3 ms·

Yeah, the doc acknowledges this concept is "drawing on tort law principles." In this case the author, Jim Dempsey, is proposing a rules-based framework for esta

Yeah, the doc acknowledges this concept is "drawing on tort law principles." In this case the author, Jim Dempsey, is proposing a rules-based framework for establishing a floor regardless of what underlying system is used (warranty, torts, etc.). So he's not _inherently_ assuming a tort law framing, and is instead making a recommendation for how it should operate regardless of whether the resulting system is based around tort law.

mustache_kimono 3y ago
> So he's not _inherently_ assuming a tort law framing, and is instead making a recommendation for how it should operate regardless of whether the resulting system is based around tort law. Not to get too in the weeds, but breaches of implied warranties were once/began as torts. But, yes, I guess I was a little glib. I should have said -- it would be sensible to require damages for these types of actions. Although I'm not sure I agree with the author's formulation: > HOWEVER, liability would only be established if a weakness is actually exploited, to help avoid the problem of people proactively scanning for weaknesses and then troll-suing as a way to make money. I think we should encourage customers to look for vulnerabilities. Damages analyses can take into account depreciation, reasonableness of damages/troll suing, etc. If you have 100s of devices you must replace because the vendor won't patch, and your patch request is reasonable (high consequence vulnerability) within 5 years of purchase, I think damages accounting for depreciation make sense, without proof of exploitation. EDIT: Implied 2nd quoted portion was the parent commenter's notion when it was a summary of the author's position.
- alilleybrinker 3y ago
  To be clear, I wasn’t staking anything as my position. I was summarizing the position of the author.

3 ms·

Yeah, the doc acknowledges this concept is "drawing on tort law principles." In this case the author, Jim Dempsey, is proposing a rules-based framework for esta

by alilleybrinker 3y ago

mustache_kimono 3y ago
> So he's not _inherently_ assuming a tort law framing, and is instead making a recommendation for how it should operate regardless of whether the resulting system is based around tort law. Not to get too in the weeds, but breaches of implied warranties were once/began as torts. But, yes, I guess I was a little glib. I should have said -- it would be sensible to require damages for these types of actions. Although I'm not sure I agree with the author's formulation: > HOWEVER, liability would only be established if a weakness is actually exploited, to help avoid the problem of people proactively scanning for weaknesses and then troll-suing as a way to make money. I think we should encourage customers to look for vulnerabilities. Damages analyses can take into account depreciation, reasonableness of damages/troll suing, etc. If you have 100s of devices you must replace because the vendor won't patch, and your patch request is reasonable (high consequence vulnerability) within 5 years of purchase, I think damages accounting for depreciation make sense, without proof of exploitation. EDIT: Implied 2nd quoted portion was the parent commenter's notion when it was a summary of the author's position.
- alilleybrinker 3y ago
  To be clear, I wasn’t staking anything as my position. I was summarizing the position of the author.