someone with no idea how that system works.
  - namibj 8y ago
    The homeowner's insurance regulates the locks and doorframes to be used for external doors, maybe differentiation more or less.
PeterisP 8y ago
Just as a door being breakable by sufficient force doesn't necessarily mean that the manufacturer is negligent, the fact that some software isn't perfect (i.e. contains bugs) doesn't necessarily mean that the developers are negligent.
- mehrdadn 8y ago
  > Just as a door being breakable by sufficient force doesn't necessarily mean that the manufacturer is negligent, the fact that some software isn't perfect (i.e. contains bugs) doesn't necessarily mean that the developers are negligent. So you consider well-known and well-understood design limitations to be comparable to unknown defects?
  - Sacho 8y ago
    Should the manufacturers of locks exhibited in DEFCON's lockpick village be sued for negligence? Are they getting sued for it?

tetha 8y ago

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a way to reliably enumerate a set of vulnerabilities, attribution of liability is even harder: - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. - What happens if that library is openssl and almost all webservers on the internet are vulnerable? - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? I dislike being so negative about it, but I wouldn't want to get sued for sticking an MIT license on a silly project 10 years ago someone necro'd and stuck into a router, so to say.

staticassertion 8y ago
> Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them. > - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. Yes. > - What happens if that library is openssl and almost all webservers on the internet are vulnerable? Everyone deploying it is liable. > - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. The company doing so is liable. > - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? You are liable. As in, the person who produces the product is liable for what they put in the product. But, as I said elsewhere, this is all off the cuff and relies on a way to properly classify software, which is extremely hard. But yeah, to your points, none of those feel hard to deal with at all. I'm not a lawyer. This is not an area I'm so familiar with. But we already have some controls for CC info, and extending those further would be hard but a good start. This situation is extremely out of hand, whether I have the solution today or not.

rootw0rm 8y ago

We don't need to criminalize everything.

WalterBright 8y ago

> Yeah, definitely. Next time you get a prescription filled, ask yourself if you're willing to pay that much for a router.

arkona3 8y ago

Have you ever been involved in development or written software?

AnthonyMouse 8y ago

> Yeah, definitely. Especially for infrastructure. The problem is that this is entirely useless. There are basically two classes of software company. The first is the likes of Google or Mozilla. They, as a rule, do the right thing. All humans make mistakes but the mistakes are understandable and there isn't really much we can expect to incentivize them to do that they aren't already doing. The second is Fly By Night IoT Device Corporation. They make garbage, it has a million vulnerabilities, but they're judgment proof. If you sue them they just file for bankruptcy. Many of them don't even exist within your jurisdiction and the ones that do are likely to have gone out of business by the time you get around to filing a lawsuit. You might as well pass a law imposing liability on raccoons for spilling garbage. There is a much better solution to all of this. Fund a government agency to search for vulnerabilities in popular products and report the vulnerabilities to the developers. Then remove products from the market that have had known unpatched vulnerabilities for more than a limited amount of time, and require updates to be offered to any product sold in the past X number of years. Because it's a lot easier to get a company to spend $5000 in developer time to fix their garbage than to get them not to avoid a twelve billion dollar lawsuit by filing for bankruptcy -- which only leaves all their customers in the lurch with hardware that will then never be patched.

staticassertion 8y ago
Cisco is a Fly By Night IOT Corporation? Linksys?
- AnthonyMouse 8y ago
  > Cisco is a Fly By Night IOT Corporation? Linksys? Cisco hasn't owned Linksys in years and Linksys itself is tiny. This kind of liability absolutely could bankrupt them. And they're one of the major players. There are companies making this kind of hardware with like twelve employees. The barrier to entry is so low that even individuals commonly make one-offs from scratch for personal use.
  - staticassertion 8y ago
    > Cisco hasn't owned Linksys in years I didn't say they did... I was providing two examples. I wouldn't call linksys tiny, either. You're assuming a lot about the costs of this liability for a made up law with no defined penalty. Maybe if companies building software can't afford to keep it safe... they shouldn't be companies? Is that so controversial?

yeukhon 8y ago

Yes. But now you are liable. How many bugs have you fixed that were created by you?

vinceguidry 8y ago

I'm not sure what sort of liability you're wanting here. Criminal culpability for this sort of thing is simply against the American social contract. You go to jail for specific things that have been previously made illegal, not just for causing public ills. And you can already sue companies if you want civil liability.

contravariant 8y ago
I agree that it's kind of hard to claim criminal negligence for software bugs, after all it's very hard to make something bug free and software is that weird edge case where you can tell someone exactly what it does, but not in a way that is useful for preventing problems. That said in extreme cases like e.g. airplanes I think it would be fair to consider it negligent when code is just brought into production without any kind of debugging or testing. I guess the stakes decide when something is or isn't negligent.

posterboy 8y ago

Since you cannot stop someone from using open source, the liability is on the user to verify the source. If the source is closed, guess what ...