4 ms·
The need is certainly clear. The call this blog post makes urges action and provides useful guidance on how to get that action moving. However, without legislat
by bdamm 3y ago
The need is certainly clear. The call this blog post makes urges action and provides useful guidance on how to get that action moving. However, without legislative forcing, no such action will occur, and we will remain in the current regime where market forces such as reputational tarnish remains the most powerful driver for security choices. In some markets there are customers that must comply with regulations in their respective market, thus causing software vendors to provide more security assurance, but this is a special case and not the general case that the post here is looking for.
> The software industry must not kick the can down the road another decade through inaction.
The software industry most assuredly will, unless legislatively forced or otherwise compelled by the industrial environment.
- brundolf 3y agoIncreased liability/lawsuit-exposure seems like an efficient way to do it (certainly better than regulations with very specific criteria around how people should write software) This liability is already non-zero. I wonder if the penalty fees are too low, or if there's some kind of legal shield that reduces the risk
- pjmlp 3y agoAnother one is higher insurance fees when using unsafe tooling, just like in other industries when hazardous substances are used, or there are higher accident rates.
- scj 3y agoIs liability insurance viable? Software can be installed on billions of devices. Even a low liability could be financially ruinous... Especially for open source.
- erik_seaberg 3y agoI could see underwriting a sealed appliance, but it doesn’t seem feasible for anyone to underwrite a general-purpose computer with varying components and many programs interacting under a power user’s commands.
- fnordpiglet 3y agoLiability will kill all free software. I am not going to write a line of code that makes me personally liable.
- mywittyname 3y agoYou already have the liability, you just don't realize it because nobody has tried to sue you over anything. Laws will provide specific behaviors that constitute liability, rather than the "anything we can prove was damaging." At least a legal framework will tell you what you should and shouldn't be doing.
- fnordpiglet 3y agoToday the disclaimers in most software and the non commercial nature generally insulates you from liability unless they can demonstrate some extreme situation like maliciousness. A regulatory framework that doesn’t carve giant holes in liability for open source will stifle it, as it will erode the giant hole being used today. In the context of the topic (memory safety and other issues in software used widely) you can’t divorce that from open source and just hold commercial software culpable for their compliance. By introducing some sort of regulatory structure around software quality you necessarily either exempt open source, leaving a huge surface area untouched, or you essentially kill non commercial contribution.
- pjmlp 3y agoMost of those disclaimers don't hold in court in many jurisdictions. Also outside computing industry everyone is liable on the eyes of the law, even if doing charity.
- fnordpiglet 3y agoAny references to case law? AFAIK none really exists because it’s generally assumed that non commercial open source licenses with disclaimers are pretty legally resilient so haven’t been tested. But my scope is US only.