Slashdot Mirror
Increased Software Vulnerability, Gov't Regulation
PogieMT writes "An
article in the New York Times
(registration required) suggests that the rash of security flaws, viruses and
worms is leading a push towards greater regulation by the government, which,
according to the piece, has largely relied on the efforts of individual
companies."
Call me cynical, but I don't think the US government are getting into this for the sake of safeguarding my PC from viruses...
Who is going to pay for regulation? I can see goverments passing it between them waiting for someone else to pay. Self regulation by software companies will not work, can you see Microsoft, SCO, Sun and Red Hat sitting down to draft a policy? I can't.
Regulation is not the answer - professionalism is. The government has oversight over the construction industry for example, but engineers are accredited and the profession is run day-to-day but the professional institution, in the UK this is the Institute of Civil Engineers. Same in medicine, the government oversees, but day to day regulation rests with the BMA, the British Medical Association, and doctors answer to them. Same with lawyers, accountants, investment bankers... even lifeguards and hairdressers have professional bodies.
Software development needs to become more like engineering, and software developers should be required to take a qualification like CEng (UK) or PEng (US) in order to work in positions of authority and responsibility. Remember that engineering is about public safety - bridges don't often collapse, buildings don't often topple, and that's all because the people designing them have been certified by independant bodies. Programmers of safety-critical systems are already often required to be certified by the relevant body, usually that of the electrical engineers.
Regulation may or may not work. What would really work would be if the government (Microsoft's biggest customer, I've heard) stopped buying their products in favor of others that are more secure. Re-evaluate that when Microsoft's products have less of an issue.
I know that all systems have some security problems or another. I don't recall any of them having sent me a thousand e-mail messages every day, though. And it's not like this is the first time.
Let the government talk with it's money and people will listen.
Personally, I don't really like my tax money going so much to Microsoft. For one thing, I don't like that the privacy of my information and security of the systems relies on something that seems to have so many problems.
Sean
Isn't it strange how there is a marked surge in software control in the past few months with microsoft's main competitor being an OS that is being built with a relatively low centralized control
!
Anything government regulated is limited by borders and politics. Unless this sort of regulation is implemented by a non-governmental world body then it's useless and will only serve to segregate the internet.
Forget thrust, drag, lift and weight. Airplanes fly because of money.
Gates is probably telling Bush "see, this is why we need trusted computing." Bush will declare that either you are with him, or you are with the terrorists.
The BBC was making similar mistakes in reporting viruses, worms and security flaws until very recently. I emailed their editors and showed them the error of their ways. They now carefully mention which platform the vulnerabilities apply to when they report them...
Stick Men
In my opinion the easiest way to cope with this threat is to make software companies responsible for their products - see article by Declan McCullagh.
Of course this regulation has to be done carefully - we shall deem liable for damages only those companies that require MONEY for that product: for instance when you install free version of RedHat Linux - RedHat (or anybody else) is not responsible for the damage, yet if you pay for this distro - then RedHat _shall_ be responsible - they can simply buy an insurance against such claims. I am sure that the price that Linux companies will pay for such insurance will be smaller than in case of Microsoft.
You can defy gravity... for a short time
when their quicken data or other very personal info is 'liberated'. or any number of other personal information. can you imagine how fast things would be patched if a virus/worm scanned for quicken/quickbooks/misc financial data and emailed them to people in the local address book?
eric
Regulating computer safety makes these guys exactly like the AT&T of yore. And don't we all know what happened with that?
So let some damned competition into the market. The only reason to trust these guys in any other situtation is to simply not understand the idea of a world without them, and sadly that seems to be the way most people think.
I think regulation is the wrong solution. A better solution is to hold companies responsible for security breaches.
Everybody keeps passing the buck: businesses blame the software company, software companies blame hackers, and ultimately the taxpayer and customer ends up paying for the incompetence and poor choices of the businesses.
Businesses should be primarily responsible for the harm that arises from the software they choose. If they want to pass on the risk of their choice to the software company, that should require an explicit contractual agreement.
And the government should get out of trying to regulate how software is written, and the government should get out of trying to catch "hackers".
Any user who does not patch daily and harms another due to not being patched should be punished. Here is how I think it should work....
... "If you don't patch and change your behavior, we cut you off without warning."
A few big ISPs should simply start cutting service to those who have been backdoored and are zombies, have opened virus laden e-mails, or are otherwise infected and causing others problems. For example, no firewall on an open, always-on connection. Especially cable modem ISPs and DSL providers should do this. It should be VERY heavily marketed
My feeling is that by doing this, people will finally start learning how to patch and how to not open e-mail attachments. People will get firewalls and AV software ASAP.
I have seen the threat of this work on a small scale. ISPs are dimwitted morons for not requiring this in the first place. How stupid to give a bunch of newbies loaded guns and then deny responsibility. Buy stock in firewall and AV companies!
"If you want to improve, be content to be thought foolish and stupid." - Epictetus
Corporations would develop their own distributions and make them as feature rich and easy to use as the Windows was. In other words the (alleged) superior security of linux distributions would be broken down in a day: The systems would enable logging in as root and would run all the conceivable daemons by default to avoid problems with third-party software.
You may have a point. But if there were several corporations creating Linux distros, they would probably have different features, default deamons, etc. Virus would not spread as easily as they do now.
Also, with Linux an interested user can decide by himself what stuff he wants to install. If I don't want to use IE, Outlook express, Mediaplayer, etc, because I think they are full of spyware and insecure, it is quite difficult to choose something else under Windows. Not so on Linux.
Monopolies are bad. They make viruses spread more easily.
)9TSS
Get rid of the whole regulation issue. Thats not necessary. It would be far better to make the software publisher liable for any faults or flaws in the software that led to an incident such as MSBlaster, Slammer or any other number of worms out there.
Virii like SoBig.F are not something that can be avoided because the vulnerability there is the user themself. The only way to sort out virii like that is to educate users to not open email they are not expecting or recognise. Even then its still a risk.
If Microsoft were liable for the damages caused by the worms such as MSBlaster and Slammer because their software was vulnerable, don't you think their culture would change very rapidly? Instead of having the worst security reputation, they'd suddenly have the very best. Win2k3 is a good start in the right direction by disabling everything by default. I applaud that. Now they need to sort out their coding practices so that these sorts of issues are a non-event.
Governments don't need to regulate anything. All they need to do is make it illegal for a company to not take responsibility for faulty products, regardless of the product. It worked in the automobile industry, its worked in the medical industry, its worked in the engineering industry.
If my car explodes because of a fault in the fuel line at manufacturing, I'm perfectly within my rights to sue that company. If my computer becomes completely unusable because a vulnerability allowed someone to damage it or similar, why shouldn't I sue the publisher of that software? I'd also reserve the right to sue the person that exploited that vulnerability and caused the damage.
Don't need regulation, just liability and a warranty of suitability for a purpose. 'This OS is guaranteed to perform to XXXXXXX level and is considered suitable for XXXXXXXXXX purpose.'
When M$ Windoze becomes fully warrantied (M$ can afford it), and most OSS coders don't dare accept liability for their software .... "Why should we be using Linux for our company systems? It doesn't even come with a guarantee! On with the windoze installation!"
What the government should do is enforce diversity. Requireing every government department above some minimum size to use systems from at least 3 independent sources would be a start.
_O_
.|< The named which can be named is not the true named
If Linux were as popular as Windows, you can bet we'd be in the same situation. Why? Because the problem is only partially software.
I can download any Linux virus I want, and I can click on it as much as I want but guess what? It still won't run unless I mark it to execute. That practically eliminates email viruses that require people run them. Not to mention that hiding file extensions by default is really not user friendly in any way, and when your OS depends on the file extension to determine its action, HIDING the file extension is the last thing you want to do.
But on the other hand, if other industries are examined, such regulation will only turn into a further barrier to entry for new entrants to the market and non-commercial (i.e. Free and Open Source ) software.
I already see this when trying to sell FOSS solutions to the public sector, who invariably have successful "Common Criteria" evaluation as a "nice to have" (at least - in some cases it's mandatory).
Getting these evaluations done is expensive, so only the big boys get to play... Ironically, the people I talk with know that FOSS solutions are usually at least as secure as the products on their approved list, but their hands are tied by regulations and auditors.
--
Now watch as Bill Gates and his cronies push for Trusted Computing, the Palladium project. After all, it's never Microsoft's fault that the bugs exist, right? It's always those darned users and by George we need to foolproof the system. Please. Trusting computing is a joke. It is a power play by top industry corporations to seize power and act as a yet another cohesive monopoly in a so-called free market. Just like the RIAA. Just like the MPAA.
Here's a thought. Hold the software companies responsible for their own goofups and bugs. Let the people sue. Let the people file their class action lawsuits against Microsoft for their errors. But don't let the government take control.
I don't want the ignorant US government, or any government for that matter, looking over the Internet and infringing on it any more than they already are. Half of those farts probably don't even know what the Internet is. I can't say I'd want these clueless individuals, easily motivated by legal bribery (lobbies) and big business (Palladium), to be involved. They will only serve to screw things up, pass ridiculous laws, and tax Internet commerce to death. Let the Internet be that one place government is unable to corrupt.
The problem is that the people who aren't on the Internet; the people who take passive interest in computers, are ignorant to these facts. That's why I feel, unfortunately, that things like Palladium are destined to pass. Microsoft and others are going to get these bills through the door while the politicians are still ignorant to computers.
I'd like to say we can stop them, but we don't have a $47 billion lobbyist group behind us.
You don't want the ISP to firewall for you. For this extra "service" you'd pay more. To open an extra port (to play quake for example) you'd have to pay extra. This would lead to every application using port 80 so they can get through the firewall, and then another mechanism (MS SOAP or whatever) to run other stuff through that port. At that point nothing is different except things are more complicated, and you gave up some freedom. Not to mention it makes the ISP responsible for the traffic on their network - something neither they nor you should want.
After developing applications for a wide variety of banking industries it became clear that:
1) The only way to develope software systems, is to proactively secure the systems once they are deployed.
2) To proactively and continuously review and examine such systems, you must have the source code and build tools and access to the hardware engineering requirements of the systems involved.
3) The only known process where this can be achieved is through Open Source.
Closed binary proprietary software is not secure, cannot be MADE secure, is impossible TO secure and with patents and copyrights laws as written it could be quite possible you could be SUED for securing the software yourself.
Security became an extension of the software engineering process for the company I started previously, and it involved reviewing the source code and making changes, performing attacks, etc.
Critical to this process was to have as many eyes and opnions looking at the source code as possible. The more experienced professionals that had a chance to offer advice and opinions on the code, the better and more secure the code became.
An entire portion of the software engineering process cannot even be done with proprietary software, and I personally as a CIO, declared proprietary binary only software sales DOA in this industry 2 years ago.
-Hack
Got Geometrodynamics? Awe, too hard to figure out? Too bad.
There's a reason they forgot to mention that. The effect of regulation like this will to be to keep many individuals and small shops from producing software. It might be a major step towards destroying Linux and other Open Source projects. Microsoft, big and rich enough to deal with any red tape and above the law when they do things illegal, will be unaffected. They will embrace it, may even be the force behind getting it started to smash those that dared to make better products.
I'm an American. I love this country and the freedoms that we used to have.
It will if those developers are personally responsible for the work, accountable to a supervisory professional body, and liable to lose their professional status and hence livelihood if they make a serious mistake. All the managers in the world won't get a known bad product out the door at that point, because every professional developer will tell them where to go. It's like unionisation, but with a somewhat different (and arguably less dangerous) slant.
The problem of course, is how to form a suitable supervisory body to do the accreditation. I sure as hell wouldn't trust most of the guys I've worked with to sit in judgement over the coding practices of another. Almost no-one invests the time and effort to get their skills to that level, because in most software development industries it's not worth it unless you're doing it as much out of interest and professionalism as out of a desire to earn your pay. In civil engineering, we have a long history of success stories and failures to provide concrete evidence (no pun intended) of what works and what doesn't. There is no analogue in software development today, and without it, who's to say what really constitutes "best practice"?
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.