2 ms·

"No one knows how to make a perfectly safe car, yet there are some car safety problems for which car manufacturers are liable and others for which they are not.

"No one knows how to make a perfectly safe car, yet there are some car safety problems for which car manufacturers are liable and others for which they are not." The situation you are describing is that automobile safety is implemented primarily by establishing standards and only secondarily by the existence of liability (though it's important). Now, if you had a large company that bought cars and modified them, that company would itself have an obligation to do it safely too. And having regulations about that would be an absolutely necessary part of liability and safety. ...we absolutely have discovered some vulnerabilities which can be protected against using certain software development techniques, and I see no reason why software vendors ought not be liable for damages caused by their failure to follow these established techniques. I would note that the existence of zero-days is absolutely not the most pressing problem of software security. Having a reasonable system of connecting X to Y is far more pressing. You can get in as much trouble with a misconfigured system as with a vulnerable system. But broadly, your point that there should be standards, is good.

tshaddox 6y ago
> The situation you are describing is that automobile safety is implemented primarily by establishing standards and only secondarily by the existence of liability (though it's important). Indeed, regulatory standards is what I was hinting at, not just civil liability (although I believe both exist for car manufacturers, and should probably exist for software vendors).
- joe_the_user 6y ago
  Yes, we desperately need broad but appropriate regulatory standards. Especially, security standards and research should focus on securing infrastructure and infrastructure type resources. The hacked water supply article from just a few days ago was shocking even to cynical me. Things like institutes that study this situation outside the government itself may be necessary to establish trust at this point. And you can't make the standards primarily about software vendors.

tshaddox 6y ago

> The situation you are describing is that automobile safety is implemented primarily by establishing standards and only secondarily by the existence of liability (though it's important). Indeed, regulatory standards is what I was hinting at, not just civil liability (although I believe both exist for car manufacturers, and should probably exist for software vendors).

joe_the_user 6y ago
Yes, we desperately need broad but appropriate regulatory standards. Especially, security standards and research should focus on securing infrastructure and infrastructure type resources. The hacked water supply article from just a few days ago was shocking even to cynical me. Things like institutes that study this situation outside the government itself may be necessary to establish trust at this point. And you can't make the standards primarily about software vendors.