8 ms·

You want to fix this? Get rid of/make void the fact that software and hardware companies disclaim any and all liability. If they make bad things, they should b

You want to fix this? Get rid of/make void the fact that software and hardware companies disclaim any and all liability. If they make bad things, they should be liable for them. I would provide an exception to this, and that's if they are open sourced, able to upload firmwares, and able to revert to a safe baseband.

_red 8y ago
>If they make bad things, they should be liable for them. Define 'bad'. What one person sees as "insecure and bad" another person will view as "configurable and open". Ultimately the consumer shares a good percentage of blame.
- crankylinuxuser 8y ago
  Really now? Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. Except, for a year and a half, those TVs were vulnerable to a whole range of bad things. They were used as local spying platforms. They were used as jumping off points for local networks. And they were used in attacks on other networks. We can quantify the damages that this malfeasant software/hardware did. They certainly weren't "intended features", nor can customers just roll their own signed firmware. > What one person sees as "insecure and bad" another person will view as "configurable and open". Depends. Does the default behavior leave you open to a range of unintended effects? Are there known and unpatched errors/bugs? Yes, configurations can be made that open you to vulnerabilities. Making an open relay over SMTP is one such. But the default Postfix is sane and secure. > Ultimately the consumer shares a good percentage of blame. That's what I'm arguing. When the customer is not much more than in a rental agreement faked as a purchase, 100% of the blame needs to fall on the renter operator.
  - supernovae 8y ago
    that would just drive up the costs significantly on tvs... I do like that Microsoft appears to be working on its smart tv's with pluggable compute modules so people could replace the compute platform on their tv with one of their preference.
    - crankylinuxuser 8y ago
      I'd disagree. The problem with most companies that put some intelligence in dumb devices is that they: 1. Rely on their own cloud platform 2. Use lockin to their specific plan 3. Fail to quickly respond to security incidences 4. Abandon when their next incremental version comes out And most of these types of devices are the ones that end up being a member in a botnet or other bad networks. The best defense is to make "dumb" devices. No, our microwave, refrigerator, oven, dish washer, and others do NOT need network connectivity. Hard to hack a machine with no connectivity.
      - supernovae 8y ago
        I don't see what your argument is, the more i read it the more i see it supports my argument that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. mind you, I'm NOT Advocating for insecure devices, I'm just saying be prepared for monthly service fees or short product lifecycles if this is what is expected. All of which will drive up costs and potentially reduce utility.
        crankylinuxuser 8y ago
        > that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. Or, the public being price sensitive, will with appropriate legislation, either start killing 'smart' devices, or use secured and local standards.
    - s73v3r_ 8y ago
      That's like saying that inspecting your meat would drive up the price. It is an absolute nonsense argument brought up by people who would prefer to have no responsibility for anything they do, ever.
      - supernovae 8y ago
        nah, inspecting meat is a one-off deal. What is being suggested is that the meat inspector has to certify your fridge/freezer is holding right temperature and is liable if the system fails and spoils the meat. With tv's you're looking at a one-off purchase with a long-tail support contract for years to certify and patch against any/all liabilities. The only way that would be profitable was if every smart tv required a service contract to support such demands, otherwise the model is flawed.
  - _red 8y ago
    >Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. In your proposed universe, you won't have a "smart tv" because you will choose not to pay the $3500 price tag to cover the security audits and increased litigation insurance that will accompany the manufacture of such devices. Most linux distros will also be sued out of existence. Such laws are a dream for authoritarian regimes. Ultimately there will be a only a small handful of monopoly powers who have enough resources to navigate the regulatory landscape.
    - MisterTea 8y ago
      Did you accurately calculate the extra expenses needed to create a secure TV? Or did you pull $3500 out of your ass to bolster your argument?
    - crankylinuxuser 8y ago
      And you're going to the "OMG regulatory hell" argument. Its only been the last 10 years since we've had idiotic "smart features". I'm proposing excising these "smart" features out of devices that don't need it. A TV/Monitor is and will be useful for the foreseeable future. A TV/MOnitor with bit-rotted 'smart features' will turn the device into a disposable device when the maintainer/owner finally wants to get rid of it.
      - _red 8y ago
        >A TV/Monitor is and will be useful for the foreseeable future. Then just buy a TV / Monitor?
        ethbro 8y ago
        Have you tried this recently, for a high-end device in a category for which a smart alternative exists? E.g. TVs Without liability, there is no disincentivizing including smart features for manufacturers. I agree that "Use a user-patchable / open source / replaceable stack -> shielded from some liability" or "Lock everything down -> take on legal liability for your own security" is a sane system to put in place. There's no reason 50%+ of IoT devices (especially Chinese clones) aren't built top-to-bottom open source, aside from manufacturer ignorance / laziness.
- s73v3r_ 8y ago
  I'm sorry, but I am rejecting that argument. "Configurable" and "Secure" are not opposite ends of the same axis. They are different axis altogether, that have very little to do with each other.
- deleted 8y ago
  [deleted]
jarfil 8y ago
Consumers don't want that. There is already a kind of hardware and software where companies are liable: in medical equipment. Now look at what that does to the prices. Open source and consumer serviceable makes sense, but that's already being fought for with the "right to repair" movement.
- monocasa 8y ago
  The medical field has all sorts of other market failures going on, that it's not really fair to compare their prices in that way.
  - logfromblammo 8y ago
    Look at the prices for hardware certified for permanent installation into an aircraft?
    - dsfyu404ed 8y ago
      You practically have to have every bolt be traceable back to the ore the iron for the steel was smelted from (this is only a slight exaggeration). That puts a huge additional cost on every unit shipped. Software is not subject to that. You can certify it once and amortize the cost over a million copies sold. The cost of testing is also much cheaper.
      - logfromblammo 8y ago
        It isn't just the cost of testing. The barrier to entry, no matter how modest, is not what increases the price so much. It's the pricing power acquired from the lack of competition, as the barrier prevents new entrants. If three brands of GPS mapping device dominate the consumer market, but only one of them bothers to certify for aircraft, the exact same hardware in an aircraft dash-mount will cost many times the amount for a consumer handheld. Costs only determine prices for commodity suppliers. Everyone else charges what the market will bear.
- philipov 8y ago
dragonwriter 8y ago
> Get rid of/make void the fact that software and hardware companies disclaim any and all liability It already is void or at least significantly limited by law in most jurisdictions. It might be better if we waived statutes of limitations and enhanced damages (e.g., 3× multiple) for damages where the basis of liability would be reasonably viewed as within the scope of a disclaimer which purported to disclaim liability that could not legally be disclaimed, so that there was a significant disincentive for the currently-routine overly-broad disclaimers.
- deleted 8y ago
  [deleted]
gnulinux 8y ago
How would this affect FLOSS where pretty much all licenses reject liability? I personally believe an engineer has an implicit liability on everything they built, no matter what the license says, but that's the status quo.

_red 8y ago

>If they make bad things, they should be liable for them. Define 'bad'. What one person sees as "insecure and bad" another person will view as "configurable and open". Ultimately the consumer shares a good percentage of blame.

crankylinuxuser 8y ago
Really now? Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. Except, for a year and a half, those TVs were vulnerable to a whole range of bad things. They were used as local spying platforms. They were used as jumping off points for local networks. And they were used in attacks on other networks. We can quantify the damages that this malfeasant software/hardware did. They certainly weren't "intended features", nor can customers just roll their own signed firmware. > What one person sees as "insecure and bad" another person will view as "configurable and open". Depends. Does the default behavior leave you open to a range of unintended effects? Are there known and unpatched errors/bugs? Yes, configurations can be made that open you to vulnerabilities. Making an open relay over SMTP is one such. But the default Postfix is sane and secure. > Ultimately the consumer shares a good percentage of blame. That's what I'm arguing. When the customer is not much more than in a rental agreement faked as a purchase, 100% of the blame needs to fall on the renter operator.
- supernovae 8y ago
  that would just drive up the costs significantly on tvs... I do like that Microsoft appears to be working on its smart tv's with pluggable compute modules so people could replace the compute platform on their tv with one of their preference.
  - crankylinuxuser 8y ago
    I'd disagree. The problem with most companies that put some intelligence in dumb devices is that they: 1. Rely on their own cloud platform 2. Use lockin to their specific plan 3. Fail to quickly respond to security incidences 4. Abandon when their next incremental version comes out And most of these types of devices are the ones that end up being a member in a botnet or other bad networks. The best defense is to make "dumb" devices. No, our microwave, refrigerator, oven, dish washer, and others do NOT need network connectivity. Hard to hack a machine with no connectivity.
    - supernovae 8y ago
      I don't see what your argument is, the more i read it the more i see it supports my argument that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. mind you, I'm NOT Advocating for insecure devices, I'm just saying be prepared for monthly service fees or short product lifecycles if this is what is expected. All of which will drive up costs and potentially reduce utility.
      - crankylinuxuser 8y ago
        > that imposing such contstraints on smart tvs (just an easy example) would shoot their costs up. Or, the public being price sensitive, will with appropriate legislation, either start killing 'smart' devices, or use secured and local standards.
  - s73v3r_ 8y ago
    That's like saying that inspecting your meat would drive up the price. It is an absolute nonsense argument brought up by people who would prefer to have no responsibility for anything they do, ever.
    - supernovae 8y ago
      nah, inspecting meat is a one-off deal. What is being suggested is that the meat inspector has to certify your fridge/freezer is holding right temperature and is liable if the system fails and spoils the meat. With tv's you're looking at a one-off purchase with a long-tail support contract for years to certify and patch against any/all liabilities. The only way that would be profitable was if every smart tv required a service contract to support such demands, otherwise the model is flawed.
- _red 8y ago
  >Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to. In your proposed universe, you won't have a "smart tv" because you will choose not to pay the $3500 price tag to cover the security audits and increased litigation insurance that will accompany the manufacture of such devices. Most linux distros will also be sued out of existence. Such laws are a dream for authoritarian regimes. Ultimately there will be a only a small handful of monopoly powers who have enough resources to navigate the regulatory landscape.
  - MisterTea 8y ago
    Did you accurately calculate the extra expenses needed to create a secure TV? Or did you pull $3500 out of your ass to bolster your argument?
  - crankylinuxuser 8y ago
    And you're going to the "OMG regulatory hell" argument. Its only been the last 10 years since we've had idiotic "smart features". I'm proposing excising these "smart" features out of devices that don't need it. A TV/Monitor is and will be useful for the foreseeable future. A TV/MOnitor with bit-rotted 'smart features' will turn the device into a disposable device when the maintainer/owner finally wants to get rid of it.
    - _red 8y ago
      >A TV/Monitor is and will be useful for the foreseeable future. Then just buy a TV / Monitor?
      - ethbro 8y ago
        Have you tried this recently, for a high-end device in a category for which a smart alternative exists? E.g. TVs Without liability, there is no disincentivizing including smart features for manufacturers. I agree that "Use a user-patchable / open source / replaceable stack -> shielded from some liability" or "Lock everything down -> take on legal liability for your own security" is a sane system to put in place. There's no reason 50%+ of IoT devices (especially Chinese clones) aren't built top-to-bottom open source, aside from manufacturer ignorance / laziness.
s73v3r_ 8y ago
I'm sorry, but I am rejecting that argument. "Configurable" and "Secure" are not opposite ends of the same axis. They are different axis altogether, that have very little to do with each other.
deleted 8y ago
[deleted]

jarfil 8y ago

Consumers don't want that. There is already a kind of hardware and software where companies are liable: in medical equipment. Now look at what that does to the prices. Open source and consumer serviceable makes sense, but that's already being fought for with the "right to repair" movement.

monocasa 8y ago
The medical field has all sorts of other market failures going on, that it's not really fair to compare their prices in that way.
- logfromblammo 8y ago
  Look at the prices for hardware certified for permanent installation into an aircraft?
  - dsfyu404ed 8y ago
    You practically have to have every bolt be traceable back to the ore the iron for the steel was smelted from (this is only a slight exaggeration). That puts a huge additional cost on every unit shipped. Software is not subject to that. You can certify it once and amortize the cost over a million copies sold. The cost of testing is also much cheaper.
    - logfromblammo 8y ago
      It isn't just the cost of testing. The barrier to entry, no matter how modest, is not what increases the price so much. It's the pricing power acquired from the lack of competition, as the barrier prevents new entrants. If three brands of GPS mapping device dominate the consumer market, but only one of them bothers to certify for aircraft, the exact same hardware in an aircraft dash-mount will cost many times the amount for a consumer handheld. Costs only determine prices for commodity suppliers. Everyone else charges what the market will bear.
philipov 8y ago

dragonwriter 8y ago

> Get rid of/make void the fact that software and hardware companies disclaim any and all liability It already is void or at least significantly limited by law in most jurisdictions. It might be better if we waived statutes of limitations and enhanced damages (e.g., 3× multiple) for damages where the basis of liability would be reasonably viewed as within the scope of a disclaimer which purported to disclaim liability that could not legally be disclaimed, so that there was a significant disincentive for the currently-routine overly-broad disclaimers.

deleted 8y ago
[deleted]

gnulinux 8y ago

How would this affect FLOSS where pretty much all licenses reject liability? I personally believe an engineer has an implicit liability on everything they built, no matter what the license says, but that's the status quo.