5 ms·

New rule: If as a company you are providing software which is unsafe you are 100% liable for all damages. I am tired of this casual attitude towards safety.

cudder 3y ago
That's a great way to make sure no company ever releases anything open source.
- yjftsjthsd-h 3y ago
  Not just FOSS: Depending on the phrasing, that sounds like a great way to kill gratis software as well.
  - chromoblob 3y ago
    No, only unsafe gratis software would be killed.
    - hypothesis 3y ago
      Please define “unsafe”. Also, you can use most things in a harmful way…
      - chromoblob 3y ago
        Cool, but that should be directed to tomjen3. As for myself, maybe: "that which causes loss or injury to the user when handling of it does not intend this"?
    - yjftsjthsd-h 3y ago
      ...right, so that's virtually all of it. Practically speaking, all software has bugs, and any piece of software can if nothing else be used in a chained attack to cause harm.
      - chromoblob 3y ago
        > Practically speaking, all software has bugs This may change in future, e.g. by enough people turning to formal verification. > any piece of software can if nothing else be used in a chained attack to cause harm Does it mean that it is unsafe? In that case notion of safety seems to be destroyed.
        yjftsjthsd-h 3y ago
        > This may change in future, e.g. by enough people turning to formal verification. It's been over 50 years; I don't think we're on the cusp of creating perfect software. Even formal verification and related methods - while a huge improvement! - aren't a silver bullet (AIUI, mostly in the "is your model right" and "does your theoretical analysis map to reality" points). > Does it mean that it is unsafe? In that case notion of safety seems to be destroyed. Yes, that's my point. If your software has exploitable bugs, it can be used in a chain of exploits to achieve attacks that don't appear plausible from individual components, and this means that most systems have a lot more attack surface than anyone wants to think about.
        chromoblob 3y ago
        I mean if it doesn't have bugs. Like if someone uses a calculator, a map, other utilities in order to plan a mass shooting. If bugs may be there, notion of safety is fine.
tomohelix 3y ago
In many industries, e.g. biotech, this is how it works. Every product is vetted so much and has so many regulations to follow and liability to cover, the profit margins are not as big as software companies. I argue that is one of the main reasons we see so many breaches and also why software developers are paid so much compared to, say, a biopharma scientist.
- tomjen3 3y ago
  Thats a really good point. But then this is not a new type of attack, it is literally checking that you don't overflow your allocated buffer. It has been a known attack vector for 30 years.
pjmlp 3y ago
Looking forward to the day this becomes common legislation.
vitiral 3y ago
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY
- tomjen3 3y ago
  Just as disclaimers on dump trucks not being responsible for window damage, and that you cannot declare bankruptcy by just jelling it out, if the law changes this disclaimer will no longer be valid.
- pjmlp 3y ago
  Completely useless in most juridisions if someone decides to go court. What we are missing is that most people still don't do it as frequently as in other industries.

cudder 3y ago

That's a great way to make sure no company ever releases anything open source.

yjftsjthsd-h 3y ago
Not just FOSS: Depending on the phrasing, that sounds like a great way to kill gratis software as well.
- chromoblob 3y ago
  No, only unsafe gratis software would be killed.
  - hypothesis 3y ago
    Please define “unsafe”. Also, you can use most things in a harmful way…
    - chromoblob 3y ago
      Cool, but that should be directed to tomjen3. As for myself, maybe: "that which causes loss or injury to the user when handling of it does not intend this"?
  - yjftsjthsd-h 3y ago
    ...right, so that's virtually all of it. Practically speaking, all software has bugs, and any piece of software can if nothing else be used in a chained attack to cause harm.
    - chromoblob 3y ago
      > Practically speaking, all software has bugs This may change in future, e.g. by enough people turning to formal verification. > any piece of software can if nothing else be used in a chained attack to cause harm Does it mean that it is unsafe? In that case notion of safety seems to be destroyed.
      - yjftsjthsd-h 3y ago
        > This may change in future, e.g. by enough people turning to formal verification. It's been over 50 years; I don't think we're on the cusp of creating perfect software. Even formal verification and related methods - while a huge improvement! - aren't a silver bullet (AIUI, mostly in the "is your model right" and "does your theoretical analysis map to reality" points). > Does it mean that it is unsafe? In that case notion of safety seems to be destroyed. Yes, that's my point. If your software has exploitable bugs, it can be used in a chain of exploits to achieve attacks that don't appear plausible from individual components, and this means that most systems have a lot more attack surface than anyone wants to think about.
        chromoblob 3y ago
        I mean if it doesn't have bugs. Like if someone uses a calculator, a map, other utilities in order to plan a mass shooting. If bugs may be there, notion of safety is fine.

tomohelix 3y ago

In many industries, e.g. biotech, this is how it works. Every product is vetted so much and has so many regulations to follow and liability to cover, the profit margins are not as big as software companies. I argue that is one of the main reasons we see so many breaches and also why software developers are paid so much compared to, say, a biopharma scientist.

tomjen3 3y ago
Thats a really good point. But then this is not a new type of attack, it is literally checking that you don't overflow your allocated buffer. It has been a known attack vector for 30 years.

pjmlp 3y ago

Looking forward to the day this becomes common legislation.

vitiral 3y ago

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY

tomjen3 3y ago
Just as disclaimers on dump trucks not being responsible for window damage, and that you cannot declare bankruptcy by just jelling it out, if the law changes this disclaimer will no longer be valid.
pjmlp 3y ago
Completely useless in most juridisions if someone decides to go court. What we are missing is that most people still don't do it as frequently as in other industries.