4 ms·

> It seems like some (most?) of the security vulnerabilities are analogous to things that physical goods manufacturers do not have liability for either. I don'

> It seems like some (most?) of the security vulnerabilities are analogous to things that physical goods manufacturers do not have liability for either. I don't think this is true — just shipping whatever junk you've piled together by some deadline has become frustratingly common. Also note the article has this to say: Software makers can avoid liability if they prove a defect was not discoverable given the “objective state of scientific and technical knowledge” at the time the product was put on the market.

gruez 2y ago
That sounds like most bugs wouldn't be able to avoid liability? Most bugs are stuff like memory corruption or sql injection, and could be discovered if you looked hard enough
- eqvinox 2y ago
  Yes and no — I think there'll be an expectation that you follow best practices and use the tools available. The legal system doesn't expect "mathematical" perfection in cases like this; if you can show that you worked diligently (kept up on tools, have a test suite, use static analyzers and sanitizers, etc.) I'm reasonably sure you'll be off the hook. If you can show that.
  - Ekaros 2y ago
    And/or follow some industry standard in process and product. Even if that standard is less than perfect. Lot of documentation. It might not entirely make sense for your use case, but having the trail that you did things is often good enough.
    - spwa4 2y ago
      And how will you get paid for doing that in perpetuity? Are they asking you to do this for free?
whimsicalism 2y ago
Unlike in the US, I do not expect European courts to be neutral between domestic vs foreign tech companies. They need to fix their system to encourage fair play before adding more rules.
- Tomte 2y ago
  You remember the Roundup cases where US juries started convicting and handing out huge damages the very second the US manufacturer was bought by a European company?
  - _DeadFred_ 2y ago
    I know multiple instances where even with reciprocity agreements/treaties (if approved in USA/Europe by that jurisdiction's authority bodies it is auto approved in the other) Europe will still fail approval. I have not ran into the USA doing the same. Europe has a history of using it's authority bodies to pick European winners.

gruez 2y ago

That sounds like most bugs wouldn't be able to avoid liability? Most bugs are stuff like memory corruption or sql injection, and could be discovered if you looked hard enough

eqvinox 2y ago
Yes and no — I think there'll be an expectation that you follow best practices and use the tools available. The legal system doesn't expect "mathematical" perfection in cases like this; if you can show that you worked diligently (kept up on tools, have a test suite, use static analyzers and sanitizers, etc.) I'm reasonably sure you'll be off the hook. If you can show that.
- Ekaros 2y ago
  And/or follow some industry standard in process and product. Even if that standard is less than perfect. Lot of documentation. It might not entirely make sense for your use case, but having the trail that you did things is often good enough.
  - spwa4 2y ago
    And how will you get paid for doing that in perpetuity? Are they asking you to do this for free?

whimsicalism 2y ago

Unlike in the US, I do not expect European courts to be neutral between domestic vs foreign tech companies. They need to fix their system to encourage fair play before adding more rules.

Tomte 2y ago
You remember the Roundup cases where US juries started convicting and handing out huge damages the very second the US manufacturer was bought by a European company?
- _DeadFred_ 2y ago
  I know multiple instances where even with reciprocity agreements/treaties (if approved in USA/Europe by that jurisdiction's authority bodies it is auto approved in the other) Europe will still fail approval. I have not ran into the USA doing the same. Europe has a history of using it's authority bodies to pick European winners.