Increased Software Vulnerability, Gov't Regulation

PogieMT writes "An article in the New York Times (registration required) suggests that the rash of security flaws, viruses and worms is leading a push towards greater regulation by the government, which, according to the piece, has largely relied on the efforts of individual companies."

Comments

Like the cars

[ComaVN]

Much like car safety between the '50s and '70s. Manufacturers simply didn't care about safety, because the customer didn't care.

retro posting

[segment]

I tried to submit something similar before as an article but it was denied ... and I sincerely thought it is very relevant to this. According to the NSA's "Statement on Cybersecurity" paper released earlier this year, there were a few people who are spooked as the government seems to want to either backdoor or control somehow software under the guise of 'tougher security'

A significant cybersecurity improvement over the next decade will be found in enhancing our ability to find and eliminate malicious code in large software applications. Beyond the matter of simply eliminating coding errors, this capability must find malicious software routines that are designed to morph and burrow into critical applications in an attempt to hide. There is little coordinated effort today to develop tools and techniques to examine effectively and efficiently either source or executable software. I believe that this problem is significant enough to warrant a considerable effort coordinated by a truly National Software Assurance Center. This center should have representatives from academia, industry, federal government, national laboratories and the national security community all working together and sharing techniques to solve this growing threat.

And to add insult to injury to MS, a letter was sent to Tom Ridge asking the Dept. of Homeland Sec to limit or stop it's use of MS products due to insecurity.

Personally I would stop using machines if it were possible to have some form of monitoring of my actions without my authorization. Aside from that it's not a secret that the NSA has been accused of corporate espionage, so I would hope large corporations would think twice about giving them any form of say when it comes to codes for commercial software.

Re:they forgot to mention

[Eric Ass Raymond]

most of the vulns are in microsoft software

It only appears so because Microsoft's is found on practically every desktop and on the majority of server computer too.

If Linux were as popular as Windows, you can bet we'd be in the same situation. Why? Because the problem is only partially software. The main problem is the clueless user and to a lesser extent the feature bloat required by the users.

Let's imagine that the open source zealots got their wish and Microsoft was broken down or, even better, stopped selling software altogether and Linux would suddenly be the mainstay operating system both for desktops and servers. Linux would suddenly be truly big business. Corporations would develop their own distributions and make them as feature rich and easy to use as the Windows was. In other words the (alleged) superior security of linux distributions would be broken down in a day: The systems would enable logging in as root and would run all the conceivable daemons by default to avoid problems with third-party software.

But getting back to the article. If operating systems were to become a government supervised commodity with stiff penalties for those who produce insecure software, would you be prepared to accept that open source companies (or the copyright owner, FSF) would get fined for every security breach - just like the manufacturers of proprietary software?

Re:Regulation is not the answer

[Ed Avis]

I'm an MEng and I've still written programs that crash... so have you. It's not a question of certification but just how much time you're prepared to take writing some code (by which I include choice of method, programming language and so on) and testing it. You can have thirty years of experience and still bang out flaky code if you're in a hurry. And if flaky code is all that's needed for the particular task, why not?

Rather than regulation we should let the market decide. Vendors could undertake: I will pay you $100 for each crash. Sometimes this already happens, eg with guarantees about the number of nines in server systems. The biggest problem is deciding responsibility for any faults. If an operating system call, which (according to POSIX or whatever) should not return null, one day does return null and the application crashes, who should pay up? And how do you find out whose fault it was? Running the whole system in some kind of virtual machine where you can roll back the last few seconds of execution would be one answer.

Re:Regulation is the goal

[Eric Ass Raymond]

I'll choose a democratically elected government over a plutocratic regime of corporations (=markets) any day.

Them wanting to control the IT market

Not all government control over the markets is bad. It's a fact that a capitalist society cannot self-regulate - it's natural growth is always towards a monopoly. This unhealthy growth cannot be curbed by some internal mechanism inherent in he markets (as libertarians like to believe) and external control is always required at some stage.

And what would the OSS angle be then?

[Cooper_007]

Here you have a company that goes out and make some cool software that scratches an itch that a big chunk of the world also feels. The program is an instant hit, becomes #1 on CNET's download page and the main coder gets his picture on the cover of Time (one can always dream).

Suddenly a bug is discovered which will give others full control of your system. Acting quickly, a patch is created and a fixed version is put online, and warnings posted to all the regular places.

Several weeks later an exploit program is seen in the wild, attacking systems owned by CLUELESS USERS who either never knew of the problem, or were too lazy/overworked to fix it. The damage is immense, and in the current fingerpointing society most people blame this company even though they did everything that could be reasonably expected from them.

And now a growing group of people feel the government should be breathing down this company's neck for not making secure software?

Replace "company" with "group of OSS developers", and tell me how things should be different for this case, and why.

Mirrors suck, huh?

ENFORCE the antitrust laws

[dpbsmith]

The cause of the current problem is only partially due to insecure Microsoft software. It is very noteworthy that Windows 98 and 95 were immune from the latest round of malware (W32/Blaster, W32/Welchia, W32/Sobig.F). The main cause is monoculture--the dominance of a single operating system, Windows NT and its variants.

What we need is a truly competitive market in which many operating systems compete, no single operating system dominates, and a market that uses many operating systems therefore demands and rewards inoperability and writing software to standards rather than writing to a single vendor's API.

Why don't we have it? Because Microsoft was allowed to get a monopoly and the Justice Department is not doing its job and breaking it up.

It wouldn't be any different if IBM were the dominant company--as it was a few decades ago--or Apple, or what have you.

The problem is not Microsoft. The problem is monopolization. And the answer is not the free market--monopolies exist only when the market has already failed.

why do we tolerate anti-virus softare

[deafgreatdane]

"There are three major things every consumer and user of computers needs to do," Scott Charney, the security chief for Microsoft, said. "One, get antivirus software and keep it up to date. [...]"

I think this spin is one of the biggest problems with the public perception of computer security.

I find it appalling that we tolerate anti-virus software as a necessary solution. IMO, every virus is an exploitation of a bug in the software, and original vendor should be responsible for fixing the hole that allowed the virus to exist.

Why doesn't the press focus on the hypocrisy holding of software vendors more accountable for fixing their problems, while at the same time, advocating supporting a third part to fix the same problems?

I about blew my top when fixing my in-laws' machine for a case of blaster, and MS so "conveniently" linked one of the trusted anti-virus sites that offered removal tools. If it's microsoft's hole, why don't they provide a cleanup method?

(This is not to say we shouldn't have virus filters on SMTP and firewalls - there's nothing wrong with trying to block the spread of virii through multiple means)

Toward a Programming Safety Authority?

[SysKoll]

Typical NYT drivel. A problem pops up? The Times clamor for government regulation. Astonishingly, when faced with a dramatic, err, bug in its own journalist monitoring activity, the NYT doesn't call for the gummint to create a Journalism Ethic Control Board. But these programmers guys? Yeah, they need to be kept under control.

The gummint will be only too happy to oblige and produce several layers of ineficient, costly, slow, slightly corrupt bureaucracy that will not solve the problem but will never disappear. As usual.

Let us put on our bureaucrat hat and see what can be done, in the immortal tradition of public service that gave us the Transportation Safely Authority. Let's see. Strip search programmers when they come to work in case they bring a copy of 2600? Have them remove their shoes? A nice start, but not enough.

See, the problem is that scumbags are writing programs that are up to no good. No scumbag coding, no worm and virus, eh? So let's put all compilers under lock. Let's make sure that scripting languages only accept input scripts that have been digitally signed by a new Programming Safety Authority. Let's make it a crime to use a computer without PSA-approved tools. Each program has to be certified by the PSA. Use the TCPA and Palladium chips to lock out all the bastards using non-PSA software and operating systems. Ban all non-Palladium computers and electronics. Do an FBI criminal check on each person entrusted with a compiler. And of course, recruits thousands of new civil servants to enforce all these new rules, at a low, low cost of [#insert eye-popping budget that will be overrun anyway].There you have, secure computing. A bit harsh, but it's for our safety, isn't it?

If you think the above is funny, I am sorry. I meant it to be ironic in a chilling way. Because when you start involving the government into a human activity, you never know how the bureaucrats are going to warp it.

So I'm gonna speak slowly so that even New York Times journalists can understand: KEEP GOVERNMENT OUT OF COMPUTING. Got it?

-- SysKoll

An incredibly BAD idea

[The Monster]

A little regulation would be nice

It is no more possible to have 'a little regulation' than to be 'a little pregnant'. Throughout the history of industrialized society, the same pattern has been repeated over and over with a new technology:

1. None of the existing agencies seems to have jurisdiction over the peculiar characteristics of the technology, so a thousand flowers bloom. Some work; others don't. The pioneers know this. They expect it.
2. The technology becomes sufficiently stable and productive, relative to existing alternatives, as to become important to the smooth flow of commerce. The 'civilized' people move into the former frontier territory, and expect services to be delivered on demand. They don't know nor care about the work done by the pioneers to get it to work as well as it does.
3. At a certain point, when the political climate is right, the Do-Gooders move in. They declare that the industry is rife with problems that only the government can solve. They seize upon some event (such as a multi-state/province blackout that can be plausibly traced to a computer worm) and demand a law to empower a new bureaucracy to oversee this wild, untamed industry.
4. Sooner or later, the law passes, and the Do-Gooders move on to the next Great Crusade. Meanwhile, the President has to appoint people to run the agency that regulates the industry.

   Now, who knows anything about the industry.... YES! That's right. The people who

   work in that industry (for companies that donated to my campaign).

5. The agency is now part of a revolving door system, where people put in a stint working for one of the major companies in the industry, then go to work for the agency that regulates them, then possibly back to private industry...

Regulating the software business per se would lead to a Federal Software Commission dominated by ex-MS employees, who would write regulations favorable to their former employer -- not even out of corruption but because they express the corporate culture inculcated into them. Mark my words: The day is coming when it will be as illegal to write computer software without a license from the government as it is to practice medicine, law, plumbing or cosmetology without one. Have you noticed that the more laws there are to regulate an industry, the more expensive it is to be a customer thereof? And if you think closed-source is bad, just you wait until the entire profession is reserved for those who take their apprenticeships with other members of the Guild.

Far better to fight laws like UCITA, DMCA, software patents, etc. that attempt to deprive software customers of the few rights they already have, than to try to push for empowering the government to screw customers even more.

Obviously, the free market isn't going to regulate itself when the consumer and even the government has decided that this is normal and that they will just 'put up with it'.

The free market has been forbidden to regulate itself. The customer has been forced to accept shrink-wrap licenses that deprive them, potential competitors, and independent consumer advocates, of the rights that would allow the free market to function correctly (by reverse-engineering to provide competing products, and benchmarking to judge performance and reliability). These licenses are already in violation of the fundamental principles of contract law.

We need to use the laws already on the books - how about a class action suit against a software company that puts out a shrink-wrap license that is fraudulent in the 48 states that haven't yet adopted UCITA (because it tells the customer that they must either accept its terms or return the software unopened for a refund, when no such license terms asserted after the sale can possibly be valid)? That would force the