4 ms·

As noted, I don't believe you have consensus on the 'literally every industry' interpretation and use of the word defect. But even so, you seem to be claiming

by Jedd 3y ago

As noted, I don't believe you have consensus on the 'literally every industry' interpretation and use of the word defect. But even so, you seem to be claiming that the product doesn't match "stated specifications, guarantees, or use" (I find 'use' a bit vague, but nonetheless.) Can you point at the stated specifications, guarantees of AAD / Entra that are contraindicated by this exploit having occurred? If written guarantees have in fact not been met - that could be really interesting. > These flaws are defects. You use the word flaw a few times - as something similar to a fault, here as a synonym of, or a precursor state to, a defect. If we're being persnickety about language ...

Veserv 3y ago
That is the plain meaning in basically every industry. That software people are allergic to it is because it would mean their products are defective and that is a no-no word because it means they are legally responsible for their failings. I am not being pedantic; coming up with highly-specialized words for the express purpose of downplaying failures and expecting others to play along is being pedantic and consumer-hostile. I am advocating consumer-friendly, industry standard language in this swamp of doublespeak. Are you arguing that the intended functionality of Exchange is leaking emails? No. Are you arguing that customers find their emails being leaked a desirable or neutral option? No. Are you arguing customers will accept a product that they know will leak their emails? No. So, a flaw that leaks emails makes the product unacceptable to the customer. The only possible defense for Microsoft here is that they accepted no liability or disclaimed all liability for leaking emails. It is certainly possible that Microsoft did that in their contracts. I applaud the skills of their salespeople and lawyers if they tricked the customer into accepting products inadequate for their needs. That does not stop me from calling it out as duplicitous, immoral behavior that should be stamped out. Part of this being pointing out how they have changed the words to make their statements seem less bad. The use of correct, industry-standard words makes it harder to misdirect customer intuition. Sure, in a strictly literal, legal sense, it is quite possible that they are not selling a defective product because they lied to the customer and tricked them into purchasing a substandard product. However, in the colloquial sense, they are absolutely selling a defective product as the consumer is not getting the plain meaning of what they were advertised (even though it is not contractually binding). I do not know about you, but I really think we should push for the consumer-friendly model over the lawyer-friendly one.
- mcai4mr2 3y ago
  Every lock is defective because it can be picked or bypassed. I doubt many others would phase it like the product (is actively) leaking the emails
- Jedd 3y ago
  Your point seems to come down to this argument, which I don't believe is in good faith (I don't believe the vendors are acting terribly laudably, either, but that's a separate issue). > Sure, in a strictly literal, legal sense, it is quite possible that they are not selling a defective product because they lied to the customer and tricked them into purchasing a substandard product. So you said a guarantee was broken earlier, and I asked you to demonstrate that or point to where they've committed to guaranteeing a certain quality of service. Now you have adopted a position of saying they're technically not doing anything wrong, but morally they are, which when talking about Microsoft or Amazon or Google or Apple or (etc) is a bit of a slippery slope and/or isn't really news. I see you also slipped in a 'they lied to their customers' (and 'tricked them') but if you read any EULA you'll see it's all best-effort, sold as is, no warranty for any purpose, etc etc, and this has always been the case. Should it be the case? I don't have a good answer there. If you want penalty clauses, I'm sure you can find vendors that will oblige, but a) you'll quickly have an adversarial relationship with your supplier, after b) you spend stupid numbers of monies negotiating such a contract, and c) you'll still suffer exploits and outages.
  - loup-vaillant 3y ago
    I believe they are arguing for a change in the law, so that software is held to similar standards as the other consumer facing industries. That we should not even be allowed to waive as many guarantees as we do. The EU is currently working on making that happen. The current draft looks like it could be improved, but overall this looks pretty reasonable.
    - Jedd 3y ago
      Oh, look, I get that it's a laudable goal, my point here is that we don't have that arrangement now. The nice thing about EU doing the heavy lifting on some of these tendentious subjects is that the rest of us often get to (eventually) enjoy the benefits, just because it's easier for them to not have to maintain two 'things' (product lines, releases, etc).

by Jedd 3y ago

Veserv 3y ago

That is the plain meaning in basically every industry. That software people are allergic to it is because it would mean their products are defective and that is a no-no word because it means they are legally responsible for their failings. I am not being pedantic; coming up with highly-specialized words for the express purpose of downplaying failures and expecting others to play along is being pedantic and consumer-hostile. I am advocating consumer-friendly, industry standard language in this swamp of doublespeak. Are you arguing that the intended functionality of Exchange is leaking emails? No. Are you arguing that customers find their emails being leaked a desirable or neutral option? No. Are you arguing customers will accept a product that they know will leak their emails? No. So, a flaw that leaks emails makes the product unacceptable to the customer. The only possible defense for Microsoft here is that they accepted no liability or disclaimed all liability for leaking emails. It is certainly possible that Microsoft did that in their contracts. I applaud the skills of their salespeople and lawyers if they tricked the customer into accepting products inadequate for their needs. That does not stop me from calling it out as duplicitous, immoral behavior that should be stamped out. Part of this being pointing out how they have changed the words to make their statements seem less bad. The use of correct, industry-standard words makes it harder to misdirect customer intuition. Sure, in a strictly literal, legal sense, it is quite possible that they are not selling a defective product because they lied to the customer and tricked them into purchasing a substandard product. However, in the colloquial sense, they are absolutely selling a defective product as the consumer is not getting the plain meaning of what they were advertised (even though it is not contractually binding). I do not know about you, but I really think we should push for the consumer-friendly model over the lawyer-friendly one.

mcai4mr2 3y ago
Every lock is defective because it can be picked or bypassed. I doubt many others would phase it like the product (is actively) leaking the emails
Jedd 3y ago
Your point seems to come down to this argument, which I don't believe is in good faith (I don't believe the vendors are acting terribly laudably, either, but that's a separate issue). > Sure, in a strictly literal, legal sense, it is quite possible that they are not selling a defective product because they lied to the customer and tricked them into purchasing a substandard product. So you said a guarantee was broken earlier, and I asked you to demonstrate that or point to where they've committed to guaranteeing a certain quality of service. Now you have adopted a position of saying they're technically not doing anything wrong, but morally they are, which when talking about Microsoft or Amazon or Google or Apple or (etc) is a bit of a slippery slope and/or isn't really news. I see you also slipped in a 'they lied to their customers' (and 'tricked them') but if you read any EULA you'll see it's all best-effort, sold as is, no warranty for any purpose, etc etc, and this has always been the case. Should it be the case? I don't have a good answer there. If you want penalty clauses, I'm sure you can find vendors that will oblige, but a) you'll quickly have an adversarial relationship with your supplier, after b) you spend stupid numbers of monies negotiating such a contract, and c) you'll still suffer exploits and outages.
- loup-vaillant 3y ago
  I believe they are arguing for a change in the law, so that software is held to similar standards as the other consumer facing industries. That we should not even be allowed to waive as many guarantees as we do. The EU is currently working on making that happen. The current draft looks like it could be improved, but overall this looks pretty reasonable.
  - Jedd 3y ago
    Oh, look, I get that it's a laudable goal, my point here is that we don't have that arrangement now. The nice thing about EU doing the heavy lifting on some of these tendentious subjects is that the rest of us often get to (eventually) enjoy the benefits, just because it's easier for them to not have to maintain two 'things' (product lines, releases, etc).