5 ms·

> At this point, I have to wonder what is even the point of missives like this. ...It's all just mindless blather unless you're actually talking about ways that

by gwd 2y ago

> At this point, I have to wonder what is even the point of missives like this. ...It's all just mindless blather unless you're actually talking about ways that software vendors will be held liable for bugs in their products. I think that liability for bugs is exactly where she's going with this. I'm not an expert, but it sounds from a few things I've heard on some Lawfare podcasts (e.g,. [1][2]) like the idea of software liability has been discussed for quite a while now in government policy circles. This sort of public statement may be laying the groundwork for building the political will to make it happen. [1] https://www.youtube.com/watch?v=9UneL5-Q98E&pp=ygUQbGF3ZmFyZSBzb2Z0d2FyZQ%3D%3D https://www.youtube.com/watch?v=9UneL5-Q98E&pp=ygUQbGF3ZmFyZ... [2] https://www.youtube.com/watch?v=zyNft-IZm_A&pp=ygUQbGF3ZmFyZSBzb2Z0d2FyZQ%3D%3D https://www.youtube.com/watch?v=zyNft-IZm_A&pp=ygUQbGF3ZmFyZ... EDIT: > Making truly secure software products is incredibly hard in this day and age, which is one reason why demanding software product liability is so scary. Loads of companies already are liable for bugs software that runs on their products: this includes cars, airplanes, and I would presume medical devices, and so on. The response has been what's called "safety certification": as an industry, you define a process which, if followed, you can in court say "we were reasonably careful", and then you hire an evaluator to confirm that you have followed that process. These processes don't prevent all bugs, naturally, but they certainly go a long way towards reducing them. Liability for companies who don't follow appropriate standard processes would essentially prevent cloud companies cutting security to get an edge in time-to-market or cost.

generic92034 2y ago
> The response has been what's called "safety certification": as an industry, you define a process which, if followed, you can in court say "we were reasonably careful", and then you hire an evaluator to confirm that you have followed that process. Can you still call it "liability" when all you have to do is performing some kind of compliance theater to get rid of it?
- telgareith 2y ago
  Ask Boeing.
- Terr_ 2y ago
  Technically yes, since it depends on the kind of liability. In particular, liability for negligence depends on somebody doing stupid-things or stupidly-not-doing the right things, and there's an ongoing struggle to define where that envelope lies.
- kurikuri 2y ago
  The ‘compliance theater’ often is filled with things which seem inane to your product, but the requirements themselves are often broad so that they cover many different types of products. Sure, we could add further granularity, but there is usually a ton of pushback and many people need to come to some compromise on what is relevant.
jand 2y ago
> The response has been what's called "safety certification": This is the most scary part for me. Certifications are mostly bureaucratic sugar and on the other hand very expensive. This seems like a sure way to strangle your startup culture. If customers require certifications worth millions, nobody can bootstrap a small business without outside capital.
- Eddy_Viscosity2 2y ago
  Assuming the level of certification will be proportionate the potential risk/harm, then this is actually totally ok. Like would you want to fly in a plane built but a bootstrap startup that had no certifications? Or go in a submarine to extremely deep ocean tours of the titanic? Or put in a heart device? Or transfer all of your savings to a startup's financial software that had no proof of being resilient to even the most basic of attacks? For me, its a hard no. The idea of risk/harm based certification and liability is overdue.
  - mike_hearn 2y ago
    Problem is that it's rarely proportional. There's a different thread on HN about the UK Foundations essay. It gives the example of the builders of a nuclear reactor being required to install hundreds of underwater megaphones to scare away fish that might otherwise be sucked into the reactor and, um, cooked. Yet cooking fish is clearly normal behavior that the government doesn't try to restrict otherwise. This type of thing crops up all over the place where government certification gets involved. Not at first, but the ratchet only moves in one direction. After enough decades have passed you end up with silliness like that, nobody empowered to stop it and a stagnating or sliding economy. > Like would you want to fly in a plane built but a bootstrap startup that had no certifications? If plenty of other people had flown in it without problems, sure? How do you think commercial aviation got started? Plane makers were startups once. But comparing software and planes (or buildings) is a false equivalence. The vast majority of all software doesn't hurt anyone if it has bugs or even if it gets hacked. It's annoying, and potentially you lose money, but nobody dies.
    - 2y ago

by gwd 2y ago

generic92034 2y ago

> The response has been what's called "safety certification": as an industry, you define a process which, if followed, you can in court say "we were reasonably careful", and then you hire an evaluator to confirm that you have followed that process. Can you still call it "liability" when all you have to do is performing some kind of compliance theater to get rid of it?

telgareith 2y ago
Ask Boeing.
Terr_ 2y ago
Technically yes, since it depends on the kind of liability. In particular, liability for negligence depends on somebody doing stupid-things or stupidly-not-doing the right things, and there's an ongoing struggle to define where that envelope lies.
kurikuri 2y ago
The ‘compliance theater’ often is filled with things which seem inane to your product, but the requirements themselves are often broad so that they cover many different types of products. Sure, we could add further granularity, but there is usually a ton of pushback and many people need to come to some compromise on what is relevant.

jand 2y ago

> The response has been what's called "safety certification": This is the most scary part for me. Certifications are mostly bureaucratic sugar and on the other hand very expensive. This seems like a sure way to strangle your startup culture. If customers require certifications worth millions, nobody can bootstrap a small business without outside capital.

Eddy_Viscosity2 2y ago
Assuming the level of certification will be proportionate the potential risk/harm, then this is actually totally ok. Like would you want to fly in a plane built but a bootstrap startup that had no certifications? Or go in a submarine to extremely deep ocean tours of the titanic? Or put in a heart device? Or transfer all of your savings to a startup's financial software that had no proof of being resilient to even the most basic of attacks? For me, its a hard no. The idea of risk/harm based certification and liability is overdue.
- mike_hearn 2y ago
  Problem is that it's rarely proportional. There's a different thread on HN about the UK Foundations essay. It gives the example of the builders of a nuclear reactor being required to install hundreds of underwater megaphones to scare away fish that might otherwise be sucked into the reactor and, um, cooked. Yet cooking fish is clearly normal behavior that the government doesn't try to restrict otherwise. This type of thing crops up all over the place where government certification gets involved. Not at first, but the ratchet only moves in one direction. After enough decades have passed you end up with silliness like that, nobody empowered to stop it and a stagnating or sliding economy. > Like would you want to fly in a plane built but a bootstrap startup that had no certifications? If plenty of other people had flown in it without problems, sure? How do you think commercial aviation got started? Plane makers were startups once. But comparing software and planes (or buildings) is a false equivalence. The vast majority of all software doesn't hurt anyone if it has bugs or even if it gets hacked. It's annoying, and potentially you lose money, but nobody dies.
  - 2y ago