Slashdot Mirror
Cure For Bad Software? Legal Liability
satch89450 writes: "SecurityFocus had a column that I missed when it was first published a few days ago, titled 'Responsible Disclosure' Draft Could Have Legal Muscle, but I discovered it when researching an answer to a comment on the CYBERIA mailing list. In this article, Mark Rasch discusses how the Draft would set the rules for reporting security vunerabilities, and in particular define the boundaries of liability assumed by bug-disclosers. By adopting a "Best Practices" RFC, the IETF could help the reporters of security-related bugs do their job, and put the onus of fixing the bugs on the vendors who make the mistakes, where it belongs. (The RFC draft described in the article, 'Responsible Vulnerability Disclosure Process, is here at the ISI repository.) This is, of course, in direct opposition to the process that Microsoft's Scott Culp, Manager of the Microsoft Security Response Center, would like to see. As Microsoft is more part of the problem than part of the solution, I believe that the path to a formal process would better serve the entire community - and that community includes Microsoft's customers. I'm taking this seriously because the mainstream press is talking about the issue, and what it's going to take to fix it. Here is an example from BusinessWeek that scares me silly. I'm glad I'm looking to change careers from software development to something safe, like law."
So is OSDN legally responsible for not fixing page widening?
There's a lawsuit I'd follow!!
Non-Donor []
A check in the Campaign Donor box guarrantees the
holder insulation from legislation which may find
the card holder liable for any damages, further, the
card holder may be elligible for assistance from the
Department of Justice in legal matters.
A feeling of having made the same mistake before: Deja Foobar
I think making software companies liable for their products so they would be forced to fix reported bugs would be a great idea. I remember a year or so ago I found a bug in a game by Activision, and I dutifully reported it to them. I didn't make it public at the time, since I wanted to give them a fair amount of time to issue a patch, but their complete refusal to do anything about it leaves me little choice. Maybe they don't think that fixing the bug in Ghostbusters that prevents you from entering one of the buildings on the map from a certain direction isn't worthy of their attention, but dammit I paid $30 for that game back in 1984, and it interferes with my enjoyment of the product! The customer support rep's excuse? "I'm sorry sir, I've never heard of a 'Commodore,' so I must assume we do not support it." Where does it end?