4 ms·

How often have you really encountered such buggy software that's cause you significant harm as a consumer? I've had annoyances and had to get refunds, though ra

by aneth4 14y ago

How often have you really encountered such buggy software that's cause you significant harm as a consumer? I've had annoyances and had to get refunds, though rarely and it's hardly ever caused any significant loss. No way for customers to demand a working product? Which products don't work? How does consumer choice and refunds for completely broken software not take care of this? The software referenced in this article was mostly built in house, perhaps some with enterprise licensing which you can be sure included negotiations covering reliability. Regulation is not the answer. Software is just fine.

lazyjones 14y ago
Vulnerabilities in widely-used software (e.g. Windows, MSIE) were often fixed much too late, so the customer was at a risk or had to use 3rd party software at an additional cost just to compensate for them. Botnets that exist only because of these vulnerabilities put every business on the web at risk. Software is just as "fine" as any other product where no accountability exists.
- learc83 14y ago
  How do you provide a warranty against someone actively trying to destroy something? Doors don't have guarantees against someone kicking them in. Cars aren't covered against someone putting sugar in the gas tank. What counts as a vulnerability? How can a regulatory body possibly decide what was a "vulnerability" they should have known about and what was something unforeseeable? I guarantee you there isn't always clear line between the two. What about when the vulnerability is exploited by a government who has greater resources than the software vendor? Does Microsoft have to pay out on a claim when damage is caused because a certificate is forged by the US government?
  - lazyjones 14y ago
    > How do you provide a warranty against someone actively trying to destroy something? You provide a warranty that states exactly what is covered and what not (and suitability for a particular purpose, which software licenses often deny completely). > Doors don't have guarantees against someone kicking them in They do, at least here in the EU you get differently rated safety doors at different prices. You know exactly what kind of minimum resistance they offer. > How can a regulatory body possibly decide what was a "vulnerability" they should have known about and what was something unforeseeable? I guarantee you there isn't always clear line between the two. Stupid Word macro and buffer exploits are very obviously grave mistakes made by the manufacturer, who should be held accountable. > What about when the vulnerability is exploited by a government who has greater resources than the software vendor? Why should that make a difference? If you cannot handle the responsibility you have as a vendor, then don't be one. > Does Microsoft have to pay out on a claim when damage is caused because a certificate is forged by the US government? No, because Microsoft's stuff works as intended in that case, the CA should be held liable.
    - learc83 14y ago
      >You provide a warranty that states exactly what is covered and what not (and suitability for a particular purpose, which software licenses often deny completely). So software vendors state in their warranties that running this software on an internet connected device voids the warranty, and they stop offering patches and support. All support moves to unofficial third parties. >They do, at least here in the EU you get differently rated safety doors at different prices. You know exactly what kind of minimum resistance they offer. And that's an objective quantifiable measurement. Levels of software vulnerability are not. >Why should that make a difference? If you cannot handle the responsibility you have as a vendor, then don't be one. That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government agency can't find a vulnerability.
      - lazyjones 14y ago
        > That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government agency can't find a vulnerability. I don't buy this. If the vulnerability is in the OS or some other program, those parts are to blame. But it's perfectly possible to avoid the mistakes that are typically employed for such intrusions (usually they are in the OS anyway - you know, the OS with no warranty, no accountability, but a monopolist price). When they aren't, it was usually some mediocre C programmer's sloppy coding (there are safer languages for mediocre programmers). The whole point of such regulations would be to put some pressure on developers so they must choose proper tools, languages, methodologies to keep customers from harm, whereas now they simply do what they like with no consequences.
- aneth4 14y ago
  No accountability? Microsoft is losing marketshare and mindshare to Apple and Linux because their products have been buggy, unreliable, and generally suck. They have revamped their company to attempt to address these issues. That's accountability. Opening software vendors to unlimited liability for flaws would certainly push me out of the software business. Particularly in the fast moving entrepreneurial word, pushing improvements that sometimes are flawed is better for consumers than perfect software. Remember that motto at Facebook?

by aneth4 14y ago

lazyjones 14y ago

Vulnerabilities in widely-used software (e.g. Windows, MSIE) were often fixed much too late, so the customer was at a risk or had to use 3rd party software at an additional cost just to compensate for them. Botnets that exist only because of these vulnerabilities put every business on the web at risk. Software is just as "fine" as any other product where no accountability exists.

learc83 14y ago
How do you provide a warranty against someone actively trying to destroy something? Doors don't have guarantees against someone kicking them in. Cars aren't covered against someone putting sugar in the gas tank. What counts as a vulnerability? How can a regulatory body possibly decide what was a "vulnerability" they should have known about and what was something unforeseeable? I guarantee you there isn't always clear line between the two. What about when the vulnerability is exploited by a government who has greater resources than the software vendor? Does Microsoft have to pay out on a claim when damage is caused because a certificate is forged by the US government?
- lazyjones 14y ago
  > How do you provide a warranty against someone actively trying to destroy something? You provide a warranty that states exactly what is covered and what not (and suitability for a particular purpose, which software licenses often deny completely). > Doors don't have guarantees against someone kicking them in They do, at least here in the EU you get differently rated safety doors at different prices. You know exactly what kind of minimum resistance they offer. > How can a regulatory body possibly decide what was a "vulnerability" they should have known about and what was something unforeseeable? I guarantee you there isn't always clear line between the two. Stupid Word macro and buffer exploits are very obviously grave mistakes made by the manufacturer, who should be held accountable. > What about when the vulnerability is exploited by a government who has greater resources than the software vendor? Why should that make a difference? If you cannot handle the responsibility you have as a vendor, then don't be one. > Does Microsoft have to pay out on a claim when damage is caused because a certificate is forged by the US government? No, because Microsoft's stuff works as intended in that case, the CA should be held liable.
  - learc83 14y ago
    >You provide a warranty that states exactly what is covered and what not (and suitability for a particular purpose, which software licenses often deny completely). So software vendors state in their warranties that running this software on an internet connected device voids the warranty, and they stop offering patches and support. All support moves to unofficial third parties. >They do, at least here in the EU you get differently rated safety doors at different prices. You know exactly what kind of minimum resistance they offer. And that's an objective quantifiable measurement. Levels of software vulnerability are not. >Why should that make a difference? If you cannot handle the responsibility you have as a vendor, then don't be one. That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government agency can't find a vulnerability.
    - lazyjones 14y ago
      > That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government agency can't find a vulnerability. I don't buy this. If the vulnerability is in the OS or some other program, those parts are to blame. But it's perfectly possible to avoid the mistakes that are typically employed for such intrusions (usually they are in the OS anyway - you know, the OS with no warranty, no accountability, but a monopolist price). When they aren't, it was usually some mediocre C programmer's sloppy coding (there are safer languages for mediocre programmers). The whole point of such regulations would be to put some pressure on developers so they must choose proper tools, languages, methodologies to keep customers from harm, whereas now they simply do what they like with no consequences.
aneth4 14y ago
No accountability? Microsoft is losing marketshare and mindshare to Apple and Linux because their products have been buggy, unreliable, and generally suck. They have revamped their company to attempt to address these issues. That's accountability. Opening software vendors to unlimited liability for flaws would certainly push me out of the software business. Particularly in the fast moving entrepreneurial word, pushing improvements that sometimes are flawed is better for consumers than perfect software. Remember that motto at Facebook?