7 ms·

German gov plans software company's liability for damages caused by vulns

89 points by sva_ 5y ago

pshirshov 5y ago
Oh, seems like the companies may finally get some motivation to use memory-safe languages, formal proofs, etc.
sva_ 5y ago
> The German government wants to ensure that manufacturers are liable in future for damage caused negligently by software vulnerabilities in their products. [DeepL]
brummm 5y ago
Sounds sensible to me. Similar laws exist for negligence with physical products that cause damages.
- sprash 5y ago
  This makes the work of independent contractors more or less impossible. Only big software houses will be able to afford the insurance needed to deploy software in general.
  - adventured 5y ago
    While that's absolutely correct, fortunately it's only true for Germany, which will further cripple itself in the tech world. The Germans are already decades behind the US in that space, this will just keep things as they are, which I appreciate. Were the Germans acting rationally, applying their potential fully, they'd be a global tech juggernaut, including in software. The more they trip themselves up, the longer the US can easily keep its crown and the trillions of dollars that go with it. And it's kind of cute how SAP now fits in Microsoft's pocket.
    - mschuster91 5y ago
      > While that's absolutely correct, fortunately it's only true for Germany, which will further cripple itself in the tech world. Sooner or later this will be an EU proposal anyway like the GDPR. > The more they trip themselves up, the longer the US can easily keep its crown and the trillions of dollars that go with it. A lot of the success of the US tech giants is built upon the cost of people suffering in a myriad of ways, from the cost of following up with data thefts to literal death from exploitative working conditions. European countries - while not perfect - tend to value their citizens a bit more than the US... and if the US continues on its current path, it may very well see the consequences of dissatisfied citizens. The election of the 45th President was only the beginning of what may happen.
  - White_Wolf 5y ago
    I'm not so sure about that. Most likely, there will be a burden of proof on whoever makes a claim of this type. Just think about how many various lib's are involved in one application. If the problem lies in one of the libs, they'll hunt down whoever made it. I have mixed feelings about a law like this but I can't say I don't agree with something like this as a principle for paid software. Maybe liability will reduce the number of backdoors in software that we pay for. As for FOSS projects on github and such, there is no contractual obigation of any kind as long as you don't see lic's or stuff like that. That being said... I've heard some horror stories that defy common sense so wouldn't be surprised by anything.
  - thephyber 5y ago
    According to the top HN comment right now, the new risk only applies to closed source software which has known/disclosed vulns before the software’s declared lifespan ends. This is not draconian to reasonable software firms and is analogous to structural/civil engineering.
    - kjksf 5y ago
      Which seems like a great incentive for companies to: a) not look for vulnerabilities b) if they are found anyway, to not classify them as vulnerabilities (but regular bugs) Then what? Relying on unpaid people to find and disclose vulnerabilities? And what about all the people who think that they found a vulnerability but didn't? Consider that there are US senators and governors that think reading HTML code is hacking. What bureaucracy will we have to build to decide what is and isn't a vulnerability?
      - thephyber 5y ago
        After having typed out a response, your comment just looks like bad faith foot dragging. This is Germany. Lots of software companies already do this type of work with SOC2 or FedRamp contracts. A vuln is typically reported to NIST and assigned a CVE record. That 3rd party system allows for embargo, publish, dispute, etc. If a manufacturer denies that is is a vuln, the researcher can release their work and malicious actors could prove the manufacturer wrong. I work in cybersecurity, so this isn’t new to me. Maybe it is new to you… ? These companies already have reasons not to look for vulns. IMHo they need more incentives (eg. Regulator/economic pressure) to look for them. My guess is that this rule is being pushed in the aftermath of Log4j, which is a publicly identified CVE/vuln, but which is compiled/linked into other products. Any proprietary product which uses a known vuln in their software supply chain should have to either fix it (by releasing a patch) or make a public statement that the upstream vuln does not create a software vuln downstream or suffer liability. This already happens with companies/products that do this with large contracts. The Missouri Governor is a political stooge, but his Department of Justice is prosecuting what the journalist did after he took the PII that was embedded in the page. We will have to wait to see if that was legal. I suspect he took a SSN that was in the page and used it to fill in a web form, which could be prosecuted as fraud. That would be an example where good faith efforts by security researchers should be exempted from prosecution, but has no relevance to this German proposal. Your complaints seem to be extremely defensive/reticent. I think such posture is only useful if you also consider the value
  - pjmlp 5y ago
    Same applies to small food places that need to comply with food regulations.
buscoquadnary 5y ago
From what I understand Germany already is not very start-up friendly it seems like this further exactrebates it. I put together a weekend project to see how it goes, I have a bug somewhere I didn't think of now BAM I'm on the hook for millions of dollars in "damages." Another much more chilling question is what happens to FOSS projects? Is Germany going to start going against every software developer that uploads an MIT licensed package on Github? What about the Log4j vulnerability who is on the hook for that? I agree security needs to be taken more seriously and we need to step up our game, but I grow concerned when the government starts making broad laws like this.
- felixrieseberg 5y ago
  You seem to misunderstand the original request _and_ the proposal. We so far only have the CCC's request, no further details are known. If you go by the proposal, FOSS and Open Source is out of scope. In the case of Log4j, companies knowingly selling software that contains in insecure version of Log4j now need to own that defect.
  - tasubotadas 5y ago
    What if they claim that they don't know? You know... haven't got the memo.
    - einherjae 5y ago
      Not sure if you’re already trying to make a joke, but there’s a word for that, isn’t there? Negligence. Doesn’t help your local restaurant if they didn’t get the memo about the poisonous scallops, particularly if there existed a regular scallop-poison-level newsletter they could check.
    - Flocular 5y ago
      that could still be considered negligent, if it has a CVE and you're using it, you gotta know about it
- A4ET8a8uTh0 5y ago
c-linkage 5y ago
I feel this is an important step in turning software programming into an actual engineering discipline. Engineers that design bridges and buildings are liable when these structures fail and cause damage or loss of life. Lessons-learned are critical to ensuring corrective actions are taken to ensure similar failures don't happen in the future. Software development has almost none of that. The lessons of the past are relearned on an apparent two to four year cycle.
- buscoquadnary 5y ago
  This is a great lesson on bridge building and software engineering. http://thecodelesscode.com/case/154 http://thecodelesscode.com/case/154
  - tjalfi 5y ago
    Jon Bentley's The Back of the Envelope[0] has a much better lesson about bridge building and software design. "Most of you," says Vyssotsky, "probably recall pictures of 'Galloping Gertie,' the Tacoma Narrows bridge which tore itself apart in a windstorm in 1940. Well, suspension bridges had been ripping themselves apart that way for 80 years or so before Galloping Gertie. It's an aerodynamic lift phenomenon, and to do a proper engineering calculation of the forces, which involve drastic nonlinearities, you have to use the mathematics and concepts of Kolmogorov to model the eddy spectrum. Nobody really knew how to do this correctly in detail until the 1950s or thereabouts. So, why hasn't the Brooklyn Bridge torn itself apart, like Galloping Gertie? "It's because John Roebling had sense enough to know what he didn't know. His notes and letters on the design of the Brooklyn Bridge still exist, and they are a fascinating example of a good engineer recognizing the limits of his knowledge. He knew about aerodynamic lift on suspension bridges; he had watched it. And he knew he didn't know enough to model it. So he designed the stiffness of the truss on the Brooklyn Bridge roadway to be six times what a normal calculation based on known static and dynamic loads would have called for. And, he specified a network of diagonal stays running down to the roadway, to stiffen the entire bridge structure. Go look at those sometime; they're almost unique. "When Roebling was asked whether his proposed bridge wouldn't collapse like so many others, he said, 'No, because I designed it six times as strong as it needs to be, to prevent that from happening.' "Roebling was a good engineer, and he built a good bridge, by employing a huge safety factor to compensate for his ignorance. Do we do that? I submit to you that in calculating performance of our real-time software systems we ought to derate them by a factor of two, or four, or six, to compensate for our ignorance. In making reliability/availability commitments, we ought to stay back from the objectives we think we can meet by a factor of ten, to compensate for our ignorance. In estimating size and cost and schedule, we should be conservative by a factor of two or four to compensate for our ignorance. We should design the way John Roebling did, and not the way his contemporaries did-- so far as I know, none of the suspension bridges built by Roebling's contemporaries in the United States still stands, and a quarter of all the bridges of any type built in the U.S. in the 1870s collapsed within ten years of construction. "Are we engineers, like John Roebling? I wonder." [0] https://www.seltzer.com/margo/teaching/CS508.19/background/p180-bentley.pdf https://www.seltzer.com/margo/teaching/CS508.19/background/p...
felixrieseberg 5y ago
Before you pick up pitchforks, it's important to understand that this has been requested by the reputable Chaos Computer Club for years. It's targeted at commercial proprietary software with disclosed and unfixed vulnerabilities. In other words, if you're knowingly selling software that materially harms your users, you're on the hook. As an example: You're buying "Foo Professional" from MegaCorp. It contains an insecure version of Log4j. You're paying MegaCorp $500,000 per year for license fees. MegaCorp refuses to patch the used version of Log4j. With this proposal, you now have a legal basis for arguing that you _deserve_ a fixed version of "Foo Professional" unless MegaCorp told you clearly by which date "Foo Professional" expired. I think that's a sensible way to think about it.
- buscoquadnary 5y ago
  All software has bugs, some of those bugs will necessarily lead to security issues. The German government can't investigate every product out there, so this will either be a reactionary only measure, that does nothing but cause organizations to simply try and hide what they are doing from the German government, or more chillingly it becomes selectively enforced to punish the politically unpopular and reward the politically favored.
  - pjmlp 5y ago
    Same thing applies to surprise visits from regulation authorities to all kind of business, nothing special about software shops.
  - mschuster91 5y ago
    That's exactly the same what was said for the GDPR... and no one will deny that the GDPR was effective in forcing the industry to adhere to at least some common sense standards. And yes, part of both the GDPR and the CCC proposal is effectively weeding out those whose business model is solely to undercut legitimate competition by putting their customers at risk of losing control of their data or of wasting money on products that are effectively a danger to their data sometimes not even a year after they were bought (looking at you here, cheap-ass Android phones).
javajosh 5y ago
Are there any software firms, or individuals, who volunteer to accept liability, as a competitive advantage?
- arkitaip 5y ago
  Those are called insurance agencies.
- johnx5c 5y ago
  Every company developing medical and automotive software for production use (ISO 262652 etc).
- dathinab 5y ago
  Not volunteer, but seeing it as advantage of required widely. Yes such which are dependent on their party software components they pay for. Like companies using payment system plugins. Or smaller laptop/computer/smartphone manufacturers.
onox 5y ago
If you want to avoid vulnerabilities and have fun with proving that your code is functionally correct, try the Ada/SPARK interactive tutorials at [1] :) [1] https://learn.adacore.com/courses/intro-to-spark/chapters/01_Overview.html https://learn.adacore.com/courses/intro-to-spark/chapters/01...
protomyth 5y ago
I expect in my lifetime insurance policy will get to dictate software practices and only certified software engineers will be allowed to program software. I also think anyone who believes this won't be applied to free / open source is fooling themselves. Other profession had hundreds of years to mature, but software will not be allowed time to grow.
- laurent92 5y ago
  Yes. Free OSS is like “I build bridges for free as an architect” or “I dig wells for free in Africa.” It may be free but we still need to ensure its security. And this is how, I believe, AWS will become kind of required, as it will be the only way to get a certified-up-to-date version of a Linux, of a database, of a library, etc. And programmers will only be responsible for the glue code between those services.
  - dathinab 5y ago
    It's more like "I build a bridge blue print for free as an hobby project". Which is ok. (As long as you don't claim that it's something it's not.) And it's also ok for a company to actually use your blueprint (ignore copyright for a moment). The problem is if a company uses the hobbist blue print without verifying that it fulfills necessary requirements, like being safe in case of an earth quake.
- pjmlp 5y ago
  I am ok with it, https://www-oern-pt.translate.goog/v-0C0J0H/informatica?_x_tr_sch=http&_x_tr_sl=pt&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp https://www-oern-pt.translate.goog/v-0C0J0H/informatica?_x_t...
- turminal 5y ago
  You're saying this as if you're very convinced it's a bad thing. Why? I'm not so sure it's a bad thing.
  - protomyth 5y ago
perihelions 5y ago
Here's a mirror if anyone else needs one: https://archive.is/42K8j https://archive.is/42K8j
cblconfederate 5y ago
I wish they did the same for governments and lawmakers
pjmlp 5y ago
Finally it is happening, great news.
tasubotadas 5y ago
Why not let market figure this out? Companies that do not provide support are bound to be eaten by the others.
- pjmorris 5y ago
  If you had asked the same question about airlines 100 years ago... [0] "At the urging of the aviation industry, that believed the airplane could not reach its full commercial potential without federal action to improve and maintain safety standards,[citation needed] President Calvin Coolidge appointed a board to investigate the issue. The board's report favored federal safety regulation.[10] To that end, the Air Commerce Act became law on May 20, 1926.[11]" [0] https://en.wikipedia.org/wiki/United_States_government_role_in_civil_aviation#Air_Commerce_Act https://en.wikipedia.org/wiki/United_States_government_role_...
  - tasubotadas 5y ago
    Market incumbents quite often welcome the new regulation. It helps them to avoid competition by creating entry barriers.
    - pjmorris 5y ago
      OK, here's an even older instance of the same thing, probably not advocated for by the industry incumbents... 229 If a builder builds a house for someone, and does not construct it properly, and the house which he built falls in and kills its owner, then that builder shall be put to death. - Code of Hammurabi, ~ 1700 BC [0] [0] https://avalon.law.yale.edu/ancient/hamframe.asp https://avalon.law.yale.edu/ancient/hamframe.asp
- bitcharmer 5y ago
  Something tells me you're from USA. Americans let the market figure out public health service and prison systems. We can all see what that did to that country and its people. Free market without any regulation whatsoever can absolutely work to the detriment of society.
ReleaseCandidat 5y ago
This is not so much 'against bugs', but to force companies to update their software and firmware against known problems. And the companies have to explicitly set a date when no more (security) updates are going to be made - for devices like WIFI router firmware. The german text: Der CCC fordert dort eine "Haftung bei unkorrigierten oder gehäuften IT-Sicherheitsproblemen inklusive einer Versicherungspflicht, zwingender Angabe eines Verfallsdatums [...]
leifg 5y ago
To everyone saying my weekend project is going to be on the hook for millions: The keyword here is "fahrlässig" (translates to negligent). Whoever is damaged must be able to prove that a bug caused through your program was negligent. I myself have tons of weekend project that have no stakes at all (most are libraries that are used by essentially no one and I make $0 from all of them combined) and even there I spend a little bit of time keeping dependencies up to that. With the few bug reports I get I at least look into them. It will be very hard to extort any money out of me under this law. If you are running a startup and making money you will need to allocate resources to maintenance, stability and bug fixing.
exabrial 5y ago
"Move slower and build stuff that lasts"
dang 5y ago
We have deep respect for German and other languages, but HN is an English-language site, so posts here need to be in English. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20english%20language%20site&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- sva_ 5y ago
  I understand. I couldn't find an English source for it yet, but the post should probably be updated with one, once it appears.
radu_floricica 5y ago
I don't know. This is the kind of decision where the upside is very visible and easy to argue for, and the downside is much less visible, very spread out, and usually a couple of orders of magnitude larger than you'd first guess. Dev doing a successful OOS project in his spare time is something that fortunately still happens. Dev doing a successful OOS project _and_ accepting liability for potential mistakes is something I really expect to see less of. Plus don't forget the death by a thousand papercuts. If you have this regulation, and that liability, and who knows what else - this is a very time-tested pattern: it raises barriers to entry in an industry and favors large, incumbent companies. Paying a lawyer is a small price to be sure that you can't have competitors smaller than that.
- paulmd 5y ago
  Dev doing a FOSS project is specifically out of scope of the proposal, so this is FUD.
tannhaeuser 5y ago
As a manufacturer, you're already liable for damages caused by negligence, similar to Common Law jurisdictions I guess. So how does this proposed law go beyond that? Is merely using unpatched software negligent, and is a bill of materials or something required to make claims practical? Maybe the law also wants to target the bad practice of eg. Android phone manufacturers stopping to provide updates 2-3 years after purchase if at all?

89 points by sva_ 5y ago

Oh, seems like the companies may finally get some motivation to use memory-safe languages, formal proofs, etc.

sva_ 5y ago

> The German government wants to ensure that manufacturers are liable in future for damage caused negligently by software vulnerabilities in their products. [DeepL]

brummm 5y ago

Sounds sensible to me. Similar laws exist for negligence with physical products that cause damages.

sprash 5y ago
This makes the work of independent contractors more or less impossible. Only big software houses will be able to afford the insurance needed to deploy software in general.
- adventured 5y ago
  While that's absolutely correct, fortunately it's only true for Germany, which will further cripple itself in the tech world. The Germans are already decades behind the US in that space, this will just keep things as they are, which I appreciate. Were the Germans acting rationally, applying their potential fully, they'd be a global tech juggernaut, including in software. The more they trip themselves up, the longer the US can easily keep its crown and the trillions of dollars that go with it. And it's kind of cute how SAP now fits in Microsoft's pocket.
  - mschuster91 5y ago
    > While that's absolutely correct, fortunately it's only true for Germany, which will further cripple itself in the tech world. Sooner or later this will be an EU proposal anyway like the GDPR. > The more they trip themselves up, the longer the US can easily keep its crown and the trillions of dollars that go with it. A lot of the success of the US tech giants is built upon the cost of people suffering in a myriad of ways, from the cost of following up with data thefts to literal death from exploitative working conditions. European countries - while not perfect - tend to value their citizens a bit more than the US... and if the US continues on its current path, it may very well see the consequences of dissatisfied citizens. The election of the 45th President was only the beginning of what may happen.
- White_Wolf 5y ago
  I'm not so sure about that. Most likely, there will be a burden of proof on whoever makes a claim of this type. Just think about how many various lib's are involved in one application. If the problem lies in one of the libs, they'll hunt down whoever made it. I have mixed feelings about a law like this but I can't say I don't agree with something like this as a principle for paid software. Maybe liability will reduce the number of backdoors in software that we pay for. As for FOSS projects on github and such, there is no contractual obigation of any kind as long as you don't see lic's or stuff like that. That being said... I've heard some horror stories that defy common sense so wouldn't be surprised by anything.
- thephyber 5y ago
  According to the top HN comment right now, the new risk only applies to closed source software which has known/disclosed vulns before the software’s declared lifespan ends. This is not draconian to reasonable software firms and is analogous to structural/civil engineering.
  - kjksf 5y ago
    Which seems like a great incentive for companies to: a) not look for vulnerabilities b) if they are found anyway, to not classify them as vulnerabilities (but regular bugs) Then what? Relying on unpaid people to find and disclose vulnerabilities? And what about all the people who think that they found a vulnerability but didn't? Consider that there are US senators and governors that think reading HTML code is hacking. What bureaucracy will we have to build to decide what is and isn't a vulnerability?
    - thephyber 5y ago
      After having typed out a response, your comment just looks like bad faith foot dragging. This is Germany. Lots of software companies already do this type of work with SOC2 or FedRamp contracts. A vuln is typically reported to NIST and assigned a CVE record. That 3rd party system allows for embargo, publish, dispute, etc. If a manufacturer denies that is is a vuln, the researcher can release their work and malicious actors could prove the manufacturer wrong. I work in cybersecurity, so this isn’t new to me. Maybe it is new to you… ? These companies already have reasons not to look for vulns. IMHo they need more incentives (eg. Regulator/economic pressure) to look for them. My guess is that this rule is being pushed in the aftermath of Log4j, which is a publicly identified CVE/vuln, but which is compiled/linked into other products. Any proprietary product which uses a known vuln in their software supply chain should have to either fix it (by releasing a patch) or make a public statement that the upstream vuln does not create a software vuln downstream or suffer liability. This already happens with companies/products that do this with large contracts. The Missouri Governor is a political stooge, but his Department of Justice is prosecuting what the journalist did after he took the PII that was embedded in the page. We will have to wait to see if that was legal. I suspect he took a SSN that was in the page and used it to fill in a web form, which could be prosecuted as fraud. That would be an example where good faith efforts by security researchers should be exempted from prosecution, but has no relevance to this German proposal. Your complaints seem to be extremely defensive/reticent. I think such posture is only useful if you also consider the value
- pjmlp 5y ago
  Same applies to small food places that need to comply with food regulations.

buscoquadnary 5y ago

From what I understand Germany already is not very start-up friendly it seems like this further exactrebates it. I put together a weekend project to see how it goes, I have a bug somewhere I didn't think of now BAM I'm on the hook for millions of dollars in "damages." Another much more chilling question is what happens to FOSS projects? Is Germany going to start going against every software developer that uploads an MIT licensed package on Github? What about the Log4j vulnerability who is on the hook for that? I agree security needs to be taken more seriously and we need to step up our game, but I grow concerned when the government starts making broad laws like this.

felixrieseberg 5y ago
You seem to misunderstand the original request _and_ the proposal. We so far only have the CCC's request, no further details are known. If you go by the proposal, FOSS and Open Source is out of scope. In the case of Log4j, companies knowingly selling software that contains in insecure version of Log4j now need to own that defect.
- tasubotadas 5y ago
  What if they claim that they don't know? You know... haven't got the memo.
  - einherjae 5y ago
    Not sure if you’re already trying to make a joke, but there’s a word for that, isn’t there? Negligence. Doesn’t help your local restaurant if they didn’t get the memo about the poisonous scallops, particularly if there existed a regular scallop-poison-level newsletter they could check.
  - Flocular 5y ago
    that could still be considered negligent, if it has a CVE and you're using it, you gotta know about it
A4ET8a8uTh0 5y ago

c-linkage 5y ago

I feel this is an important step in turning software programming into an actual engineering discipline. Engineers that design bridges and buildings are liable when these structures fail and cause damage or loss of life. Lessons-learned are critical to ensuring corrective actions are taken to ensure similar failures don't happen in the future. Software development has almost none of that. The lessons of the past are relearned on an apparent two to four year cycle.

buscoquadnary 5y ago
This is a great lesson on bridge building and software engineering. http://thecodelesscode.com/case/154 http://thecodelesscode.com/case/154
- tjalfi 5y ago
  Jon Bentley's The Back of the Envelope[0] has a much better lesson about bridge building and software design. "Most of you," says Vyssotsky, "probably recall pictures of 'Galloping Gertie,' the Tacoma Narrows bridge which tore itself apart in a windstorm in 1940. Well, suspension bridges had been ripping themselves apart that way for 80 years or so before Galloping Gertie. It's an aerodynamic lift phenomenon, and to do a proper engineering calculation of the forces, which involve drastic nonlinearities, you have to use the mathematics and concepts of Kolmogorov to model the eddy spectrum. Nobody really knew how to do this correctly in detail until the 1950s or thereabouts. So, why hasn't the Brooklyn Bridge torn itself apart, like Galloping Gertie? "It's because John Roebling had sense enough to know what he didn't know. His notes and letters on the design of the Brooklyn Bridge still exist, and they are a fascinating example of a good engineer recognizing the limits of his knowledge. He knew about aerodynamic lift on suspension bridges; he had watched it. And he knew he didn't know enough to model it. So he designed the stiffness of the truss on the Brooklyn Bridge roadway to be six times what a normal calculation based on known static and dynamic loads would have called for. And, he specified a network of diagonal stays running down to the roadway, to stiffen the entire bridge structure. Go look at those sometime; they're almost unique. "When Roebling was asked whether his proposed bridge wouldn't collapse like so many others, he said, 'No, because I designed it six times as strong as it needs to be, to prevent that from happening.' "Roebling was a good engineer, and he built a good bridge, by employing a huge safety factor to compensate for his ignorance. Do we do that? I submit to you that in calculating performance of our real-time software systems we ought to derate them by a factor of two, or four, or six, to compensate for our ignorance. In making reliability/availability commitments, we ought to stay back from the objectives we think we can meet by a factor of ten, to compensate for our ignorance. In estimating size and cost and schedule, we should be conservative by a factor of two or four to compensate for our ignorance. We should design the way John Roebling did, and not the way his contemporaries did-- so far as I know, none of the suspension bridges built by Roebling's contemporaries in the United States still stands, and a quarter of all the bridges of any type built in the U.S. in the 1870s collapsed within ten years of construction. "Are we engineers, like John Roebling? I wonder." [0] https://www.seltzer.com/margo/teaching/CS508.19/background/p180-bentley.pdf https://www.seltzer.com/margo/teaching/CS508.19/background/p...

felixrieseberg 5y ago

Before you pick up pitchforks, it's important to understand that this has been requested by the reputable Chaos Computer Club for years. It's targeted at commercial proprietary software with disclosed and unfixed vulnerabilities. In other words, if you're knowingly selling software that materially harms your users, you're on the hook. As an example: You're buying "Foo Professional" from MegaCorp. It contains an insecure version of Log4j. You're paying MegaCorp $500,000 per year for license fees. MegaCorp refuses to patch the used version of Log4j. With this proposal, you now have a legal basis for arguing that you _deserve_ a fixed version of "Foo Professional" unless MegaCorp told you clearly by which date "Foo Professional" expired. I think that's a sensible way to think about it.

buscoquadnary 5y ago
All software has bugs, some of those bugs will necessarily lead to security issues. The German government can't investigate every product out there, so this will either be a reactionary only measure, that does nothing but cause organizations to simply try and hide what they are doing from the German government, or more chillingly it becomes selectively enforced to punish the politically unpopular and reward the politically favored.
- pjmlp 5y ago
  Same thing applies to surprise visits from regulation authorities to all kind of business, nothing special about software shops.
- mschuster91 5y ago
  That's exactly the same what was said for the GDPR... and no one will deny that the GDPR was effective in forcing the industry to adhere to at least some common sense standards. And yes, part of both the GDPR and the CCC proposal is effectively weeding out those whose business model is solely to undercut legitimate competition by putting their customers at risk of losing control of their data or of wasting money on products that are effectively a danger to their data sometimes not even a year after they were bought (looking at you here, cheap-ass Android phones).

javajosh 5y ago

Are there any software firms, or individuals, who volunteer to accept liability, as a competitive advantage?

arkitaip 5y ago
Those are called insurance agencies.
johnx5c 5y ago
Every company developing medical and automotive software for production use (ISO 262652 etc).
dathinab 5y ago
Not volunteer, but seeing it as advantage of required widely. Yes such which are dependent on their party software components they pay for. Like companies using payment system plugins. Or smaller laptop/computer/smartphone manufacturers.

onox 5y ago

If you want to avoid vulnerabilities and have fun with proving that your code is functionally correct, try the Ada/SPARK interactive tutorials at [1] :) [1] https://learn.adacore.com/courses/intro-to-spark/chapters/01_Overview.html https://learn.adacore.com/courses/intro-to-spark/chapters/01...

protomyth 5y ago

I expect in my lifetime insurance policy will get to dictate software practices and only certified software engineers will be allowed to program software. I also think anyone who believes this won't be applied to free / open source is fooling themselves. Other profession had hundreds of years to mature, but software will not be allowed time to grow.

laurent92 5y ago
Yes. Free OSS is like “I build bridges for free as an architect” or “I dig wells for free in Africa.” It may be free but we still need to ensure its security. And this is how, I believe, AWS will become kind of required, as it will be the only way to get a certified-up-to-date version of a Linux, of a database, of a library, etc. And programmers will only be responsible for the glue code between those services.
- dathinab 5y ago
  It's more like "I build a bridge blue print for free as an hobby project". Which is ok. (As long as you don't claim that it's something it's not.) And it's also ok for a company to actually use your blueprint (ignore copyright for a moment). The problem is if a company uses the hobbist blue print without verifying that it fulfills necessary requirements, like being safe in case of an earth quake.
pjmlp 5y ago
I am ok with it, https://www-oern-pt.translate.goog/v-0C0J0H/informatica?_x_tr_sch=http&_x_tr_sl=pt&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp https://www-oern-pt.translate.goog/v-0C0J0H/informatica?_x_t...
turminal 5y ago
You're saying this as if you're very convinced it's a bad thing. Why? I'm not so sure it's a bad thing.
- protomyth 5y ago

perihelions 5y ago

Here's a mirror if anyone else needs one: https://archive.is/42K8j https://archive.is/42K8j

cblconfederate 5y ago

I wish they did the same for governments and lawmakers

pjmlp 5y ago

Finally it is happening, great news.

tasubotadas 5y ago

Why not let market figure this out? Companies that do not provide support are bound to be eaten by the others.

pjmorris 5y ago
If you had asked the same question about airlines 100 years ago... [0] "At the urging of the aviation industry, that believed the airplane could not reach its full commercial potential without federal action to improve and maintain safety standards,[citation needed] President Calvin Coolidge appointed a board to investigate the issue. The board's report favored federal safety regulation.[10] To that end, the Air Commerce Act became law on May 20, 1926.[11]" [0] https://en.wikipedia.org/wiki/United_States_government_role_in_civil_aviation#Air_Commerce_Act https://en.wikipedia.org/wiki/United_States_government_role_...
- tasubotadas 5y ago
  Market incumbents quite often welcome the new regulation. It helps them to avoid competition by creating entry barriers.
  - pjmorris 5y ago
    OK, here's an even older instance of the same thing, probably not advocated for by the industry incumbents... 229 If a builder builds a house for someone, and does not construct it properly, and the house which he built falls in and kills its owner, then that builder shall be put to death. - Code of Hammurabi, ~ 1700 BC [0] [0] https://avalon.law.yale.edu/ancient/hamframe.asp https://avalon.law.yale.edu/ancient/hamframe.asp
bitcharmer 5y ago
Something tells me you're from USA. Americans let the market figure out public health service and prison systems. We can all see what that did to that country and its people. Free market without any regulation whatsoever can absolutely work to the detriment of society.

ReleaseCandidat 5y ago

This is not so much 'against bugs', but to force companies to update their software and firmware against known problems. And the companies have to explicitly set a date when no more (security) updates are going to be made - for devices like WIFI router firmware. The german text: Der CCC fordert dort eine "Haftung bei unkorrigierten oder gehäuften IT-Sicherheitsproblemen inklusive einer Versicherungspflicht, zwingender Angabe eines Verfallsdatums [...]

leifg 5y ago

To everyone saying my weekend project is going to be on the hook for millions: The keyword here is "fahrlässig" (translates to negligent). Whoever is damaged must be able to prove that a bug caused through your program was negligent. I myself have tons of weekend project that have no stakes at all (most are libraries that are used by essentially no one and I make $0 from all of them combined) and even there I spend a little bit of time keeping dependencies up to that. With the few bug reports I get I at least look into them. It will be very hard to extort any money out of me under this law. If you are running a startup and making money you will need to allocate resources to maintenance, stability and bug fixing.

exabrial 5y ago

"Move slower and build stuff that lasts"

dang 5y ago

We have deep respect for German and other languages, but HN is an English-language site, so posts here need to be in English. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20english%20language%20site&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

sva_ 5y ago
I understand. I couldn't find an English source for it yet, but the post should probably be updated with one, once it appears.

radu_floricica 5y ago

I don't know. This is the kind of decision where the upside is very visible and easy to argue for, and the downside is much less visible, very spread out, and usually a couple of orders of magnitude larger than you'd first guess. Dev doing a successful OOS project in his spare time is something that fortunately still happens. Dev doing a successful OOS project _and_ accepting liability for potential mistakes is something I really expect to see less of. Plus don't forget the death by a thousand papercuts. If you have this regulation, and that liability, and who knows what else - this is a very time-tested pattern: it raises barriers to entry in an industry and favors large, incumbent companies. Paying a lawyer is a small price to be sure that you can't have competitors smaller than that.

paulmd 5y ago
Dev doing a FOSS project is specifically out of scope of the proposal, so this is FUD.

tannhaeuser 5y ago

As a manufacturer, you're already liable for damages caused by negligence, similar to Common Law jurisdictions I guess. So how does this proposed law go beyond that? Is merely using unpatched software negligent, and is a bill of materials or something required to make claims practical? Maybe the law also wants to target the bad practice of eg. Android phone manufacturers stopping to provide updates 2-3 years after purchase if at all?