7 ms·

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software sys

by tetha 8y ago

This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a way to reliably enumerate a set of vulnerabilities, attribution of liability is even harder: - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. - What happens if that library is openssl and almost all webservers on the internet are vulnerable? - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? I dislike being so negative about it, but I wouldn't want to get sued for sticking an MIT license on a silly project 10 years ago someone necro'd and stuck into a router, so to say.

staticassertion 8y ago
> Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them. > - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. Yes. > - What happens if that library is openssl and almost all webservers on the internet are vulnerable? Everyone deploying it is liable. > - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. The company doing so is liable. > - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? You are liable. As in, the person who produces the product is liable for what they put in the product. But, as I said elsewhere, this is all off the cuff and relies on a way to properly classify software, which is extremely hard. But yeah, to your points, none of those feel hard to deal with at all. I'm not a lawyer. This is not an area I'm so familiar with. But we already have some controls for CC info, and extending those further would be hard but a good start. This situation is extremely out of hand, whether I have the solution today or not.
- DougN7 8y ago
  I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’ve still shipped bugs. Should I be sued out of existence? We don’t need hardware and software costs spirally out of control like healthcare because of the liability. If device makers would just support their products (bug fixes) for 10(?) years I think that would do it.
  - rebuilder 8y ago
    It seems to me this is one of those situations where the programmer mindset does not properly interface with the lawyer mindset. In programming, you have true and false, and generally things fall into one or the other category with no human input. In law, you have concepts like "reasonable", and a whole lot of human input, by design. So my expectation would be that if software vendors were to be held responsible for bugs in their products, the standard they would be expected to adhere to would be "reasonable expectation of proper functioning", with humans intepreting what "reasonable" means.
    - amarkov 8y ago
      On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.
      - subway 8y ago
        What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.
inetknght 8y ago
Do you sell the product? If you don't, why is this a concern? I think the parent's arguments are for software that's being sold, not just random silly project that you don't care about (which is obvious if you don't sell it).
losteric 8y ago
Safety liability follows and ends with the chain of financial transactions. No commerce, no liability.
dozzie 8y ago
> Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. You nailed the problem here, though you don't seem to realize it. Yes, software is very complex. Maybe it should be made simpler instead of buggier.
bradknowles 8y ago
Perhaps a “UL Labs” type of solution for software, so that if your software and organization are certified according to the current standard, then your liabilities would be reduced? And yes, organizations and versions of software would have to be recertified on a regular basis. You would want software versions to be able to be certified quickly and through an automated process, but there is already some best practice in this space — it’s just unevenly distributed.
- jsoc815 8y ago
  Ask and you shall receive, something... Past event: https://www.aei.org/events/securing-the-internet-of-things-a-conversation-with-sen-ed-markey-d-ma-and-rep-ted-lieu-d-ca/ https://www.aei.org/events/securing-the-internet-of-things-a... Partial event video: https://www.youtube.com/watch?v=DrnFcLuqzd4 https://www.youtube.com/watch?v=DrnFcLuqzd4
- v_lisivka 8y ago
  If certification authority said that software is secure and then security flaws are found, then who is liable? IMHO, we should have optimistic check: any public network device must have guarantee from the vendor to fix any remote vulnerability in 30 days after discovery by independent security organization(s), otherwise vendor liable for the damage done by his device.
seanp2k2 8y ago
Given the above, consider the future of semi-autonomous and fully-autonomous vehicles.
PakG1 8y ago
When an aircraft crashes and the NTSB gets involved to investigate, does the aircraft manufacturer get sued? I don't know. Why can't we set up something like the NTSB for critical infrastructure stuff at least? I can see how setting it up for consumer stuff would suck. But purpose of the org would be to make stuff safer and develop best practices, not assign blame. I'm probably naive, as I don't know all the good and bad details of how NTSB investigations work. But I figure that's a good place as any to find inspiration for something that could work?
Vektorweg 8y ago
If a software company tells me, that their software is safe, they should be liable in case it isn't. Most FOSS licenses come with 'without warranty' notice. Businesses, who use it, should know that.
- khedoros1 8y ago
  Sounds like it would be smartest for all software to come with a warning that it may be vulnerable to malicious interference. It'll be the software version of a Prop 65 warning. There's no such thing as absolutely safe software.
  - adrianN 8y ago
    We have fairly complex rules already in place when it comes to hardware safety. Manufacturers aren't liable if they can show that they performed due diligence in designing their product. Why can't we have something similar for software?
  - v_lisivka 8y ago
    Except we can forbid by law to attach such devices to public networks. If you want to attach a router with no guarantees of security, by a router with guarantee of security and plug in it before vulnerable one.
subway 8y ago
Software is a mess by choice. Let those who made it a mess burn. Nobody has half a fucking clue where the libraries they're slapping together come from, nor how they're maintained, nor how they're vulnerable. It gets worse every day with trash like DockerHub, and has no relief in sight. So yeah -- let the folks who won't adhere to proper engineering burn.
huhlig 8y ago
OSS libraries are almost always shipped with a no warranty license. Your router however is not. The Vendor shipping a hardware product IS responsible for the quality and safety of that product. By shipping libraries as part of their product with a no warranty liability to lower their costs they absorb the liability.

by tetha 8y ago

staticassertion 8y ago

> Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them. > - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. Yes. > - What happens if that library is openssl and almost all webservers on the internet are vulnerable? Everyone deploying it is liable. > - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. The company doing so is liable. > - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? You are liable. As in, the person who produces the product is liable for what they put in the product. But, as I said elsewhere, this is all off the cuff and relies on a way to properly classify software, which is extremely hard. But yeah, to your points, none of those feel hard to deal with at all. I'm not a lawyer. This is not an area I'm so familiar with. But we already have some controls for CC info, and extending those further would be hard but a good start. This situation is extremely out of hand, whether I have the solution today or not.

DougN7 8y ago
I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’ve still shipped bugs. Should I be sued out of existence? We don’t need hardware and software costs spirally out of control like healthcare because of the liability. If device makers would just support their products (bug fixes) for 10(?) years I think that would do it.
- rebuilder 8y ago
  It seems to me this is one of those situations where the programmer mindset does not properly interface with the lawyer mindset. In programming, you have true and false, and generally things fall into one or the other category with no human input. In law, you have concepts like "reasonable", and a whole lot of human input, by design. So my expectation would be that if software vendors were to be held responsible for bugs in their products, the standard they would be expected to adhere to would be "reasonable expectation of proper functioning", with humans intepreting what "reasonable" means.
  - amarkov 8y ago
    On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.
    - subway 8y ago
      What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.

inetknght 8y ago

Do you sell the product? If you don't, why is this a concern? I think the parent's arguments are for software that's being sold, not just random silly project that you don't care about (which is obvious if you don't sell it).

losteric 8y ago

Safety liability follows and ends with the chain of financial transactions. No commerce, no liability.

dozzie 8y ago

> Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. You nailed the problem here, though you don't seem to realize it. Yes, software is very complex. Maybe it should be made simpler instead of buggier.

bradknowles 8y ago

Perhaps a “UL Labs” type of solution for software, so that if your software and organization are certified according to the current standard, then your liabilities would be reduced? And yes, organizations and versions of software would have to be recertified on a regular basis. You would want software versions to be able to be certified quickly and through an automated process, but there is already some best practice in this space — it’s just unevenly distributed.

jsoc815 8y ago
Ask and you shall receive, something... Past event: https://www.aei.org/events/securing-the-internet-of-things-a-conversation-with-sen-ed-markey-d-ma-and-rep-ted-lieu-d-ca/ https://www.aei.org/events/securing-the-internet-of-things-a... Partial event video: https://www.youtube.com/watch?v=DrnFcLuqzd4 https://www.youtube.com/watch?v=DrnFcLuqzd4
v_lisivka 8y ago
If certification authority said that software is secure and then security flaws are found, then who is liable? IMHO, we should have optimistic check: any public network device must have guarantee from the vendor to fix any remote vulnerability in 30 days after discovery by independent security organization(s), otherwise vendor liable for the damage done by his device.

seanp2k2 8y ago

Given the above, consider the future of semi-autonomous and fully-autonomous vehicles.

PakG1 8y ago

When an aircraft crashes and the NTSB gets involved to investigate, does the aircraft manufacturer get sued? I don't know. Why can't we set up something like the NTSB for critical infrastructure stuff at least? I can see how setting it up for consumer stuff would suck. But purpose of the org would be to make stuff safer and develop best practices, not assign blame. I'm probably naive, as I don't know all the good and bad details of how NTSB investigations work. But I figure that's a good place as any to find inspiration for something that could work?

Vektorweg 8y ago

If a software company tells me, that their software is safe, they should be liable in case it isn't. Most FOSS licenses come with 'without warranty' notice. Businesses, who use it, should know that.

khedoros1 8y ago
Sounds like it would be smartest for all software to come with a warning that it may be vulnerable to malicious interference. It'll be the software version of a Prop 65 warning. There's no such thing as absolutely safe software.
- adrianN 8y ago
  We have fairly complex rules already in place when it comes to hardware safety. Manufacturers aren't liable if they can show that they performed due diligence in designing their product. Why can't we have something similar for software?
- v_lisivka 8y ago
  Except we can forbid by law to attach such devices to public networks. If you want to attach a router with no guarantees of security, by a router with guarantee of security and plug in it before vulnerable one.

subway 8y ago

Software is a mess by choice. Let those who made it a mess burn. Nobody has half a fucking clue where the libraries they're slapping together come from, nor how they're maintained, nor how they're vulnerable. It gets worse every day with trash like DockerHub, and has no relief in sight. So yeah -- let the folks who won't adhere to proper engineering burn.

huhlig 8y ago

OSS libraries are almost always shipped with a no warranty license. Your router however is not. The Vendor shipping a hardware product IS responsible for the quality and safety of that product. By shipping libraries as part of their product with a no warranty liability to lower their costs they absorb the liability.