6 ms·

> Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual

> Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them. > - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries. Yes. > - What happens if that library is openssl and almost all webservers on the internet are vulnerable? Everyone deploying it is liable. > - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library. The company doing so is liable. > - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally? You are liable. As in, the person who produces the product is liable for what they put in the product. But, as I said elsewhere, this is all off the cuff and relies on a way to properly classify software, which is extremely hard. But yeah, to your points, none of those feel hard to deal with at all. I'm not a lawyer. This is not an area I'm so familiar with. But we already have some controls for CC info, and extending those further would be hard but a good start. This situation is extremely out of hand, whether I have the solution today or not.

DougN7 8y ago
I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’ve still shipped bugs. Should I be sued out of existence? We don’t need hardware and software costs spirally out of control like healthcare because of the liability. If device makers would just support their products (bug fixes) for 10(?) years I think that would do it.
- rebuilder 8y ago
  It seems to me this is one of those situations where the programmer mindset does not properly interface with the lawyer mindset. In programming, you have true and false, and generally things fall into one or the other category with no human input. In law, you have concepts like "reasonable", and a whole lot of human input, by design. So my expectation would be that if software vendors were to be held responsible for bugs in their products, the standard they would be expected to adhere to would be "reasonable expectation of proper functioning", with humans intepreting what "reasonable" means.
  - amarkov 8y ago
    On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.
    - subway 8y ago
      What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.
      - khedoros1 8y ago
        > What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Millions of malicious people constantly attacking it with cheap equipment from a distance with little chance of being caught doing so?
        true_religion 8y ago
        Whilst that is true, it doesn't have to be that way. If from day one, liability for software bugs lead back to whomever wrote the code, then the world would be a much different place. For one thing, we would be much more conservative in how we wrote code. Libraries would be vetted, with insurance contracts attached to them. Programming languages would not allow for dynamic data, type coercion, or weak typing. In the 80s, rather than C rising to prominence, Ada would have. Haskell would be our generations Javascript, and XHTML would have won over HTML5 simple because guessing how rendering should work would open up a browser maker to high fines and lawsuits. We'd have to rewrite our entire software stack from the ground up. It's not impossible, but we'd have to view it as a multi-decade transition like how the chemical industry was slowly forced to not use heavily polluting procedures.
- staticassertion 8y ago
  I've been shipping production software for years... I think you've misread my post if you think I said that every bug should lead to a lawsuit. It's right in the first part of my first post that we should not be holding every product equally liable for every bug. There is a line somewhere, and beyond that line is negligence. A developer exposing a potential vulnerability in an internal service that does not handle sensitive information is clearly not across that line, a company that creates routers that constantly have serious holes, that handle sensitive information, seems clearly on the other side. Deciding exactly where that line exists is obviously complex.
  - ryanlol 8y ago
    Why would routers be handling sensitive information? You're doing something seriously wrong. Perhaps you should be fined for not encrypting your communications?
    - staticassertion 8y ago
      wat you mean like, say, routing all of the traffic from my system to the internet?
      - ryanlol 8y ago
        You should not be transmitting sensitive information to the internet.
        DougN7 8y ago
        So don’t use online banking, or email, or online insurance or any online healthcare, or ... ?
        ryanlol 8y ago
        Do you seriously use any of those without TLS? In the year 2018?
  - 8y ago
- Khaine 8y ago
  Most routers are shit. Manufacturers slap together a version of linux, some crappy web ui, and ship it. It is unlikely to receive any updates or patches. Manufacturers should be liable for the poor quality of the devices they make. Software vulnerabilities are a fact of life, because there is no driving force to be better. Strict liability would force the industry to be more like other engineering disciplines.
- posterboy 8y ago
  Take the grand parent comment as written by a consumer, not a producer.

DougN7 8y ago

I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’ve still shipped bugs. Should I be sued out of existence? We don’t need hardware and software costs spirally out of control like healthcare because of the liability. If device makers would just support their products (bug fixes) for 10(?) years I think that would do it.

rebuilder 8y ago
It seems to me this is one of those situations where the programmer mindset does not properly interface with the lawyer mindset. In programming, you have true and false, and generally things fall into one or the other category with no human input. In law, you have concepts like "reasonable", and a whole lot of human input, by design. So my expectation would be that if software vendors were to be held responsible for bugs in their products, the standard they would be expected to adhere to would be "reasonable expectation of proper functioning", with humans intepreting what "reasonable" means.
- amarkov 8y ago
  On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.
  - subway 8y ago
    What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.
    - khedoros1 8y ago
      > What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Millions of malicious people constantly attacking it with cheap equipment from a distance with little chance of being caught doing so?
      - true_religion 8y ago
        Whilst that is true, it doesn't have to be that way. If from day one, liability for software bugs lead back to whomever wrote the code, then the world would be a much different place. For one thing, we would be much more conservative in how we wrote code. Libraries would be vetted, with insurance contracts attached to them. Programming languages would not allow for dynamic data, type coercion, or weak typing. In the 80s, rather than C rising to prominence, Ada would have. Haskell would be our generations Javascript, and XHTML would have won over HTML5 simple because guessing how rendering should work would open up a browser maker to high fines and lawsuits. We'd have to rewrite our entire software stack from the ground up. It's not impossible, but we'd have to view it as a multi-decade transition like how the chemical industry was slowly forced to not use heavily polluting procedures.
staticassertion 8y ago
I've been shipping production software for years... I think you've misread my post if you think I said that every bug should lead to a lawsuit. It's right in the first part of my first post that we should not be holding every product equally liable for every bug. There is a line somewhere, and beyond that line is negligence. A developer exposing a potential vulnerability in an internal service that does not handle sensitive information is clearly not across that line, a company that creates routers that constantly have serious holes, that handle sensitive information, seems clearly on the other side. Deciding exactly where that line exists is obviously complex.
- ryanlol 8y ago
  Why would routers be handling sensitive information? You're doing something seriously wrong. Perhaps you should be fined for not encrypting your communications?
  - staticassertion 8y ago
    wat you mean like, say, routing all of the traffic from my system to the internet?
    - ryanlol 8y ago
      You should not be transmitting sensitive information to the internet.
      - DougN7 8y ago
        So don’t use online banking, or email, or online insurance or any online healthcare, or ... ?
        ryanlol 8y ago
        Do you seriously use any of those without TLS? In the year 2018?
- 8y ago
Khaine 8y ago
Most routers are shit. Manufacturers slap together a version of linux, some crappy web ui, and ship it. It is unlikely to receive any updates or patches. Manufacturers should be liable for the poor quality of the devices they make. Software vulnerabilities are a fact of life, because there is no driving force to be better. Strict liability would force the industry to be more like other engineering disciplines.
posterboy 8y ago
Take the grand parent comment as written by a consumer, not a producer.