4 ms·

>>>> - What happens if that library is openssl and almost all webservers on the internet are vulnerable? >>> Everyone deploying it is liable. > I've been ship

>>>> - What happens if that library is openssl and almost all webservers on the internet are vulnerable? >>> Everyone deploying it is liable. > I've been shipping production software for years... Have you ever shipped software which depends on openssl? If not, then pretend that you have. Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for because you deployed something using openssl?

staticassertion 8y ago
Yes, I have. > Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for because you deployed something using openssl? This is a really ridiculous question. I've already stated that these things are complicated - you're asking for a hard number? Companies should take responsibility for their users data, which includes understanding the risk involved in third party libraries they use. If they're concerned about fees, invest in the security of the project you're using. But this is all based on some hypothetical, undefined 'law', so arguing about the specific mechanics is pointless.
- jamescostian 8y ago
  >> can you give me a ballpark > you're asking for a hard number? No, I am not asking for a hard number, I specifically asked for a ballpark. > invest in the security of the project you're using I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security > arguing about the specific mechanics is pointless Agreed, my goal is not to flesh out the mechanics, it is to demonstrate the pitfalls of such a law. I'm only asking for a ballpark (again, not a hard number) so that you can personally understand why you and every other serious developer would be sued out of existence unless you propose obscenely small fines (which would make the whole idea useless, because then developers could easily afford to be negligent without getting too much of an increase in fines).
  - staticassertion 8y ago
    > No, I am not asking for a hard number, I specifically asked for a ballpark. Yes, and it's a fake law that doesn't exist. How would I possibly answer this? Off handedly, I'd say that the fine could really range depending on a lot of things. Was this an outdated version of OpenSSL that they just didn't patch? Was it a programmer error using the library? A 0day? All of these things would probably make a big different - charging companies for 0days in 3rd party code, in at least many cases, would not make sense. > I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security At some point if companies can't afford to keep users safe maybe they just shouldn't be companies. And if we're talking about router companies, they have the cash. > why you and every other serious developer would be sued out of existence unless you propose obscenely small fines I would imagine instead that companies would have insurance around these issues to cover developers, but again, the legal components of this are not something I'd want to get into since I'm not qualified to.
    - hueving 8y ago
      >charging companies for 0days in 3rd party code, in at least many cases, would not make sense. Well you've just made the workaround trivial. Open source the majority of everything under a separate org and then use that stuff from the product being shipped. Therefore any vulns are not their problem. >And if we're talking about router companies, they have the cash I don't think you understand how tiny the margins are in consumer networking gear. Lowest price dominates. >the legal components of this are not something I'd want to get into since I'm not qualified to. Suggesting they be liable is a legal component.
v_lisivka 8y ago
If vendors refuse to update vulnerable OpenSSL library when fix is provided for free, risking their customers, then they should be punished until they change their altitude. Volunteers are doing that for free. Why businesses cannot pay to OpenWrt project for 10 year service for their products?

staticassertion 8y ago

Yes, I have. > Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for because you deployed something using openssl? This is a really ridiculous question. I've already stated that these things are complicated - you're asking for a hard number? Companies should take responsibility for their users data, which includes understanding the risk involved in third party libraries they use. If they're concerned about fees, invest in the security of the project you're using. But this is all based on some hypothetical, undefined 'law', so arguing about the specific mechanics is pointless.

jamescostian 8y ago
>> can you give me a ballpark > you're asking for a hard number? No, I am not asking for a hard number, I specifically asked for a ballpark. > invest in the security of the project you're using I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security > arguing about the specific mechanics is pointless Agreed, my goal is not to flesh out the mechanics, it is to demonstrate the pitfalls of such a law. I'm only asking for a ballpark (again, not a hard number) so that you can personally understand why you and every other serious developer would be sued out of existence unless you propose obscenely small fines (which would make the whole idea useless, because then developers could easily afford to be negligent without getting too much of an increase in fines).
- staticassertion 8y ago
  > No, I am not asking for a hard number, I specifically asked for a ballpark. Yes, and it's a fake law that doesn't exist. How would I possibly answer this? Off handedly, I'd say that the fine could really range depending on a lot of things. Was this an outdated version of OpenSSL that they just didn't patch? Was it a programmer error using the library? A 0day? All of these things would probably make a big different - charging companies for 0days in 3rd party code, in at least many cases, would not make sense. > I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security At some point if companies can't afford to keep users safe maybe they just shouldn't be companies. And if we're talking about router companies, they have the cash. > why you and every other serious developer would be sued out of existence unless you propose obscenely small fines I would imagine instead that companies would have insurance around these issues to cover developers, but again, the legal components of this are not something I'd want to get into since I'm not qualified to.
  - hueving 8y ago
    >charging companies for 0days in 3rd party code, in at least many cases, would not make sense. Well you've just made the workaround trivial. Open source the majority of everything under a separate org and then use that stuff from the product being shipped. Therefore any vulns are not their problem. >And if we're talking about router companies, they have the cash I don't think you understand how tiny the margins are in consumer networking gear. Lowest price dominates. >the legal components of this are not something I'd want to get into since I'm not qualified to. Suggesting they be liable is a legal component.

v_lisivka 8y ago

If vendors refuse to update vulnerable OpenSSL library when fix is provided for free, risking their customers, then they should be punished until they change their altitude. Volunteers are doing that for free. Why businesses cannot pay to OpenWrt project for 10 year service for their products?