3 ms·

That sounds great(-ish) when the company in question is one like SolarWinds that does hundreds of millions in revenue, but people and companies are equally reli

That sounds great(-ish) when the company in question is one like SolarWinds that does hundreds of millions in revenue, but people and companies are equally reliant on open source software or software from tiny businesses. Trying to fine random Github users or the Linux foundation or whoever seems like a losing strategy. It also ignores the point from the article that the solution can't be trying to make all software secure. Whatever the incentive mechanism and whatever the source of the insecurity, it's unrealistic to think we're ever going to be able to make that a reality. But designing the environments software is used in such that broken software isn't the end of the world seems doable, if also incredibly difficult.

Veserv 3y ago
You do not fine Home Depot if a suspension bridge fails because the builder decided to go there and buy the cheapest rivets to hold up their suspension bridge instead of sourcing components that meet the design specifications. You fine the bridge builder for using components unfit for purpose. For that matter, even considering to use components that unfit for purpose is inconceivable in most professions. Only in software do people use systems with no specifications, no guarantees, and where even the component makers did not intend or design them to be load bearing.