4 ms·

If commercial software companies were liable for their security flaws the penalty money could be fed into an Open Source fund.

bdcravens 6y ago
Ignoring the fact that's either impossible or requires government overreach that would make a fascist blush, it would take the Hacktoberfest problem and turn it up to 1000.
- romanows 6y ago
  Governments fine companies for environmental, ADA, etc. incidents/violations, why not for IT-related security incidents/violations? Governments also give money away to for-profits and nonprofits all the time via grants.
  - bagacrap 6y ago
    Not sure how those things are related? Non IT security events are not penalized by the government, e.g. if someone breaks into your warehouse and steals physical goods you don't get slapped with a fine for buying the wrong padlocks and ABUS doesn't get a fine for making a lock that was cuttable.
    - romanows 6y ago
      Governments do penalize non-IT security events-- first thing that comes to mind are laws that impose penalties for improper storage of a firearm. It probably depends on jurisdiction but in my Google search, "proper storage" can require the firearm to be placed in a locked container or have a tamper resistant mechanical lock.
- dastx 6y ago
  > requires government overreach that would make a fascist blush How is keeping companies liable for their failures something that would make a fascist blush? Companies should be liable for their mistakes, especially when it's negligence that results in user data being blown all over the internet.
  - strictnein 6y ago
    > Companies should be liable for their mistakes, especially when it's negligence There's a vast sea between mistakes and negligence. Exactly 0% of the people posting on this site have written 100% bug free code that's been pushed to prod/released to customers.
    - alexashka 6y ago
      Yes, and no doctor is 100% error free in his/her judgement. We can sue if a doctor amputates the wrong limb. How is software any different? It's simply a matter of making companies pay for externalities. If you pollute the environment with your business, you need to pay for that. If you pollute the world with buggy software, you need to pay for that. But all companies have externalities?! Yes, and they should all pay for their externalities and if the cost is high enough that the business is no longer profitable, it needs to close. Software without bugs isn't some pipe dream - the people writing software will simply be elevated to the level of a surgeon. Do you want your surgeon introducing 'bugs' during your operation? I don't, that's why surgeons get extensive training and are highly compensated. People want to pay people peanuts for software that barely works, so that they can capture and monopolize as much of the market as quickly as possible. Uh, that's not my problem that people who want to get rich will have difficulty, I want shit that actually works.
      - strictnein 6y ago
        Again, that's negligence and you can sue software companies over negligence. > Software without bugs isn't some pipe dream - the people writing software will simply be elevated to the level of a surgeon. Your doctor analogies really don't make a lot of sense. Surgeons likely make small mistakes all the time, they're just working on one system (person) at a time and can fix them immediately. Software without bugs is absolutely a pipedream. Maybe you just haven't worked on very complex systems written over the span of many years or decades?
        alexashka 6y ago
kortilla 6y ago
And who pays when the flaws are in open source software?
- mistersys 6y ago
  If the flaw is in open source software, it would be the responsibility of the commercial company that shipped the open source software, for not auditing the code they shipped. You can always disclaim your code if you want to take no responsibility for damages, as in the MIT license.
  - rmah 6y ago
    You cannot disclaim away the law. You cannot sign a contract with a non-government entity that makes it legal to break the law.
  - kortilla 6y ago
    If an individual can disclaim their code then there is no sane reason a corporation couldn’t. It’s not logically consistent otherwise.

bdcravens 6y ago

Ignoring the fact that's either impossible or requires government overreach that would make a fascist blush, it would take the Hacktoberfest problem and turn it up to 1000.

romanows 6y ago
Governments fine companies for environmental, ADA, etc. incidents/violations, why not for IT-related security incidents/violations? Governments also give money away to for-profits and nonprofits all the time via grants.
- bagacrap 6y ago
  Not sure how those things are related? Non IT security events are not penalized by the government, e.g. if someone breaks into your warehouse and steals physical goods you don't get slapped with a fine for buying the wrong padlocks and ABUS doesn't get a fine for making a lock that was cuttable.
  - romanows 6y ago
    Governments do penalize non-IT security events-- first thing that comes to mind are laws that impose penalties for improper storage of a firearm. It probably depends on jurisdiction but in my Google search, "proper storage" can require the firearm to be placed in a locked container or have a tamper resistant mechanical lock.
dastx 6y ago
> requires government overreach that would make a fascist blush How is keeping companies liable for their failures something that would make a fascist blush? Companies should be liable for their mistakes, especially when it's negligence that results in user data being blown all over the internet.
- strictnein 6y ago
  > Companies should be liable for their mistakes, especially when it's negligence There's a vast sea between mistakes and negligence. Exactly 0% of the people posting on this site have written 100% bug free code that's been pushed to prod/released to customers.
  - alexashka 6y ago
    Yes, and no doctor is 100% error free in his/her judgement. We can sue if a doctor amputates the wrong limb. How is software any different? It's simply a matter of making companies pay for externalities. If you pollute the environment with your business, you need to pay for that. If you pollute the world with buggy software, you need to pay for that. But all companies have externalities?! Yes, and they should all pay for their externalities and if the cost is high enough that the business is no longer profitable, it needs to close. Software without bugs isn't some pipe dream - the people writing software will simply be elevated to the level of a surgeon. Do you want your surgeon introducing 'bugs' during your operation? I don't, that's why surgeons get extensive training and are highly compensated. People want to pay people peanuts for software that barely works, so that they can capture and monopolize as much of the market as quickly as possible. Uh, that's not my problem that people who want to get rich will have difficulty, I want shit that actually works.
    - strictnein 6y ago
      Again, that's negligence and you can sue software companies over negligence. > Software without bugs isn't some pipe dream - the people writing software will simply be elevated to the level of a surgeon. Your doctor analogies really don't make a lot of sense. Surgeons likely make small mistakes all the time, they're just working on one system (person) at a time and can fix them immediately. Software without bugs is absolutely a pipedream. Maybe you just haven't worked on very complex systems written over the span of many years or decades?
      - alexashka 6y ago

kortilla 6y ago

And who pays when the flaws are in open source software?

mistersys 6y ago
If the flaw is in open source software, it would be the responsibility of the commercial company that shipped the open source software, for not auditing the code they shipped. You can always disclaim your code if you want to take no responsibility for damages, as in the MIT license.
- rmah 6y ago
  You cannot disclaim away the law. You cannot sign a contract with a non-government entity that makes it legal to break the law.
- kortilla 6y ago
  If an individual can disclaim their code then there is no sane reason a corporation couldn’t. It’s not logically consistent otherwise.