4 ms·

It's pretty scary that you can go to jail (for a long time!) for something as simple as: > ~curl http://example.com/att/[1-100].html http://example.com/att/[1-

by jonknee 14y ago

It's pretty scary that you can go to jail (for a long time!) for something as simple as: > ~curl http://example.com/att/[1-100].html http://example.com/att/[1-100].html I understand what the lawyers are saying, but this is just beyond common sense. There should be liabilities for deploying software that publicly gives out information you do not intend to.

danielweber 14y ago
If you've never deployed software without security flaws, it means you have never deployed software.
- jrockway 14y ago
  At the same time, it's worth noting that running curl in a loop is slightly less difficult than factoring RSA keys. So if someone "hacks" you via an unauthenticated public web service, the courts should take that as less of a computer crime on the attacker's part and more of negligence on your part. But on the other hand, if someone breaks into your well-engineered system through some nearly-impossible attack, then you should not be liable.
- jonknee 14y ago
  Sure, but why should who makes the software bear no responsibility? If a building is found to have a flaw the architect or an engineer are who get questions, not whoever noticed the flaw.
  - danielweber 14y ago
    The flaws in architecture are well-understood and there are rarely-changing building codes to describe exactly what should and should not happen. Software does not exist in any such stable world. There can be two pieces of software, each perfectly legitimate and doing exactly what they intend, that when both are present format a customer's hard drive. Who does the customer sue then? If you want to make developers responsible, I won't personally be hurt much, since I can make a shitload of money finding vulnerabilities in other people's code (and have done so in the past). The lawyers will make lots of money, too, as we have jury trials to figure out whether that SQL injection was really negligent or not.

by jonknee 14y ago

danielweber 14y ago

If you've never deployed software without security flaws, it means you have never deployed software.

jrockway 14y ago
At the same time, it's worth noting that running curl in a loop is slightly less difficult than factoring RSA keys. So if someone "hacks" you via an unauthenticated public web service, the courts should take that as less of a computer crime on the attacker's part and more of negligence on your part. But on the other hand, if someone breaks into your well-engineered system through some nearly-impossible attack, then you should not be liable.
jonknee 14y ago
Sure, but why should who makes the software bear no responsibility? If a building is found to have a flaw the architect or an engineer are who get questions, not whoever noticed the flaw.
- danielweber 14y ago
  The flaws in architecture are well-understood and there are rarely-changing building codes to describe exactly what should and should not happen. Software does not exist in any such stable world. There can be two pieces of software, each perfectly legitimate and doing exactly what they intend, that when both are present format a customer's hard drive. Who does the customer sue then? If you want to make developers responsible, I won't personally be hurt much, since I can make a shitload of money finding vulnerabilities in other people's code (and have done so in the past). The lawyers will make lots of money, too, as we have jury trials to figure out whether that SQL injection was really negligent or not.