5 ms·

I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’

by DougN7 8y ago

I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’ve still shipped bugs. Should I be sued out of existence? We don’t need hardware and software costs spirally out of control like healthcare because of the liability. If device makers would just support their products (bug fixes) for 10(?) years I think that would do it.

rebuilder 8y ago
It seems to me this is one of those situations where the programmer mindset does not properly interface with the lawyer mindset. In programming, you have true and false, and generally things fall into one or the other category with no human input. In law, you have concepts like "reasonable", and a whole lot of human input, by design. So my expectation would be that if software vendors were to be held responsible for bugs in their products, the standard they would be expected to adhere to would be "reasonable expectation of proper functioning", with humans intepreting what "reasonable" means.
- amarkov 8y ago
  On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.
  - subway 8y ago
    What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.
    - khedoros1 8y ago
      > What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Millions of malicious people constantly attacking it with cheap equipment from a distance with little chance of being caught doing so?
      - true_religion 8y ago
        Whilst that is true, it doesn't have to be that way. If from day one, liability for software bugs lead back to whomever wrote the code, then the world would be a much different place. For one thing, we would be much more conservative in how we wrote code. Libraries would be vetted, with insurance contracts attached to them. Programming languages would not allow for dynamic data, type coercion, or weak typing. In the 80s, rather than C rising to prominence, Ada would have. Haskell would be our generations Javascript, and XHTML would have won over HTML5 simple because guessing how rendering should work would open up a browser maker to high fines and lawsuits. We'd have to rewrite our entire software stack from the ground up. It's not impossible, but we'd have to view it as a multi-decade transition like how the chemical industry was slowly forced to not use heavily polluting procedures.
    - hueving 8y ago
      The pace of software innovation to lack of liability from simply writing code has brought us the entire information age.
    - posterboy 8y ago
      Other engineering disciplines are very conservative. Due to age, this doesn't compare well to software. There is tradition, but a lot of it military in origin, not civil: ARPA net, Grace Hopper, and the first bug, Turing and the Enigma. Stealworking as a military secret in comparison is thousands of years old. And so far, leaked DB content has per the official record not killed anyone ... perhaps a few astronauts but none of the people responsible in place to fix it, as would be the case in a family of incorporated electricians. We need a code-code.
staticassertion 8y ago
I've been shipping production software for years... I think you've misread my post if you think I said that every bug should lead to a lawsuit. It's right in the first part of my first post that we should not be holding every product equally liable for every bug. There is a line somewhere, and beyond that line is negligence. A developer exposing a potential vulnerability in an internal service that does not handle sensitive information is clearly not across that line, a company that creates routers that constantly have serious holes, that handle sensitive information, seems clearly on the other side. Deciding exactly where that line exists is obviously complex.
- ryanlol 8y ago
  Why would routers be handling sensitive information? You're doing something seriously wrong. Perhaps you should be fined for not encrypting your communications?
  - staticassertion 8y ago
    wat you mean like, say, routing all of the traffic from my system to the internet?
    - ryanlol 8y ago
      You should not be transmitting sensitive information to the internet.
      - DougN7 8y ago
        So don’t use online banking, or email, or online insurance or any online healthcare, or ... ?
        ryanlol 8y ago
        Do you seriously use any of those without TLS? In the year 2018?
- 8y ago
Khaine 8y ago
Most routers are shit. Manufacturers slap together a version of linux, some crappy web ui, and ship it. It is unlikely to receive any updates or patches. Manufacturers should be liable for the poor quality of the devices they make. Software vulnerabilities are a fact of life, because there is no driving force to be better. Strict liability would force the industry to be more like other engineering disciplines.
posterboy 8y ago
Take the grand parent comment as written by a consumer, not a producer.

by DougN7 8y ago

rebuilder 8y ago

It seems to me this is one of those situations where the programmer mindset does not properly interface with the lawyer mindset. In programming, you have true and false, and generally things fall into one or the other category with no human input. In law, you have concepts like "reasonable", and a whole lot of human input, by design. So my expectation would be that if software vendors were to be held responsible for bugs in their products, the standard they would be expected to adhere to would be "reasonable expectation of proper functioning", with humans intepreting what "reasonable" means.

amarkov 8y ago
On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.
- subway 8y ago
  What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.
  - khedoros1 8y ago
    > What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it? Millions of malicious people constantly attacking it with cheap equipment from a distance with little chance of being caught doing so?
    - true_religion 8y ago
      Whilst that is true, it doesn't have to be that way. If from day one, liability for software bugs lead back to whomever wrote the code, then the world would be a much different place. For one thing, we would be much more conservative in how we wrote code. Libraries would be vetted, with insurance contracts attached to them. Programming languages would not allow for dynamic data, type coercion, or weak typing. In the 80s, rather than C rising to prominence, Ada would have. Haskell would be our generations Javascript, and XHTML would have won over HTML5 simple because guessing how rendering should work would open up a browser maker to high fines and lawsuits. We'd have to rewrite our entire software stack from the ground up. It's not impossible, but we'd have to view it as a multi-decade transition like how the chemical industry was slowly forced to not use heavily polluting procedures.
  - hueving 8y ago
    The pace of software innovation to lack of liability from simply writing code has brought us the entire information age.
  - posterboy 8y ago
    Other engineering disciplines are very conservative. Due to age, this doesn't compare well to software. There is tradition, but a lot of it military in origin, not civil: ARPA net, Grace Hopper, and the first bug, Turing and the Enigma. Stealworking as a military secret in comparison is thousands of years old. And so far, leaked DB content has per the official record not killed anyone ... perhaps a few astronauts but none of the people responsible in place to fix it, as would be the case in a family of incorporated electricians. We need a code-code.

staticassertion 8y ago

I've been shipping production software for years... I think you've misread my post if you think I said that every bug should lead to a lawsuit. It's right in the first part of my first post that we should not be holding every product equally liable for every bug. There is a line somewhere, and beyond that line is negligence. A developer exposing a potential vulnerability in an internal service that does not handle sensitive information is clearly not across that line, a company that creates routers that constantly have serious holes, that handle sensitive information, seems clearly on the other side. Deciding exactly where that line exists is obviously complex.

ryanlol 8y ago
Why would routers be handling sensitive information? You're doing something seriously wrong. Perhaps you should be fined for not encrypting your communications?
- staticassertion 8y ago
  wat you mean like, say, routing all of the traffic from my system to the internet?
  - ryanlol 8y ago
    You should not be transmitting sensitive information to the internet.
    - DougN7 8y ago
      So don’t use online banking, or email, or online insurance or any online healthcare, or ... ?
      - ryanlol 8y ago
        Do you seriously use any of those without TLS? In the year 2018?
8y ago

Khaine 8y ago

Most routers are shit. Manufacturers slap together a version of linux, some crappy web ui, and ship it. It is unlikely to receive any updates or patches. Manufacturers should be liable for the poor quality of the devices they make. Software vulnerabilities are a fact of life, because there is no driving force to be better. Strict liability would force the industry to be more like other engineering disciplines.

posterboy 8y ago

Take the grand parent comment as written by a consumer, not a producer.