3 ms·

Who do you consider responsible for the code in products we ship? Is it users? It can’t be. They aren’t engineers, and even the users who are don’t have access

Who do you consider responsible for the code in products we ship? Is it users? It can’t be. They aren’t engineers, and even the users who are don’t have access to our source code. Is it the government? No. Is it … nobody? That sounds like a terrible idea. The only people left are us. The company or team who ships a product. This is the same as everything else in civilisation. I’m responsible for food I sell. If I sell you poisoned food, you can sue me for the harm my food caused. If you hire me to build a house, I’m responsible for making the house safe. If the house falls down and injures you, you can sue me for damages. The general principle is that we are responsible to our neighbours insofar as our actions could foreseeably hurt one another. Lawyers call it Tort Law and frankly it makes sense. Why should software be exempt? As for opensource - if you pull in a random (free) MIT licenced piece of code on GitHub, one of the license conditions is that you take all responsibility for the software. The opensource dev isn’t responsible and (I am not a lawyer) almost certainly wouldn’t be held liable for bugs.

tasubotadas 5y ago
Users. They shouldn't use software that they haven't wetted as secure. No amount of regulation will save users from installing a hundred of toolbars if they want to do that. But it will hinder legitimate programmers from publishing useful software (especially free and open source software).
- einherjae 5y ago
  That only makes sense for FOSS, where part of the deal is that the software is provided for free, but with no guarantees about fitness for purpose. Would you except restaurant-goers to be liable if they get poisoned? Now compare that to picking your own mushrooms, or dumpster diving. Part of the deal when you start charging for something, has to be that the customer can expect the product to… work.
- cdirkx 5y ago
  How is this different from saying "We shouldn't cross bridges that we haven't vetted as structurally sound."? I don't expect everyone to have an architectural degree, as well as the time and resources to verify everything without access to the building plans.
- josephg 5y ago
  Huh? How?? How are users supposed to vet all the software we run? How are you supposed to know that a compiled binary from Wacom snoops on your computer? That gmail - or, worse, some random startup has no security vulnerabilities? Users don’t have time to read the source code for every product. Even if they did, we don’t have the source code for most software on our devices. And even if we could get that, we don’t have access to any of the code running on someone’s web server. Saying users are responsible is the same as saying nobody is responsible. The only way a user can take responsibility is to refuse to use products and services from startups & young companies who don’t have a reputation yet. And if people feel the need to start doing that, it’s bad for everyone.
kjksf 5y ago
responsible is not the same thing as "liable for damages" Obviously the companies are responsible for the stuff they make. If companies make crappy software or groceries stock rotten vegetables the invisible hand of the market will take care of it and put them out of business. This law, while well meaning, has obvious side effects that might make things worse than they are today. Most importantly it creates an incentive for companies to create a culture of not looking for vulnerabilities. If they have a vulnerability they don't know about, they are fine. If they do know about it, they are potentially liable. Then there's the issue of who decides what is a vulnerability. And if you think that's obvious just read "The Old New Things" blog for many examples of "vulnerability" reports that boil down to "If I can run program with admin privilege's, I can do bad stuff". Or look at US senators and governors who think that looking at HTML is hacking. Finally, not of that is free. Government doesn't make money, it takes it from you. So when we create new regulation that require more government employees, you're paying for it, indirectly.
- aphexairlines 5y ago
  > the invisible hand The FDA has 18,000 employees. The USDA has around 100,000.
- paulmd 5y ago
  > If companies make crappy software or groceries stock rotten vegetables the invisible hand of the market will take care of it and put them out of business. The problem with IOT, routers, etc with unpatched vulnerabilities are much more akin to dumping toxic waste or spewing smog than a grocery equipment supplier making poor-quality goods. A grocer would naturally choose equipment that didn't fail and cost them inventory, but unpatched devices affect all of us, even the ones who didn't choose to purchase that equipment. And far from the invisible hand of the free market shutting them out, it actually tends to encourage this behavior (absent regulation) because it's cheaper to dump the waste in the river (not patch your known-vulnerable commercial software) than to pay to have it handled properly, and the market generally favors cheap above all else. It's a classic tragedy of the commons situation, and that's where regulations are important. > Then there's the issue of who decides what is a vulnerability. And if you think that's obvious just read "The Old New Things" blog for many examples of "vulnerability" reports that boil down to "If I can run program with admin privilege's, I can do bad stuff". Or look at US senators and governors who think that looking at HTML is hacking. Uh, MITRE already does that. The CVE list is a thing that exists, it works well and isn't filled with a bunch of nonsense. Some blog being bad doesn't mean there's no way to systematically track vulnerabilities and their severity. This is nonsense throwing up your hands "who can, truly, know anything!?". We can, and we already do. > Finally, not of that is free. Government doesn't make money, it takes it from you. So when we create new regulation that require more government employees The beautiful thing is, this isn't about the government enforcing these regulations - this is about creating a civil claim by the customers of the business. The business will provide a support window for critical security vulnerabilities, and if they fail to meet it, they're liable just like any other support contract. It's a free market solution, in fact!

tasubotadas 5y ago

Users. They shouldn't use software that they haven't wetted as secure. No amount of regulation will save users from installing a hundred of toolbars if they want to do that. But it will hinder legitimate programmers from publishing useful software (especially free and open source software).

einherjae 5y ago
That only makes sense for FOSS, where part of the deal is that the software is provided for free, but with no guarantees about fitness for purpose. Would you except restaurant-goers to be liable if they get poisoned? Now compare that to picking your own mushrooms, or dumpster diving. Part of the deal when you start charging for something, has to be that the customer can expect the product to… work.
cdirkx 5y ago
How is this different from saying "We shouldn't cross bridges that we haven't vetted as structurally sound."? I don't expect everyone to have an architectural degree, as well as the time and resources to verify everything without access to the building plans.
josephg 5y ago
Huh? How?? How are users supposed to vet all the software we run? How are you supposed to know that a compiled binary from Wacom snoops on your computer? That gmail - or, worse, some random startup has no security vulnerabilities? Users don’t have time to read the source code for every product. Even if they did, we don’t have the source code for most software on our devices. And even if we could get that, we don’t have access to any of the code running on someone’s web server. Saying users are responsible is the same as saying nobody is responsible. The only way a user can take responsibility is to refuse to use products and services from startups & young companies who don’t have a reputation yet. And if people feel the need to start doing that, it’s bad for everyone.

kjksf 5y ago

responsible is not the same thing as "liable for damages" Obviously the companies are responsible for the stuff they make. If companies make crappy software or groceries stock rotten vegetables the invisible hand of the market will take care of it and put them out of business. This law, while well meaning, has obvious side effects that might make things worse than they are today. Most importantly it creates an incentive for companies to create a culture of not looking for vulnerabilities. If they have a vulnerability they don't know about, they are fine. If they do know about it, they are potentially liable. Then there's the issue of who decides what is a vulnerability. And if you think that's obvious just read "The Old New Things" blog for many examples of "vulnerability" reports that boil down to "If I can run program with admin privilege's, I can do bad stuff". Or look at US senators and governors who think that looking at HTML is hacking. Finally, not of that is free. Government doesn't make money, it takes it from you. So when we create new regulation that require more government employees, you're paying for it, indirectly.

aphexairlines 5y ago
> the invisible hand The FDA has 18,000 employees. The USDA has around 100,000.
paulmd 5y ago
> If companies make crappy software or groceries stock rotten vegetables the invisible hand of the market will take care of it and put them out of business. The problem with IOT, routers, etc with unpatched vulnerabilities are much more akin to dumping toxic waste or spewing smog than a grocery equipment supplier making poor-quality goods. A grocer would naturally choose equipment that didn't fail and cost them inventory, but unpatched devices affect all of us, even the ones who didn't choose to purchase that equipment. And far from the invisible hand of the free market shutting them out, it actually tends to encourage this behavior (absent regulation) because it's cheaper to dump the waste in the river (not patch your known-vulnerable commercial software) than to pay to have it handled properly, and the market generally favors cheap above all else. It's a classic tragedy of the commons situation, and that's where regulations are important. > Then there's the issue of who decides what is a vulnerability. And if you think that's obvious just read "The Old New Things" blog for many examples of "vulnerability" reports that boil down to "If I can run program with admin privilege's, I can do bad stuff". Or look at US senators and governors who think that looking at HTML is hacking. Uh, MITRE already does that. The CVE list is a thing that exists, it works well and isn't filled with a bunch of nonsense. Some blog being bad doesn't mean there's no way to systematically track vulnerabilities and their severity. This is nonsense throwing up your hands "who can, truly, know anything!?". We can, and we already do. > Finally, not of that is free. Government doesn't make money, it takes it from you. So when we create new regulation that require more government employees The beautiful thing is, this isn't about the government enforcing these regulations - this is about creating a civil claim by the customers of the business. The business will provide a support window for critical security vulnerabilities, and if they fail to meet it, they're liable just like any other support contract. It's a free market solution, in fact!