6 ms·

How do you provide a warranty against someone actively trying to destroy something? Doors don't have guarantees against someone kicking them in. Cars aren't co

by learc83 14y ago

How do you provide a warranty against someone actively trying to destroy something? Doors don't have guarantees against someone kicking them in. Cars aren't covered against someone putting sugar in the gas tank. What counts as a vulnerability? How can a regulatory body possibly decide what was a "vulnerability" they should have known about and what was something unforeseeable? I guarantee you there isn't always clear line between the two. What about when the vulnerability is exploited by a government who has greater resources than the software vendor? Does Microsoft have to pay out on a claim when damage is caused because a certificate is forged by the US government?

lazyjones 14y ago
> How do you provide a warranty against someone actively trying to destroy something? You provide a warranty that states exactly what is covered and what not (and suitability for a particular purpose, which software licenses often deny completely). > Doors don't have guarantees against someone kicking them in They do, at least here in the EU you get differently rated safety doors at different prices. You know exactly what kind of minimum resistance they offer. > How can a regulatory body possibly decide what was a "vulnerability" they should have known about and what was something unforeseeable? I guarantee you there isn't always clear line between the two. Stupid Word macro and buffer exploits are very obviously grave mistakes made by the manufacturer, who should be held accountable. > What about when the vulnerability is exploited by a government who has greater resources than the software vendor? Why should that make a difference? If you cannot handle the responsibility you have as a vendor, then don't be one. > Does Microsoft have to pay out on a claim when damage is caused because a certificate is forged by the US government? No, because Microsoft's stuff works as intended in that case, the CA should be held liable.
- learc83 14y ago
  >You provide a warranty that states exactly what is covered and what not (and suitability for a particular purpose, which software licenses often deny completely). So software vendors state in their warranties that running this software on an internet connected device voids the warranty, and they stop offering patches and support. All support moves to unofficial third parties. >They do, at least here in the EU you get differently rated safety doors at different prices. You know exactly what kind of minimum resistance they offer. And that's an objective quantifiable measurement. Levels of software vulnerability are not. >Why should that make a difference? If you cannot handle the responsibility you have as a vendor, then don't be one. That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government agency can't find a vulnerability.
  - lazyjones 14y ago
    > That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government agency can't find a vulnerability. I don't buy this. If the vulnerability is in the OS or some other program, those parts are to blame. But it's perfectly possible to avoid the mistakes that are typically employed for such intrusions (usually they are in the OS anyway - you know, the OS with no warranty, no accountability, but a monopolist price). When they aren't, it was usually some mediocre C programmer's sloppy coding (there are safer languages for mediocre programmers). The whole point of such regulations would be to put some pressure on developers so they must choose proper tools, languages, methodologies to keep customers from harm, whereas now they simply do what they like with no consequences.

by learc83 14y ago

lazyjones 14y ago

> How do you provide a warranty against someone actively trying to destroy something? You provide a warranty that states exactly what is covered and what not (and suitability for a particular purpose, which software licenses often deny completely). > Doors don't have guarantees against someone kicking them in They do, at least here in the EU you get differently rated safety doors at different prices. You know exactly what kind of minimum resistance they offer. > How can a regulatory body possibly decide what was a "vulnerability" they should have known about and what was something unforeseeable? I guarantee you there isn't always clear line between the two. Stupid Word macro and buffer exploits are very obviously grave mistakes made by the manufacturer, who should be held accountable. > What about when the vulnerability is exploited by a government who has greater resources than the software vendor? Why should that make a difference? If you cannot handle the responsibility you have as a vendor, then don't be one. > Does Microsoft have to pay out on a claim when damage is caused because a certificate is forged by the US government? No, because Microsoft's stuff works as intended in that case, the CA should be held liable.

learc83 14y ago
>You provide a warranty that states exactly what is covered and what not (and suitability for a particular purpose, which software licenses often deny completely). So software vendors state in their warranties that running this software on an internet connected device voids the warranty, and they stop offering patches and support. All support moves to unofficial third parties. >They do, at least here in the EU you get differently rated safety doors at different prices. You know exactly what kind of minimum resistance they offer. And that's an objective quantifiable measurement. Levels of software vulnerability are not. >Why should that make a difference? If you cannot handle the responsibility you have as a vendor, then don't be one. That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government agency can't find a vulnerability.
- lazyjones 14y ago
  > That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government agency can't find a vulnerability. I don't buy this. If the vulnerability is in the OS or some other program, those parts are to blame. But it's perfectly possible to avoid the mistakes that are typically employed for such intrusions (usually they are in the OS anyway - you know, the OS with no warranty, no accountability, but a monopolist price). When they aren't, it was usually some mediocre C programmer's sloppy coding (there are safer languages for mediocre programmers). The whole point of such regulations would be to put some pressure on developers so they must choose proper tools, languages, methodologies to keep customers from harm, whereas now they simply do what they like with no consequences.