5 ms·

A half baked idea, curious what people think: Would it be possible to create an insurance policy against these major FOSS vulnerabilities? The insurance compa

A half baked idea, curious what people think: Would it be possible to create an insurance policy against these major FOSS vulnerabilities? The insurance company would then require audits of your tech stack, and fund security research. This is analogous to what car insurance companies already do. And then companies who are not insured are viewed as suspect, etc etc. There's apparently a misalignment of incentives because there's a break in the chain of responsibility. The idea here is to close that loop.

convolvatron 5y ago
car insurance companies hires actuaries that correlate driving speed to payout and adjust rates accordingly. if you think that software quality and risk can be so easily quantified then you clearly dont have your hands in software.
- orblivion 5y ago
  What about insurance companies that need to predict weather disasters? Is that also more predictable than software? If it's something harder to predict, is there a way you could put error bars around it? Granted premiums could get high as a result.
  - atq2119 5y ago
    The key is establishing a market for this kind of insurance policy. That can only happen if companies are made liable. That needs to happen at some point, though it's not clear how to do it without getting unpleasant unintended side effects.
    - orblivion 5y ago
      Companies already don't like to deal with this stuff right? However much liability already exists, they're already having a bad day trying to patch all this stuff. So maybe they'd want to know they'll get compensated for the resources spent on that.
      - atq2119 5y ago
        Good point. A more difficult sale for sure, but perhaps somebody should try and let us know how it went? :)
raxxorrax 5y ago
That would create an even more parasitic security industry than we already have. As many have said that the only defense against data extraction of personal information is to not collect them. I think this collection has to become more expensive than the benefits to marketing and advertising. Insurance might help here, but I expect premiums to be high if risk is adequately and realistically assessed. Against exploits like the log4j thing... the library is popular and was used for years. In open source and commercial software alike. I doubt any audit would have found the problem. Most probably didn't expect it in such a library in the first place and would have started review with the more arcane dependencies. The only benefit of other components is probably security through obscurity. But what would you insure against here? Against exploits in software in general? I don't think that would improve software security in the long run.

convolvatron 5y ago

car insurance companies hires actuaries that correlate driving speed to payout and adjust rates accordingly. if you think that software quality and risk can be so easily quantified then you clearly dont have your hands in software.

orblivion 5y ago
What about insurance companies that need to predict weather disasters? Is that also more predictable than software? If it's something harder to predict, is there a way you could put error bars around it? Granted premiums could get high as a result.
- atq2119 5y ago
  The key is establishing a market for this kind of insurance policy. That can only happen if companies are made liable. That needs to happen at some point, though it's not clear how to do it without getting unpleasant unintended side effects.
  - orblivion 5y ago
    Companies already don't like to deal with this stuff right? However much liability already exists, they're already having a bad day trying to patch all this stuff. So maybe they'd want to know they'll get compensated for the resources spent on that.
    - atq2119 5y ago
      Good point. A more difficult sale for sure, but perhaps somebody should try and let us know how it went? :)

raxxorrax 5y ago

That would create an even more parasitic security industry than we already have. As many have said that the only defense against data extraction of personal information is to not collect them. I think this collection has to become more expensive than the benefits to marketing and advertising. Insurance might help here, but I expect premiums to be high if risk is adequately and realistically assessed. Against exploits like the log4j thing... the library is popular and was used for years. In open source and commercial software alike. I doubt any audit would have found the problem. Most probably didn't expect it in such a library in the first place and would have started review with the more arcane dependencies. The only benefit of other components is probably security through obscurity. But what would you insure against here? Against exploits in software in general? I don't think that would improve software security in the long run.