5 ms·

I think this reading is _mostly_ right. To make it a little clearer: 1. A rules-based approach to define a minimum standard, likely based around existing descr

I think this reading is _mostly_ right. To make it a little clearer: 1. A rules-based approach to define a minimum standard, likely based around existing descriptions of software weaknesses where the rules basically say "you aren't allowed to have this type of software weakness" (the doc specifically gives path traversal as an example). HOWEVER, liability would only be established if a weakness is actually exploited, to help avoid the problem of people proactively scanning for weaknesses and then troll-suing as a way to make money. 2. A process-based safe harbor to avoid liability for exploitation of weaknesses NOT on the rules-based "no no list." Basically, if you can show you followed the safe harbor process requirements, you get the benefit of the safe harbor. This is to protect and encourage organizations to go above and beyond the floor established by the rules-based standard.

mustache_kimono 3y ago
> HOWEVER, liability would only be established if a weakness is actually exploited, to help avoid the problem of people proactively scanning for weaknesses and then troll-suing as a way to make money. Agreed. Torts require damages.
- alilleybrinker 3y ago
  Yeah, the doc acknowledges this concept is "drawing on tort law principles." In this case the author, Jim Dempsey, is proposing a rules-based framework for establishing a floor regardless of what underlying system is used (warranty, torts, etc.). So he's not _inherently_ assuming a tort law framing, and is instead making a recommendation for how it should operate regardless of whether the resulting system is based around tort law.
  - mustache_kimono 3y ago
    > So he's not _inherently_ assuming a tort law framing, and is instead making a recommendation for how it should operate regardless of whether the resulting system is based around tort law. Not to get too in the weeds, but breaches of implied warranties were once/began as torts. But, yes, I guess I was a little glib. I should have said -- it would be sensible to require damages for these types of actions. Although I'm not sure I agree with the author's formulation: > HOWEVER, liability would only be established if a weakness is actually exploited, to help avoid the problem of people proactively scanning for weaknesses and then troll-suing as a way to make money. I think we should encourage customers to look for vulnerabilities. Damages analyses can take into account depreciation, reasonableness of damages/troll suing, etc. If you have 100s of devices you must replace because the vendor won't patch, and your patch request is reasonable (high consequence vulnerability) within 5 years of purchase, I think damages accounting for depreciation make sense, without proof of exploitation. EDIT: Implied 2nd quoted portion was the parent commenter's notion when it was a summary of the author's position.
    - alilleybrinker 3y ago
      To be clear, I wasn’t staking anything as my position. I was summarizing the position of the author.
- bee_rider 3y ago
  It seems like an odd framing to me. If you have a vulnerable device, you’ll need to replace it, whether or not it is actively being exploited. So, you’ve been damaged by the device producer’s negligence.
  - mustache_kimono 3y ago
    Imagine: The vulnerable device is on your internal network, and the likelihood of damages is very small. I suppose you can construct a regime in which feds come in a fine you simply for having an insecure device, but a lighter touch approach is to wait for damages, which given this scenario, perhaps never comes.
    - bee_rider 3y ago
      I think I might not have been totally clear. If you’ve been sold a vulnerable device, you are the victim. You have to replace the device. The damage is to you, the one who did the damage is the company that sold you a defective device. They should pay to replace the functionality, and some punitive fine, as a start. Then we can get into whatever damage their negligently designed device did (did it participate in a DDOS? Did it attack other devices on your network?)
      - mustache_kimono 3y ago
        > If you’ve been sold a vulnerable device, you are the victim. Ahh. Simply having to replace a defective device would be "damages". The only Q would be: Was it reasonable to replace given the threat?
        bee_rider 3y ago
        I’ve edited it, hopefully for clarity :)
  - abirch 3y ago
    You seem to have fortunately survived orphaned software. I've seen scientific software running on a 15 year old OS. The lab equipment functioned so we took out the Ethernet port to prevent viruses.

mustache_kimono 3y ago

> HOWEVER, liability would only be established if a weakness is actually exploited, to help avoid the problem of people proactively scanning for weaknesses and then troll-suing as a way to make money. Agreed. Torts require damages.

alilleybrinker 3y ago
Yeah, the doc acknowledges this concept is "drawing on tort law principles." In this case the author, Jim Dempsey, is proposing a rules-based framework for establishing a floor regardless of what underlying system is used (warranty, torts, etc.). So he's not _inherently_ assuming a tort law framing, and is instead making a recommendation for how it should operate regardless of whether the resulting system is based around tort law.
- mustache_kimono 3y ago
  > So he's not _inherently_ assuming a tort law framing, and is instead making a recommendation for how it should operate regardless of whether the resulting system is based around tort law. Not to get too in the weeds, but breaches of implied warranties were once/began as torts. But, yes, I guess I was a little glib. I should have said -- it would be sensible to require damages for these types of actions. Although I'm not sure I agree with the author's formulation: > HOWEVER, liability would only be established if a weakness is actually exploited, to help avoid the problem of people proactively scanning for weaknesses and then troll-suing as a way to make money. I think we should encourage customers to look for vulnerabilities. Damages analyses can take into account depreciation, reasonableness of damages/troll suing, etc. If you have 100s of devices you must replace because the vendor won't patch, and your patch request is reasonable (high consequence vulnerability) within 5 years of purchase, I think damages accounting for depreciation make sense, without proof of exploitation. EDIT: Implied 2nd quoted portion was the parent commenter's notion when it was a summary of the author's position.
  - alilleybrinker 3y ago
    To be clear, I wasn’t staking anything as my position. I was summarizing the position of the author.
bee_rider 3y ago
It seems like an odd framing to me. If you have a vulnerable device, you’ll need to replace it, whether or not it is actively being exploited. So, you’ve been damaged by the device producer’s negligence.
- mustache_kimono 3y ago
  Imagine: The vulnerable device is on your internal network, and the likelihood of damages is very small. I suppose you can construct a regime in which feds come in a fine you simply for having an insecure device, but a lighter touch approach is to wait for damages, which given this scenario, perhaps never comes.
  - bee_rider 3y ago
    I think I might not have been totally clear. If you’ve been sold a vulnerable device, you are the victim. You have to replace the device. The damage is to you, the one who did the damage is the company that sold you a defective device. They should pay to replace the functionality, and some punitive fine, as a start. Then we can get into whatever damage their negligently designed device did (did it participate in a DDOS? Did it attack other devices on your network?)
    - mustache_kimono 3y ago
      > If you’ve been sold a vulnerable device, you are the victim. Ahh. Simply having to replace a defective device would be "damages". The only Q would be: Was it reasonable to replace given the threat?
      - bee_rider 3y ago
        I’ve edited it, hopefully for clarity :)
- abirch 3y ago
  You seem to have fortunately survived orphaned software. I've seen scientific software running on a 15 year old OS. The lab equipment functioned so we took out the Ethernet port to prevent viruses.