3 ms·

I've been shipping production software for years... I think you've misread my post if you think I said that every bug should lead to a lawsuit. It's right in th

I've been shipping production software for years... I think you've misread my post if you think I said that every bug should lead to a lawsuit. It's right in the first part of my first post that we should not be holding every product equally liable for every bug. There is a line somewhere, and beyond that line is negligence. A developer exposing a potential vulnerability in an internal service that does not handle sensitive information is clearly not across that line, a company that creates routers that constantly have serious holes, that handle sensitive information, seems clearly on the other side. Deciding exactly where that line exists is obviously complex.

ryanlol 8y ago
Why would routers be handling sensitive information? You're doing something seriously wrong. Perhaps you should be fined for not encrypting your communications?
- staticassertion 8y ago
  wat you mean like, say, routing all of the traffic from my system to the internet?
  - ryanlol 8y ago
    You should not be transmitting sensitive information to the internet.
    - DougN7 8y ago
      So don’t use online banking, or email, or online insurance or any online healthcare, or ... ?
      - ryanlol 8y ago
        Do you seriously use any of those without TLS? In the year 2018?
jamescostian 8y ago
>>>> - What happens if that library is openssl and almost all webservers on the internet are vulnerable? >>> Everyone deploying it is liable. > I've been shipping production software for years... Have you ever shipped software which depends on openssl? If not, then pretend that you have. Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for because you deployed something using openssl?
- staticassertion 8y ago
  Yes, I have. > Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for because you deployed something using openssl? This is a really ridiculous question. I've already stated that these things are complicated - you're asking for a hard number? Companies should take responsibility for their users data, which includes understanding the risk involved in third party libraries they use. If they're concerned about fees, invest in the security of the project you're using. But this is all based on some hypothetical, undefined 'law', so arguing about the specific mechanics is pointless.
  - jamescostian 8y ago
    >> can you give me a ballpark > you're asking for a hard number? No, I am not asking for a hard number, I specifically asked for a ballpark. > invest in the security of the project you're using I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security > arguing about the specific mechanics is pointless Agreed, my goal is not to flesh out the mechanics, it is to demonstrate the pitfalls of such a law. I'm only asking for a ballpark (again, not a hard number) so that you can personally understand why you and every other serious developer would be sued out of existence unless you propose obscenely small fines (which would make the whole idea useless, because then developers could easily afford to be negligent without getting too much of an increase in fines).
    - staticassertion 8y ago

ryanlol 8y ago

Why would routers be handling sensitive information? You're doing something seriously wrong. Perhaps you should be fined for not encrypting your communications?

staticassertion 8y ago
wat you mean like, say, routing all of the traffic from my system to the internet?
- ryanlol 8y ago
  You should not be transmitting sensitive information to the internet.
  - DougN7 8y ago
    So don’t use online banking, or email, or online insurance or any online healthcare, or ... ?
    - ryanlol 8y ago
      Do you seriously use any of those without TLS? In the year 2018?

jamescostian 8y ago

>>>> - What happens if that library is openssl and almost all webservers on the internet are vulnerable? >>> Everyone deploying it is liable. > I've been shipping production software for years... Have you ever shipped software which depends on openssl? If not, then pretend that you have. Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for because you deployed something using openssl?

staticassertion 8y ago
Yes, I have. > Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for because you deployed something using openssl? This is a really ridiculous question. I've already stated that these things are complicated - you're asking for a hard number? Companies should take responsibility for their users data, which includes understanding the risk involved in third party libraries they use. If they're concerned about fees, invest in the security of the project you're using. But this is all based on some hypothetical, undefined 'law', so arguing about the specific mechanics is pointless.
- jamescostian 8y ago
  >> can you give me a ballpark > you're asking for a hard number? No, I am not asking for a hard number, I specifically asked for a ballpark. > invest in the security of the project you're using I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security > arguing about the specific mechanics is pointless Agreed, my goal is not to flesh out the mechanics, it is to demonstrate the pitfalls of such a law. I'm only asking for a ballpark (again, not a hard number) so that you can personally understand why you and every other serious developer would be sued out of existence unless you propose obscenely small fines (which would make the whole idea useless, because then developers could easily afford to be negligent without getting too much of an increase in fines).
  - staticassertion 8y ago