3 ms·

This makes the work of independent contractors more or less impossible. Only big software houses will be able to afford the insurance needed to deploy software

by sprash 5y ago

This makes the work of independent contractors more or less impossible. Only big software houses will be able to afford the insurance needed to deploy software in general.

adventured 5y ago
While that's absolutely correct, fortunately it's only true for Germany, which will further cripple itself in the tech world. The Germans are already decades behind the US in that space, this will just keep things as they are, which I appreciate. Were the Germans acting rationally, applying their potential fully, they'd be a global tech juggernaut, including in software. The more they trip themselves up, the longer the US can easily keep its crown and the trillions of dollars that go with it. And it's kind of cute how SAP now fits in Microsoft's pocket.
- mschuster91 5y ago
  > While that's absolutely correct, fortunately it's only true for Germany, which will further cripple itself in the tech world. Sooner or later this will be an EU proposal anyway like the GDPR. > The more they trip themselves up, the longer the US can easily keep its crown and the trillions of dollars that go with it. A lot of the success of the US tech giants is built upon the cost of people suffering in a myriad of ways, from the cost of following up with data thefts to literal death from exploitative working conditions. European countries - while not perfect - tend to value their citizens a bit more than the US... and if the US continues on its current path, it may very well see the consequences of dissatisfied citizens. The election of the 45th President was only the beginning of what may happen.
White_Wolf 5y ago
I'm not so sure about that. Most likely, there will be a burden of proof on whoever makes a claim of this type. Just think about how many various lib's are involved in one application. If the problem lies in one of the libs, they'll hunt down whoever made it. I have mixed feelings about a law like this but I can't say I don't agree with something like this as a principle for paid software. Maybe liability will reduce the number of backdoors in software that we pay for. As for FOSS projects on github and such, there is no contractual obigation of any kind as long as you don't see lic's or stuff like that. That being said... I've heard some horror stories that defy common sense so wouldn't be surprised by anything.
thephyber 5y ago
According to the top HN comment right now, the new risk only applies to closed source software which has known/disclosed vulns before the software’s declared lifespan ends. This is not draconian to reasonable software firms and is analogous to structural/civil engineering.
- kjksf 5y ago
  Which seems like a great incentive for companies to: a) not look for vulnerabilities b) if they are found anyway, to not classify them as vulnerabilities (but regular bugs) Then what? Relying on unpaid people to find and disclose vulnerabilities? And what about all the people who think that they found a vulnerability but didn't? Consider that there are US senators and governors that think reading HTML code is hacking. What bureaucracy will we have to build to decide what is and isn't a vulnerability?
  - thephyber 5y ago
    After having typed out a response, your comment just looks like bad faith foot dragging. This is Germany. Lots of software companies already do this type of work with SOC2 or FedRamp contracts. A vuln is typically reported to NIST and assigned a CVE record. That 3rd party system allows for embargo, publish, dispute, etc. If a manufacturer denies that is is a vuln, the researcher can release their work and malicious actors could prove the manufacturer wrong. I work in cybersecurity, so this isn’t new to me. Maybe it is new to you… ? These companies already have reasons not to look for vulns. IMHo they need more incentives (eg. Regulator/economic pressure) to look for them. My guess is that this rule is being pushed in the aftermath of Log4j, which is a publicly identified CVE/vuln, but which is compiled/linked into other products. Any proprietary product which uses a known vuln in their software supply chain should have to either fix it (by releasing a patch) or make a public statement that the upstream vuln does not create a software vuln downstream or suffer liability. This already happens with companies/products that do this with large contracts. The Missouri Governor is a political stooge, but his Department of Justice is prosecuting what the journalist did after he took the PII that was embedded in the page. We will have to wait to see if that was legal. I suspect he took a SSN that was in the page and used it to fill in a web form, which could be prosecuted as fraud. That would be an example where good faith efforts by security researchers should be exempted from prosecution, but has no relevance to this German proposal. Your complaints seem to be extremely defensive/reticent. I think such posture is only useful if you also consider the value
pjmlp 5y ago
Same applies to small food places that need to comply with food regulations.

by sprash 5y ago

This makes the work of independent contractors more or less impossible. Only big software houses will be able to afford the insurance needed to deploy software in general.

adventured 5y ago

While that's absolutely correct, fortunately it's only true for Germany, which will further cripple itself in the tech world. The Germans are already decades behind the US in that space, this will just keep things as they are, which I appreciate. Were the Germans acting rationally, applying their potential fully, they'd be a global tech juggernaut, including in software. The more they trip themselves up, the longer the US can easily keep its crown and the trillions of dollars that go with it. And it's kind of cute how SAP now fits in Microsoft's pocket.

mschuster91 5y ago
> While that's absolutely correct, fortunately it's only true for Germany, which will further cripple itself in the tech world. Sooner or later this will be an EU proposal anyway like the GDPR. > The more they trip themselves up, the longer the US can easily keep its crown and the trillions of dollars that go with it. A lot of the success of the US tech giants is built upon the cost of people suffering in a myriad of ways, from the cost of following up with data thefts to literal death from exploitative working conditions. European countries - while not perfect - tend to value their citizens a bit more than the US... and if the US continues on its current path, it may very well see the consequences of dissatisfied citizens. The election of the 45th President was only the beginning of what may happen.

White_Wolf 5y ago

I'm not so sure about that. Most likely, there will be a burden of proof on whoever makes a claim of this type. Just think about how many various lib's are involved in one application. If the problem lies in one of the libs, they'll hunt down whoever made it. I have mixed feelings about a law like this but I can't say I don't agree with something like this as a principle for paid software. Maybe liability will reduce the number of backdoors in software that we pay for. As for FOSS projects on github and such, there is no contractual obigation of any kind as long as you don't see lic's or stuff like that. That being said... I've heard some horror stories that defy common sense so wouldn't be surprised by anything.

thephyber 5y ago

According to the top HN comment right now, the new risk only applies to closed source software which has known/disclosed vulns before the software’s declared lifespan ends. This is not draconian to reasonable software firms and is analogous to structural/civil engineering.

kjksf 5y ago
Which seems like a great incentive for companies to: a) not look for vulnerabilities b) if they are found anyway, to not classify them as vulnerabilities (but regular bugs) Then what? Relying on unpaid people to find and disclose vulnerabilities? And what about all the people who think that they found a vulnerability but didn't? Consider that there are US senators and governors that think reading HTML code is hacking. What bureaucracy will we have to build to decide what is and isn't a vulnerability?
- thephyber 5y ago
  After having typed out a response, your comment just looks like bad faith foot dragging. This is Germany. Lots of software companies already do this type of work with SOC2 or FedRamp contracts. A vuln is typically reported to NIST and assigned a CVE record. That 3rd party system allows for embargo, publish, dispute, etc. If a manufacturer denies that is is a vuln, the researcher can release their work and malicious actors could prove the manufacturer wrong. I work in cybersecurity, so this isn’t new to me. Maybe it is new to you… ? These companies already have reasons not to look for vulns. IMHo they need more incentives (eg. Regulator/economic pressure) to look for them. My guess is that this rule is being pushed in the aftermath of Log4j, which is a publicly identified CVE/vuln, but which is compiled/linked into other products. Any proprietary product which uses a known vuln in their software supply chain should have to either fix it (by releasing a patch) or make a public statement that the upstream vuln does not create a software vuln downstream or suffer liability. This already happens with companies/products that do this with large contracts. The Missouri Governor is a political stooge, but his Department of Justice is prosecuting what the journalist did after he took the PII that was embedded in the page. We will have to wait to see if that was legal. I suspect he took a SSN that was in the page and used it to fill in a web form, which could be prosecuted as fraud. That would be an example where good faith efforts by security researchers should be exempted from prosecution, but has no relevance to this German proposal. Your complaints seem to be extremely defensive/reticent. I think such posture is only useful if you also consider the value

pjmlp 5y ago

Same applies to small food places that need to comply with food regulations.