Slashdot Mirror

← Back to Stories (view on slashdot.org)

Laws to Punish Insecure Software Vendors?

Posted by ryuzaki0 on from the and-the-land-of-the-free dept.

Gambit Thirty-Two writes "An influential body of researchers is calling on the US Government to draft laws that would punish software firms that do not do enough to make their products secure." Yeah that'll work.

15 of 581 comments (clear)

  1. open source by kz45 · · Score: 5, Insightful

    What will this mean for open source? OSS companies/programmers will be just as liable as closed source ones.

    1. Re:open source by glitch! · · Score: 5, Insightful

      OSS companies/programmers will be just as liable as closed source ones.

      It does not have to be that way. Why not put in exemption for software that comes with source code? The presumption could be that releasing source code allows the user to take responsibility for the correct operation of the software. Also consider that the OSS writer has little or no control over changes the user might make (and that's one of the main points, isn't it?)

      --
      A dingo ate my sig...
    2. Re:open source by athakur999 · · Score: 5, Insightful
      The presumption could be that releasing source code allows the user to take responsibility for the correct operation of the software.


      That's a bit like saying a car company shouldn't be held responsible for putting faulty brakes on a car, since after all, the car owner could have replaced the brakes with something that worked.
      --
      "People that quote themselves in their signatures bother me" - athakur999
    3. Re:open source by Computer! · · Score: 4, Insightful

      that gets exploited

      A critical point, I think. Keep in mind that these security holes are not exactly akin to a lock with a pink sticker that says "This lock doesn't actually work". A lot of research and experimentation is necessary in order to exploit those security holes. Research and experimentation carried out by criminals. As much as I would love to see software companies held accountable for the generally terrible state of software quality industry-wide, I'm not sure it's fair to hold Microsoft responible for making possible the actions of a malicious hacker. Is it Honda's fault a slimjim opens the door of my Civic?

      --
      If you fall off a building, go real limp, because maybe you'll look like a dummy and people will be like hey, free dummy
    4. Re:open source by kin_korn_karn · · Score: 5, Insightful


      It does not have to be that way. Why not put in exemption for software that comes with source code? The presumption could be that releasing source code allows the user to take responsibility for the correct operation of the software. Also consider that the OSS writer has little or no control over changes the user might make (and that's one of the main points, isn't it?)

      What needs to be made illegal are EULAs that absolve the software creator of guilt for flaws. Ford is liable for putting the wrong tires on SUVs and causing people to die. Ask Explorer owners (if you can talk to people that would buy one nowadays) how they would have reacted to such a license, and imagine how the courts would have reacted.

      You've also made an excellent point about the futility of the GPL, but I digress.

  2. Oh my, the irony by Reckless+Visionary · · Score: 4, Insightful
    You know, it used to seem like the software security and freedom communities were pretty closely related. Apparently the NAS doesn't have the same lassaiz fairre attitude as most of the freedom advocates.

    It's always interesting when those who call for freedom and security for themselves can only figure out how to do it by reducing the freedom of others. Now they want to legislate software standards? Come on, you have to be against that.

    --
    I think I'll stop here.
  3. Freedom of Speech by CTalkobt · · Score: 4, Insightful

    This raises some constitutional issues - Do I have the right of freedom of speech ( as code has been found to be in some cases ) to utter an incorrect program?

    An additional question would be should all software now come with a warrently that specifically disclaims the implied warrenty and states that there is no warrenty? Would it be legal under the proposal?

    --
    There's a gorilla from Manilla whose a fella that stinks of vanilla and has salmonella.
    1. Re:Freedom of Speech by sam_handelman · · Score: 5, Insightful

      There is a wide legal history for freedom of speech ending when it causes harm to others.

      You don't need to open that whole kettle of worms at all, in this case. The right to say something does not equate with the right to sell it - unless it is sold for the purpose of communication (which commercial software is not.)

      People who write software and then sit on it, or only give it to a few friends, cannot and should not be able to be held accountable for their software not working - unless (like yelling "FIRE!" in the middle of a crowded theatre) there is clear evidence of malicious intent (computer viruses.)

      Someone who distributes software for free ought to be required to disclaim any warranties, which they allready do, and that is fine.

      On the other hand, when you sell a piece of software there is an implied warranty of merchantability that you cannot disclaim. Extending that warranty to include security is not a free speech issue. Your right to write any code you want is still protected, you just cannot necesarilly sell it.

      By extension, however, code written for the purpose of communication - including "here is how you write DeCSS" or the example code in a CS textbook - would still be protected, and you'd still have a right to sell it, whether or not it worked or was secure.

      --
      The good and new comes from no quarter where it is looked for, and is always something different from what is expected.
  4. Be careful of what you wish for by Pinball+Wizard · · Score: 4, Insightful
    If you are talking about imposing rigid design and coding standards to software that is released to the public, it could have a far more adverse effect on small software publishers and open source projects than it does to, oh say Microsoft.


    Seems to me this will have the least impact on those who need to pay attention to security the most(large software companies) while having the potential to make it harder for the "little guy" to write and publish software.

    --

    No, Thursday's out. How about never - is never good for you?

  5. Boon to Corporate America by Mr_Perl · · Score: 5, Insightful

    I suspect that this would ensure far less software gets produced by smaller vendors and individuals who can't afford the liability.

    Another good move for corporate America.

    Microsoft is able to defend itself against the government. Are you?

    --

    My poetry site welcomes the unusual.
  6. Before we decide this is such a great idea . . . by acceleriter · · Score: 5, Insightful

    . . . we might want to consider that while "security" can mean keeping your machine from being 0wn3d, it can also mean "security" as in the Security Systems Standards and Certification Act, otherwise known as the "Enforced Copy Control and Free Operating System Elimination Act."

    --

    CEE5210S The signal SIGHUP was received.

  7. Re:Bad Idea by Todd+Knarr · · Score: 5, Insightful

    The Ford Pinto.

    We have laws that tell auto manufacturers how they can build cars. Not in detail, no, but they have to meet certain standards or they just aren't legal to make. Note that business concerns don't enter into it. Making the Ford Pinto the way they did originally was a good business decision. It really did cost Ford less to pay out the death claims than to improve the car. It even arguably benefitted the consumers, because lower costs to Ford meant a lower price on the car and consumers were still buying them even after the problem became public so people obviously wanted them. The courts still held Ford criminally liable for building a car that blew up and killed people when they could easily have built one that didn't.

    So why should we treat software any differently?

  8. Re:Everyone would be in violation by stilwebm · · Score: 5, Insightful

    A law like this would benefit two camps. One would be large software companies, since the smaller competetition would be squashed as the cost of doing business reaches prohibitive levels. The other benefactor would be the insurance agency. They would increase premiums for software businesses greatly, since this would be the best way for businesses to protect themselves. Consumers would only suffer.

  9. How to track liability by Mr.+Fred+Smoothie · · Score: 4, Insightful
    Your post is interesting, especially in light of the difficulty a court may have in accurately assigning liability to the correct party.

    For instance, am I liable if I use the standard C function gets() in a program? I, as the program vendor, can argue that that's what was taught in my undergrad CS course, or I could point the finger at the language designer or C library vendor.

    What about a program I write that communicates w/ other software via a standard protocol, and works perfectly if the other software adheres strictly to that protocol but fails in combination with another program which implemented that protocol incorrectly; am I to blame, or is the other vendor? What if the spec is vague?

    As I've said in other posts, the potential for good legislation along these lines is there, but only with *heavy* involvement of people who understand issues such as these, along side of the industry lobbyists, consumer advocates and politicians.

    --

  10. A Certain Level by virg_mattes · · Score: 5, Insightful

    > I'm not sure it's fair to hold Microsoft responible for making
    > possible the actions of a malicious hacker. Is it Honda's fault a
    > slimjim opens the door of my Civic?

    Well, to get a realistic comparison, you'd need to compare on even ground. Pretend for a moment that your car door locks went to "locked" when you pushed the lock button, and "unlocked" when you pushed the unlock. However, they didn't actually engage the tumblers in the door, so when it's locked, the handle still opens the door. Now, there's a switch inside the door that you can get to by pulling the door side off, and when you throw it the tumblers connect and when the door says "locked" it now really means it.

    Now, would you blame Honda if they didn't set the switch to "on" at the factory, and didn't tell anyone about the switch, and only acknowledged that it exists when someone in the field finds it and threatens to tell the general public?

    I'd bet you would. That's a fairer comparison, and so yes, I think the companies that produce easily exploitable software should be forced to reckoning for it.

    Virg