4 ms·

What would have actually happened is once the first programmer realised you could get a speed bump by putting all your objects inside a single segment, we'd hav

by rwmj 4y ago

What would have actually happened is once the first programmer realised you could get a speed bump by putting all your objects inside a single segment, we'd have been back to where we are now. Which is roughly what happened to the 286 which borrowed some of the 432 concepts -- every practical OS ignored the call gates, segments, and all but two of the rings.

pjmlp 4y ago
That is what happens without liability, finally cybersecurity laws are fixing this.
- AnimalMuppet 4y ago
  They are? In what jurisdictions?
  - pjmlp 4y ago
    US and EU,slowly getting there. https://www.sonatype.com/national-cybersecurity-strategy-what-you-should-know https://www.sonatype.com/national-cybersecurity-strategy-wha... https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act https://digital-strategy.ec.europa.eu/en/library/cyber-resil... The rest will follow.
    - AnimalMuppet 4y ago
      That doesn't seem to point me to any actual laws in the US...
      - pjmlp 4y ago
        https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/02/fact-sheet-biden-harris-administration-announces-national-cybersecurity-strategy/ https://www.whitehouse.gov/briefing-room/statements-releases... > Shifting liability for software products and services to promote secure development practices; and,
        AnimalMuppet 4y ago
        Great. That's a strategy statement. Got any actual laws? Any bills proposed, even?
        pjmlp 4y ago
        It has to start somewhere, keep your scepticism and you'll be rewarded.
    - singleshot_ 4y ago
      The state of liability for insecure software in America is woefully bad. You’re not going to be able to apply breach of warranty under UCC. As a threshold matter, software might not even be considered a “good” and so it might not even governed by UCC. But if you did manage to apply UCC to software, the contract or license under which software is provided would have to be incompetently drafted if it were to be found that it did not effectively disclaim liability or if it was found unconscionable. There are some additional procedural hurdles concerning probity of contract but let’s leave it there Under basic tort law, a software provider would need to be found to have a duty of care in order to be found negligent, but surprisingly, this is seldom found to exist. There is also no clear standard to measure whether a software provider may have breached that duty. Intervening or superseding cause exists in almost every breach, although for security-specific software, this might not be the case (e.g., a firewall fails open might be reasonably foreseeable to cause damage by means of a hacker, against whom the firewall is meant to protect). Finally even if you get to this point, recovery may be barred or limited by the economic loss doctrine. Defective product law is even worse, due to the (inscrutable) fact that while most courts would call software a good for UCC purposes, they would not call it a product for the purposes of product defect law. There are some additional wrinkles here concerning design of software versus manufacture of software in the context of defective product design law, but we’re starting to wander out of HN post territory and into CLE territory here. Frankly if Joe Biden wanted to change every thing I just red it would be superb but I think we have to be realistic about how much influence the federal government can apply here without causing massive terrible second and third order effects. For example look back to 43 and Obama’s heavy reliance on cybersecurity insurance to advance national security interests and how quickly that turned into free payouts for everyone who could manage to get a random reared out to work.
      - singleshot_ 4y ago
        *could manage to get a ransomware kit to work.
- userbinator 4y ago
  ...if by "fixing" you mean driving us further towards corporate-authoritarian dystopia. "If you outlaw freedom, only outlaws will have freedom."
  - pjmlp 4y ago
    People have had the freedom to fix these kind of exploits by themselves for the last 50 years, apparently that wasn't enough.

by rwmj 4y ago

pjmlp 4y ago

That is what happens without liability, finally cybersecurity laws are fixing this.

AnimalMuppet 4y ago
They are? In what jurisdictions?
- pjmlp 4y ago
  US and EU,slowly getting there. https://www.sonatype.com/national-cybersecurity-strategy-what-you-should-know https://www.sonatype.com/national-cybersecurity-strategy-wha... https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act https://digital-strategy.ec.europa.eu/en/library/cyber-resil... The rest will follow.
  - AnimalMuppet 4y ago
    That doesn't seem to point me to any actual laws in the US...
    - pjmlp 4y ago
      https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/02/fact-sheet-biden-harris-administration-announces-national-cybersecurity-strategy/ https://www.whitehouse.gov/briefing-room/statements-releases... > Shifting liability for software products and services to promote secure development practices; and,
      - AnimalMuppet 4y ago
        Great. That's a strategy statement. Got any actual laws? Any bills proposed, even?
        pjmlp 4y ago
        It has to start somewhere, keep your scepticism and you'll be rewarded.
  - singleshot_ 4y ago
    The state of liability for insecure software in America is woefully bad. You’re not going to be able to apply breach of warranty under UCC. As a threshold matter, software might not even be considered a “good” and so it might not even governed by UCC. But if you did manage to apply UCC to software, the contract or license under which software is provided would have to be incompetently drafted if it were to be found that it did not effectively disclaim liability or if it was found unconscionable. There are some additional procedural hurdles concerning probity of contract but let’s leave it there Under basic tort law, a software provider would need to be found to have a duty of care in order to be found negligent, but surprisingly, this is seldom found to exist. There is also no clear standard to measure whether a software provider may have breached that duty. Intervening or superseding cause exists in almost every breach, although for security-specific software, this might not be the case (e.g., a firewall fails open might be reasonably foreseeable to cause damage by means of a hacker, against whom the firewall is meant to protect). Finally even if you get to this point, recovery may be barred or limited by the economic loss doctrine. Defective product law is even worse, due to the (inscrutable) fact that while most courts would call software a good for UCC purposes, they would not call it a product for the purposes of product defect law. There are some additional wrinkles here concerning design of software versus manufacture of software in the context of defective product design law, but we’re starting to wander out of HN post territory and into CLE territory here. Frankly if Joe Biden wanted to change every thing I just red it would be superb but I think we have to be realistic about how much influence the federal government can apply here without causing massive terrible second and third order effects. For example look back to 43 and Obama’s heavy reliance on cybersecurity insurance to advance national security interests and how quickly that turned into free payouts for everyone who could manage to get a random reared out to work.
    - singleshot_ 4y ago
      *could manage to get a ransomware kit to work.
userbinator 4y ago
...if by "fixing" you mean driving us further towards corporate-authoritarian dystopia. "If you outlaw freedom, only outlaws will have freedom."
- pjmlp 4y ago
  People have had the freedom to fix these kind of exploits by themselves for the last 50 years, apparently that wasn't enough.