Increased Software Vulnerability, Gov't Regulation

PogieMT writes "An article in the New York Times (registration required) suggests that the rash of security flaws, viruses and worms is leading a push towards greater regulation by the government, which, according to the piece, has largely relied on the efforts of individual companies."

Comments

Like the cars

[ComaVN]

Much like car safety between the '50s and '70s. Manufacturers simply didn't care about safety, because the customer didn't care.

Re:Like the cars

[Anonymous Coward]

They'll care when their baby pictures get wiped out, taken with that nice new digital camera

Hmmm

[RMH101]

Is this being used to restrict individual freedoms in a similar way as 9-11 is used to?

Call me cynical, but I don't think the US government are getting into this for the sake of safeguarding my PC from viruses...

Re:Hmmm

[rknop]

Call me cynical, but I don't think the US government are getting into this for the sake of safeguarding my PC from viruses...

It's cynical, but it's also not an unreasonable fear based on anybody who's been rationally observing the behavior of our government recently.

I fully expect that we'll see increased security resolutions which are ostensively tough on companies like Microsoft, but those companies will embrace them (while all the while getting good PR about "doing the right thing and making the right sacrfices") because ultimatly they will only be minor inconveniences... while the regulations that show up will all but prohibit free software (at least for commercial purposes, and possibly for anybody who wants to connect to the Internet), meaning that in the long run Microsoft benefits hugely from those "minor inconveniences".

Meanwhile, the regulations-- like a lot of what we've seen with airport security-- won't increase actualy computer security one whit, but anybody who complains about them will be chastised by John Ashcroft as a whiner who won't let the government do what it needs to safeguard our homeland.

Yeah, I'm cynical too.

-Rob

Re:Hmmm

[Chexum]

It's cynical, but it's also not an unreasonable fear based on anybody who's been rationally observing the behavior of our government recently.

I would oppose any regulation with all my instincts, but let's look at it this way: when was the last time an electrician, or architect/house-builder handed you a paper that with the money you forked over, they can only make product only *this* good, and you are responsible for any damage they may be causing, not them, and forced you signing/accepting it?

Thought so. In software, it's called the EULA.

Hmm.. Regulation

[dbs_flac]

Who is going to pay for regulation? I can see goverments passing it between them waiting for someone else to pay. Self regulation by software companies will not work, can you see Microsoft, SCO, Sun and Red Hat sitting down to draft a policy? I can't.

Regulation is not the answer

[sql*kitten]

Regulation is not the answer - professionalism is. The government has oversight over the construction industry for example, but engineers are accredited and the profession is run day-to-day but the professional institution, in the UK this is the Institute of Civil Engineers. Same in medicine, the government oversees, but day to day regulation rests with the BMA, the British Medical Association, and doctors answer to them. Same with lawyers, accountants, investment bankers... even lifeguards and hairdressers have professional bodies.

Software development needs to become more like engineering, and software developers should be required to take a qualification like CEng (UK) or PEng (US) in order to work in positions of authority and responsibility. Remember that engineering is about public safety - bridges don't often collapse, buildings don't often topple, and that's all because the people designing them have been certified by independant bodies. Programmers of safety-critical systems are already often required to be certified by the relevant body, usually that of the electrical engineers.

Re:Regulation is not the answer

[Ed Avis]

I'm an MEng and I've still written programs that crash... so have you. It's not a question of certification but just how much time you're prepared to take writing some code (by which I include choice of method, programming language and so on) and testing it. You can have thirty years of experience and still bang out flaky code if you're in a hurry. And if flaky code is all that's needed for the particular task, why not?

Rather than regulation we should let the market decide. Vendors could undertake: I will pay you $100 for each crash. Sometimes this already happens, eg with guarantees about the number of nines in server systems. The biggest problem is deciding responsibility for any faults. If an operating system call, which (according to POSIX or whatever) should not return null, one day does return null and the application crashes, who should pay up? And how do you find out whose fault it was? Running the whole system in some kind of virtual machine where you can roll back the last few seconds of execution would be one answer.

Re:Regulation is not the answer

[Audity]

I really wish that would work. But the problem is that the software industry is not like construction. If a house is designed poorly it could collapse and cause serious damage. There would likely be lawsuits involved and the construction company would be bad publicity. They would lose market share and possibly fall out of the buisiness entirely.

If a software program is poorly designed, it crashes, Joe User restarts his machine and goes on with his life. He doesn't even bother to investigate what caused the crash because it happens so often.

The real problem with "cybersecurity" is that software companies have no incentive to create secure software, insecure software sells just as well.

Re:Regulation is not the answer

[El]

Certifying the developers wont help if the management is still pushing pushing to ship software with inadequate testing. Micro$oft already hires many of the best and brightest programmers in the world, and yet their security still sucks. Therefore the problem must be more systemic; simply put, their corporate culture and procedures must not reward designing in and implementing secure software. Even after the "Trustworthy computing" initiative, this still appears to be true. Imagine civil engineers working for management that insisted on shipping bridges by artificial deadlines, and refused to allow time for safety checks. Would it matter if the engineers were certified? Only in the sense tha certified engineers would be morally bound to resign rather than signing off on the bridge design.

Re:Regulation is not the answer

[awol]

Of course regulation is the answer. But the implications are horrible. Any doubt that we are living in the "wilds" of the post revolution expolosion just consider the issues of industrial safety immediately after the industrial revolution. It was a disaster, people were killed and maimed hourly. Look at software, thankfully few people are actually harmed but some of what we "professionals" produce is just crap.

Professionalism is an answer to nothing in this case. Regulation comes in many forms. Pick your jusrisdiction and even your industry and you will find a litany of standards and regulations to which a product must conform before it can be sold. Fire safety for clothes, building materials, Electrical safety standards etc etc etc. One recurring theme seems that most of these standards relate to safety, or to paraphrase to reduce the human cost of substandard products. Having never worked in the industry, I do not know, but I can imagine that the standards required for medical equipment software (pacemakers et al) and things like nuclear power stations are much higher. This is not a question of the qualifications of the people who do the work but opf the output of their work and that is regulation, plain and simple.

Personally I think that the market is the right tool for many of these regulations, but that requires better information and we all know how companies are about disclosing the true nature of their products at the moment, but I digress. The other point is that whilst I am comfortable with my ability to choose the prudent or safe product, I don't trust the vast majority of morons out there to do the same and if they drive a crappy car they can kill me, so I am happy to have regulated standards.

Software, ah yes software, well for starters with most software the worst thing a crash or defect will do is cost you money (or make you late for a date), so I am not so sure that I want so much regulation. Secondly, due to the nature of the process, software is more art than engineering, and that is nothing to do with the professionalism of the people writing it. Now, it is true that the baseline at which the process turns from art into engineering is increasingly high (I am comfortable relying on my compiler to turn my Arty C code into engineered machine language and that the hardware will interpret this in a way that is engineered, whereas thirty years ago that was not so much the case) and in future that boundry will be higher still, however it is not a question of the "capabilities" of the industry participants that currently determines that level and getting us to a point where it is will take a long time and a number of really astounding revolutions in the tools at our disposal.

Having said all that. I would love to see "BS01232 - Computer Operating Systems" that defined a minimum standard of performance, but such a thing is a logistical nightmare do define yet alone to actually implement, so in the mean time I will just run the OSes for which my tasks are best suited and grin and bear the pain.

Re:Regulation is not the answer

[sql*kitten]

If a software program is poorly designed, it crashes, Joe User restarts his machine and goes on with his life. He doesn't even bother to investigate what caused the crash because it happens so often.

But it is possible to write reliable software. Aircraft, for example, run on extremely reliable software. The way it works in civil engineering is, if you can't get a CEng to sign off on the plans, you can't go ahead with the project. A CEng won't sign unless he's sure, because if it fails, he's responsible and he'll likely never work again. The fact that he's an employee is neither here nor there, he answers to the ICE, not the company. A similar approach could be taken with software - make the senior programmer on a team personally responsible, and give them the authority - independant of the company employing them - to say yes or no.

Re:Regulation is not the answer

[sql*kitten]

I'm an MEng and I've still written programs that crash... so have you.

Sure, it wouldn't be a perfect system - but it would better than the situation we have now, where no-one is willing to take responsibility for quality. A strong professional body for granting certified status, backed by a public unwillingness to buy software that didn't have a signature on it from a qualified engineer (maybe in turn backed by a law that some software must be signed off to be sold to the public) would work wonders.

Re:Regulation is not the answer

[ScrewMaster]

You're right ... professionalism is the answer. But professionalism is not something that can be easily mandated: certification means absolutely nothing if the people being certified aren't fundamentally trustworthy. Being able to pass a test is no indicator whatsoever as to the the kind of human being you are and the quality of work you will choose to perform, it just means that you can pass a test. And you simply destroyed your case by using doctors, lawyers, accountants and investment bankers as examples. I guess you haven't been reading the news: those groups have consistently shown themselves (at least in the U.S.) to have all the ingrained ethics of used car salesmen and professional thieves. Forcing that kind of "professionalism" on the software development industry would be a huge mistake and would result in even more downed aircraft and refinery explosions.

And yes, buildings don't fall (very often) and bridges don't collapse (most of the time), BUT the difference there is that the technologies and math used to design those constructs have been well understood for centuries. That same claim cannot be made for computing technology because it has only existed for a few decades, and is evolving constantly. Any certification examination required of software engineers will be obsolete a few months after it was administered. And may I point out that software-driven devices such as calculators, microwave ovens, automobiles and aircraft generally do function very well.

You completely miss the point that the developers themselves are not the problem. The problem is that business sees software as a commodity item, something to be packaged and sold and rushed to market as quickly as possible. Programmers, developers and software engineers are generally very aware of whether their product is ready for release or not, and will typically fight to keep it in-house until it is ready. Why? Because it would be irresponsible to do otherwise.

I might add that as a professional developer of high-reliability systems for the past twenty three years I have fought that same battle many times, on many fronts. Unfortunately, the engineers don't make the decision to release a defective product: management does, and it is management that must make the effort to understand the software development process and the consequences of corrupting it. If you want to certify anyone, start with them, because it is their poor decisionmaking that causes most of the issues you were talking about.

Look, all software has bugs. Any programmer that tells you his software is bug free is lying, ignorant or worse. However, if management sets in place proper testing and review processes, the majority of major problems can be found well before release and a product can gain a reputation for quality.

Unfortunately, such processes are resource-intensive and cost lots of money, and are often the first thing to be cut from the next year's budget. I would suggest that you look more into what actually goes on in most development houses before you cry "foul" and claim that those who create the software that drives our civilization are immoral, unethical or just incompetent.

Re:Regulation is not the answer

[jadavis]

Who is going to pay these costs? The costs for certification and increased education are high, and will undoubtedly increase the cost of developing software.

Why not regulate that everything has to be perfect? Some M&M candies are a little lopsided, so let's pass some regulations and make the employees get a license. That way nobody will have to eat another lopsided M&M, they'll all be made to a 10nm spec.

How about instead we just let consumers decide what's acceptable, and what prices they're willing to pay for higher design costs or other quality control.

Now, if the vendor is making false claims, that can be handled under existing laws. If they say it has feature X and it's so buggy that it's unreasonably difficult to use feature X due to bugs, than you should have a right to some kind of refund.

However, in the case of Microsoft software, most people KNOW how much it crashes/fails and KNOW that it may have to be rebooted frequently. MS makes no pretenses about perfect software. And MS software generally works, I can't (offhand) think of an advertised feature that is so dysfunctional that it should be called false advertising.

Re:Regulation is not the answer

[ScrewMaster]

If you design a bridge, it has one purpose only - to carry a road - which has weight travelling across it. You aren't going to suddenly find next week that someone also wants to keep their recepies on the thing, and use it to pretend they're shooting space aliens with ray guns, and then use it to balance their checkbook

That's true, but only because game programmers don't design bridges. However, the real issue here is simply one of complexity: the more things something is composed of, the more things there are to fail. An top-of-the-line Lincoln Continental, with all its built-in toys, will have more things break over time than a stripped-down Chevette.

To continue the previous example, a modern suspension bridge is a pretty damned complicated device, with a lot of potential failure modes. And, it's true ... they don't fall down very often. But you can bet your boots that every step in the design process for such a construct is thoroughly checked, double-checked, triple-checked and then checked again. Bridge designers and builders make a substantial investment in QC, because a. once the die is cast and the bridge is built you can't easily change it and b. the penalties for failure are immense.

From a business/management perspective, however, the vast majority of computer applications do not fall into those categories. Software is relatively easy to change after delivery, and b. there are few penalties for failure. Management frequently takes the position that it is more important to ship the product as soon as possible, and fix any problems later. It is that attitude that has to change if commercial software is going to get any better. There are shining examples of companies that do know how to do it right, but they are few and far between.

In any event, I'm not really disagreeing with you. I'm just saying that, as complex as modern programs are, we can do one hell of a lot better at making them reliable. We shouldn't have allowed organizations like Microsoft to use the excuse that, "Well, ya know ... it's just so darn complicated" to justify shipping bad software. Stop shipping features that nobody will ever use and start shipping features that work.

I read a book some twenty years ago that was called "How to purchase software" or something like that. It was written by a (rather intelligent) businessman who was responsible for selecting and buying software for a large corporation. He said one thing that sticks in my mind to this day: "If a feature doesn't work, then it isn't a feature."

Forget the regulation...

[jafo]

Regulation may or may not work. What would really work would be if the government (Microsoft's biggest customer, I've heard) stopped buying their products in favor of others that are more secure. Re-evaluate that when Microsoft's products have less of an issue.

I know that all systems have some security problems or another. I don't recall any of them having sent me a thousand e-mail messages every day, though. And it's not like this is the first time.

Let the government talk with it's money and people will listen.

Personally, I don't really like my tax money going so much to Microsoft. For one thing, I don't like that the privacy of my information and security of the systems relies on something that seems to have so many problems.

Sean

Re:they forgot to mention

[digitalunity]

It's not just Microsoft, they are just really prevalent. With new laws coming like UCITA, software makers can disclaim all liability while making false advertisements about the softwares ability to perform a certain function. Notice how every software maker has advertised that their product is the very best, most secure product on the market? How can everyone be the best all at once? It would also allow for far more draconian licensing clauses.

A little regulation would be nice. Obviously, the free market isn't going to regulate itself when the consumer and even the government has decided that this is normal and that they will just 'put up with it'. Well, some of us have had enough.

retro posting

[segment]

I tried to submit something similar before as an article but it was denied ... and I sincerely thought it is very relevant to this. According to the NSA's "Statement on Cybersecurity" paper released earlier this year, there were a few people who are spooked as the government seems to want to either backdoor or control somehow software under the guise of 'tougher security'

A significant cybersecurity improvement over the next decade will be found in enhancing our ability to find and eliminate malicious code in large software applications. Beyond the matter of simply eliminating coding errors, this capability must find malicious software routines that are designed to morph and burrow into critical applications in an attempt to hide. There is little coordinated effort today to develop tools and techniques to examine effectively and efficiently either source or executable software. I believe that this problem is significant enough to warrant a considerable effort coordinated by a truly National Software Assurance Center. This center should have representatives from academia, industry, federal government, national laboratories and the national security community all working together and sharing techniques to solve this growing threat.

And to add insult to injury to MS, a letter was sent to Tom Ridge asking the Dept. of Homeland Sec to limit or stop it's use of MS products due to insecurity.

Personally I would stop using machines if it were possible to have some form of monitoring of my actions without my authorization. Aside from that it's not a secret that the NSA has been accused of corporate espionage, so I would hope large corporations would think twice about giving them any form of say when it comes to codes for commercial software.

Re:they forgot to mention

[Eric Ass Raymond]

most of the vulns are in microsoft software

It only appears so because Microsoft's is found on practically every desktop and on the majority of server computer too.

If Linux were as popular as Windows, you can bet we'd be in the same situation. Why? Because the problem is only partially software. The main problem is the clueless user and to a lesser extent the feature bloat required by the users.

Let's imagine that the open source zealots got their wish and Microsoft was broken down or, even better, stopped selling software altogether and Linux would suddenly be the mainstay operating system both for desktops and servers. Linux would suddenly be truly big business. Corporations would develop their own distributions and make them as feature rich and easy to use as the Windows was. In other words the (alleged) superior security of linux distributions would be broken down in a day: The systems would enable logging in as root and would run all the conceivable daemons by default to avoid problems with third-party software.

But getting back to the article. If operating systems were to become a government supervised commodity with stiff penalties for those who produce insecure software, would you be prepared to accept that open source companies (or the copyright owner, FSF) would get fined for every security breach - just like the manufacturers of proprietary software?

Trends?

[NtwoO]

Isn't it strange how there is a marked surge in software control in the past few months with microsoft's main competitor being an OS that is being built with a relatively low centralized control

Re:Decent regulation is the only way

[BiggerIsBetter]

Anything government regulated is limited by borders and politics. Unless this sort of regulation is implemented by a non-governmental world body then it's useless and will only serve to segregate the internet.

trusted computing anyone?

[Alien Being]

Gates is probably telling Bush "see, this is why we need trusted computing." Bush will declare that either you are with him, or you are with the terrorists.

Re:they forgot to mention

[Rosco P. Coltrane]

Notice how every software maker has advertised that their product is the very best, most secure product on the market? How can everyone be the best all at once?

Err.. on what planet do you live? this isn't new and it's not limited to the computer industry. What has that got to do with UCITA? Have you ever seen a company say anything else but "leader in abc", "best product of xyz", ...? I'm still waiting for the pepsi bottle that says "great taste, second only to coke"

Blame the user

[madsen]

In just about every report on worms or virus attacks the user is blamed for propagating the problem. In the article Scott Charney (MS security chief) tells the users to get antivirus software and keep it up to date.
That wouldn't be necessary if the user does as his third suggestion, patch the system.
And that wouldn't be necessary if the system would be built more securely from the start.

A good idea for MS would be to not make their stuff so userfriendly that it automatically executes every virus attachement that it comes across but instead would warn the user by default.

Re:Blame the user

[dzym]

A good idea for MS would be to not make their stuff so userfriendly that it automatically executes every virus attachement that it comes across but instead would warn the user by default.

The default behavior for Outlook, Express, has already been to do this. It is certainly not Microsoft's fault a select subset of individuals aren't patching or are smart enough to be purposefully circumventing their attachment protections but are dumb enough to run attachments anyway.

Regulation vs Open Source

[jcam2]

While regulation of software might sound like a good idea to the anti-Microsoft crowd, consider how it would effect free software developers. Imagine if you couldn't release any software that hasn't been vetted by some government agency - that would be end end of 99% of the open-source projects out there.

And even if there were some excemption for not-for-profit developers, what about distribution companies like Redhat? They would be out of business in seconds ..

Re:Regulation vs Open Source

[mangu]

Imagine if you couldn't release any software that hasn't been vetted by some government agency

No, imagine if you couldn't sell any software that hasn't been vetted by some government agency...

Reprint of the story

[Florian Weimer]

Here.

Re:they forgot to mention

[turgid]

The BBC was making similar mistakes in reporting viruses, worms and security flaws until very recently. I emailed their editors and showed them the error of their ways. They now carefully mention which platform the vulnerabilities apply to when they report them...

The easiest way to cope with this threat

[kompiluj]

In my opinion the easiest way to cope with this threat is to make software companies responsible for their products - see article by Declan McCullagh.
Of course this regulation has to be done carefully - we shall deem liable for damages only those companies that require MONEY for that product: for instance when you install free version of RedHat Linux - RedHat (or anybody else) is not responsible for the damage, yet if you pay for this distro - then RedHat _shall_ be responsible - they can simply buy an insurance against such claims. I am sure that the price that Linux companies will pay for such insurance will be smaller than in case of Microsoft.

no, they will care when...

[ecalkin]

when their quicken data or other very personal info is 'liberated'. or any number of other personal information. can you imagine how fast things would be patched if a virus/worm scanned for quicken/quickbooks/misc financial data and emailed them to people in the local address book?

eric

Break up Microsoft, for God's sake

[goon america]

People accept the low level of software quality simply because the thought has never entered their heads that things could be any different. MS can get away with it, much like the old AT&T of yore, because it knows that switching and using an alternative is costly enough, if only cognitively costly enough, that people will be willing to accept a level of frustration up to the value of the cost of switching before doing so.

Regulating computer safety makes these guys exactly like the AT&T of yore. And don't we all know what happened with that?

So let some damned competition into the market. The only reason to trust these guys in any other situtation is to simply not understand the idea of a world without them, and sadly that seems to be the way most people think.

Re:Regulation is the goal

[Eric Ass Raymond]

I'll choose a democratically elected government over a plutocratic regime of corporations (=markets) any day.

Them wanting to control the IT market

Not all government control over the markets is bad. It's a fact that a capitalist society cannot self-regulate - it's natural growth is always towards a monopoly. This unhealthy growth cannot be curbed by some internal mechanism inherent in he markets (as libertarians like to believe) and external control is always required at some stage.

Software Regulation is going to be EXPENSIVE

[Anonymous Coward]

You don't buy a car for $20, $50 or even $399. Nor do we build bridges for anything near that cost. Realize that adding regulation will not significantly change the security issues and will cost end users tremendously.

You thought software prices in the 80's were horrible, wait until it costs you $70,000 for a text editor (that's been "certified").. that's where we're headed.

Software "Engineering" is still in its infancy. It's like civil engineering was back hundreds of years ago. In order to create more secure systems, we'll have to completely give up low-level languages and it'll take 10x as long to build in a feature (as it has to be "engineered" in).

Software Engineers will have to buy special insurance to protect them from lawsuits related to any potential bugs and that cost will be passed on.

I think arguments that more pressure should be put on Microsoft, which has been the source of probably 90% (or more) of the vunerabilities. Of course, when the gov't just slap the hands of a giant corporation for destroying markets with its monopolistic attacks, the clout of the gov't isn't all that great.

just hold businesses liable

[penguin7of9]

I think regulation is the wrong solution. A better solution is to hold companies responsible for security breaches.

Everybody keeps passing the buck: businesses blame the software company, software companies blame hackers, and ultimately the taxpayer and customer ends up paying for the incompetence and poor choices of the businesses.

Businesses should be primarily responsible for the harm that arises from the software they choose. If they want to pass on the risk of their choice to the software company, that should require an explicit contractual agreement.

And the government should get out of trying to regulate how software is written, and the government should get out of trying to catch "hackers".

Yes! Yes!

[moehoward]

Any user who does not patch daily and harms another due to not being patched should be punished. Here is how I think it should work....

A few big ISPs should simply start cutting service to those who have been backdoored and are zombies, have opened virus laden e-mails, or are otherwise infected and causing others problems. For example, no firewall on an open, always-on connection. Especially cable modem ISPs and DSL providers should do this. It should be VERY heavily marketed ... "If you don't patch and change your behavior, we cut you off without warning."

My feeling is that by doing this, people will finally start learning how to patch and how to not open e-mail attachments. People will get firewalls and AV software ASAP.

I have seen the threat of this work on a small scale. ISPs are dimwitted morons for not requiring this in the first place. How stupid to give a bunch of newbies loaded guns and then deny responsibility. Buy stock in firewall and AV companies!

Re:Yes! Yes!

[MadKeithV]

"Any user who does not patch daily and harms another due to not being patched should be punished"

95% of the people I have to go visit to solve serious computer-related problems wouldn't even know what the word "patch" means.

To me, requiring the average joe user to be on top of his patches is like asking average joe driver to stay on top of the advancements in electronic motormanagement technology. I just want to drive the damn car, fill up the water reservoir every now and then, and take the car in for regular checkups. If there is something seriously wrong with the car I'm using that causes it to be unsafe for either me, or other people, I expect the manufacturer or garage holder to notify me of this fact. If it's big enough, it'll be on the news (and it has been several times, relating to the recent worms).

Now, we don't really have "garage holders" for white-box PC systems, and even people like Dell aren't going to be particularly bothered. I think this is part of the problem. That's why half my neighbourhood comes to ME when they have issues, I'm the only guy that knows anything about computers that will actually put the time in to help them.

What we need is PC service centers. The kind where you walk in carrying your box under your arm, and your problems are fixed for a small fee. Not just "nothing works anymore" problems, but also setups, regular patchings, checkups for viruses (when are virus/worm scanners and firewalls going to become mandatory for any system that wants to connect to the internet anyway??)

Anyway, [/rant], [asbestos]

Re:they forgot to mention

[pesc]

Corporations would develop their own distributions and make them as feature rich and easy to use as the Windows was. In other words the (alleged) superior security of linux distributions would be broken down in a day: The systems would enable logging in as root and would run all the conceivable daemons by default to avoid problems with third-party software.

You may have a point. But if there were several corporations creating Linux distros, they would probably have different features, default deamons, etc. Virus would not spread as easily as they do now.

Also, with Linux an interested user can decide by himself what stuff he wants to install. If I don't want to use IE, Outlook express, Mediaplayer, etc, because I think they are full of spyware and insecure, it is quite difficult to choose something else under Windows. Not so on Linux.

Monopolies are bad. They make viruses spread more easily.

Solution - simple

[ajs318]

The idea of software being distributed without warranty dates all the way back to the first ever spreadsheet. The software company's lawyers were worried that if someone used the programme to design a suspension bridge, and it later collapsed and investigation proved that it was due to a flaw in the software, they might get sued. Furthermore, it would have been a physical impossibility to test the software in all circumstances. These were the days of 2MHz 8080 processors, lest we forget.

The sane response would have been "let them try, we'll never have what they're asking for and you can't be sued for what you've not got." Instead, that company explicitly disclaimed any warranty on their software, and the situation has persisted since. Today, one company is responsible for a lot of software, and they could easily afford to pay for several suspension bridge failures. But the law has not caught up with reality. The solution is simple and everyone will like it except the distributors of substandard software.

My proposed solution is to require all software to be guaranteed to perform substantially as indicated on the packaging. If you buy any other product, and it doesn't do what the literature said it was going to do, then you are entitled to a refund.

The only exception to the requirement for a guarantee would be where the source code is available for scrutiny. IMHO, reading the source code before deploying a mission-critical application is just Due Diligence. It has been stated by some that this is a lot of work to expect people to do. It is, but there is nothing to say independent bodies could not audit software for a fee. The GPL does not seek to prohibit anyone from making money out of their own work; only by misappropriating other people's work.

Whilst stopping short of my Ultimate Ideal, I think this is a fair compromise. Most goods are required to be guaranteed, why should software be any different? But Open Source software is more like self-assembly furniture: you {or a suitably qualified person in your pay} can examine the pieces {source code} before they are put together {compiled and installed}, determine suitability for your application, and make a decision: use as-is, use slightly-modified or reject outright. You only get your money back on kit-built stuff if there are actually any pieces missing; everyone understands that circumstances of deployment are beyond the control of the supplier.

Re:they forgot to mention

[turgid]

Dude, don't you have a job to do? Haven't you caught them pesky Duke boys yet?

And what would the OSS angle be then?

[Cooper_007]

Here you have a company that goes out and make some cool software that scratches an itch that a big chunk of the world also feels. The program is an instant hit, becomes #1 on CNET's download page and the main coder gets his picture on the cover of Time (one can always dream).

Suddenly a bug is discovered which will give others full control of your system. Acting quickly, a patch is created and a fixed version is put online, and warnings posted to all the regular places.

Several weeks later an exploit program is seen in the wild, attacking systems owned by CLUELESS USERS who either never knew of the problem, or were too lazy/overworked to fix it. The damage is immense, and in the current fingerpointing society most people blame this company even though they did everything that could be reasonably expected from them.

And now a growing group of people feel the government should be breathing down this company's neck for not making secure software?

Replace "company" with "group of OSS developers", and tell me how things should be different for this case, and why.

Mirrors suck, huh?

Make the Software Publisher Liable

[Korgan]

Get rid of the whole regulation issue. Thats not necessary. It would be far better to make the software publisher liable for any faults or flaws in the software that led to an incident such as MSBlaster, Slammer or any other number of worms out there.

Virii like SoBig.F are not something that can be avoided because the vulnerability there is the user themself. The only way to sort out virii like that is to educate users to not open email they are not expecting or recognise. Even then its still a risk.

If Microsoft were liable for the damages caused by the worms such as MSBlaster and Slammer because their software was vulnerable, don't you think their culture would change very rapidly? Instead of having the worst security reputation, they'd suddenly have the very best. Win2k3 is a good start in the right direction by disabling everything by default. I applaud that. Now they need to sort out their coding practices so that these sorts of issues are a non-event.

Governments don't need to regulate anything. All they need to do is make it illegal for a company to not take responsibility for faulty products, regardless of the product. It worked in the automobile industry, its worked in the medical industry, its worked in the engineering industry.

If my car explodes because of a fault in the fuel line at manufacturing, I'm perfectly within my rights to sue that company. If my computer becomes completely unusable because a vulnerability allowed someone to damage it or similar, why shouldn't I sue the publisher of that software? I'd also reserve the right to sue the person that exploited that vulnerability and caused the damage.

Don't need regulation, just liability and a warranty of suitability for a purpose. 'This OS is guaranteed to perform to XXXXXXX level and is considered suitable for XXXXXXXXXX purpose.'

Re:Make the Software Publisher Liable

[sql*kitten]

If Microsoft were liable for the damages caused by the worms such as MSBlaster and Slammer because their software was vulnerable, don't you think their culture would change very rapidly?

Well, given that Microsoft had released patches for both of the vulnerabilities exploited by those two viruses long before the viruses were ever released, I'm not sure it even should be liable. Nothing helps if the sysadmins don't stay on top of things.

Re:Make the Software Publisher Liable

[ctid]

Get rid of the whole regulation issue. Thats not necessary. It would be far better to make the software publisher liable for any faults or flaws in the software that led to an incident such as MSBlaster, Slammer or any other number of worms out there.

This wouldn't work because then no-one could use (eg) Debian Linux, as there is no one company behind it. The right way to prevent security problems is to make sure that there is fair and open competition in the OS market. This way a company whose products are proven over and over to be unreliable and insecure (naming no names) would simply be overtaken by its competitors. Once the company saw the writing on the wall, they might decide to focus properly on security, or run the risk of being driven out of the market. To achieve this, companies who sell OSs and applications should be forced to open up their secret protocols and file formats to ensure that competition is fair. This will have the additional effect of allowing a more varied ecosystem of OSes on the internet, making it far more difficult for virus and worm writers to hit a majority of machines.

Although these ideas would be good for competition and good for security and good for the economy, they won't happen because that is not how democracies work any more. Certain companies will buy political influence to prevent this happening. We are already seeing Microsoft claiming that it's "impossible" to create a secure computing platform without secure hardware. This sort of madness is likely to be the result of government intervention.

Re:they forgot to mention

[michaeltoe]

The free market does a fine job regulating itself, assuming users are willing to actually inform themselves. What's going on here, is the general populace is stupid about computers, and is opting for the government to do the thinking for them.

It could mean the end of open source...

[Anonymous Coward]

When M$ Windoze becomes fully warrantied (M$ can afford it), and most OSS coders don't dare accept liability for their software .... "Why should we be using Linux for our company systems? It doesn't even come with a guarantee! On with the windoze installation!"

semantic error in your reading of the article

[Simon]

"What we're seeing is that those voluntary efforts are insufficient, and the repercussions are vast."

I think that here "voluntary efforts" refers to businesses' efforts to handle security without regulations and laws forcing them to (i.e. 'voluntarily'), and doesn't refer to Open Source developers.

Have a nice day.

--
Simon

The last frontier

[scifiber_phil]

Part of the charm of the internet has always been its lack of regulation. It has been the last frontier that we can still explore. There were parts of it that should have been labelled on the map, "Here be monsters and sea serpents". Now, it is becoming like the cow town where the railroad now reaches, and the women have arrived, and they want to civilize the place. They want to hire a sheriff and close down the saloons. They want a dry goods store and a bank. The mountainmen and adventurers who first came are no longer welcome, and they will leave by their own choice, as this safe, homogeneous town is no longer interesting. The bad thing is, where will they go? Government regulation will be the death of innovation and the publishing of unpopular or non mainstream ideas. Sure, your IM program will be declared "safe" by the government. Nothing bad can happen, but your "smileys" don't interest me, and I will be leaving then, looking for another map with an area where there just may be sea serpents.

"Voluntary Efforts" Insufficient?!

[dollar70]

From the article:
"What we're seeing is that those voluntary efforts are insufficient, and the repercussions are vast."

Did I miss a meeting? Is this not Slashdot? I'm skimming through the posts and seeing a lot of cammoring that seems to approve regulating software. IS NOT LINUX A VOLUNTARY EFFORT?! Hand this guy a copy of Knoppix and tell him to crack it!

The biggest problem with computers on the internet today is the number of people who ran out and bought a computer because it looked like an interactive television. Hold the end user responsible for what their computer does.

I like to view my computer as one of my best friends... Proverbially, man's best friend is a dog... In other words, a pet. Think of it in this light: Do you sue the kennel when your dog bites your neighbor? No... You sue the kennel for selling you a dog with physical defect, but not a personality defect. You are responsible for your pet's actions, even if the kid down the street was shooting him with the super soaker, makes the dog mad, and the dog goes out on a rampage biting old ladies.

So if your computer goes out and bites another system, then you should be responsible for the cleanup costs regardless of who or what made it go off like that. Sure, it may sound harsh, but if it takes a few "Bonzai Buddy" users out of the pool, I doubt the net will suffer too greatly.

Re:they forgot to mention

[Anonymous Coward]

It only appears so because Microsoft's is found on practically every desktop and on the majority of server computer too.

Microsurfs repeat this myth a lot. Is it true? Does WinXX have more viruses and stability problems because it is on "practically every desktop and server"?

Obviously not. OpenSource software run 67% of the Internet, and Linux is underneath a large part of those applications, yet it is only those Internet servers running Microsoft products that are targets of the malware. It is a fact that Script Kiddies and Crackers target WinXX and its applications because they are easy to break into. As far as reliability goes, Bill Gates himself said that 50% of all WinXX platforms crash at least once a day. I have no doubts that the remaining 50% crash more than once a day. He also said that half of the stability problems were caused by drivers from 3rd party software house, but that leave four fingers pointing back at MS. He knows full well that if his platforms were more stable 3rd party software would be more stable. http://www.bugtoaster.com/dw15/Reports/OperatingSy stems.asp

Linux now runs about 25% of corporate America's servers and is probably settng on 10% of their desktops. In other countries the pecentages are higher. One would think that 25% of the viruses and trojans would be targeted at Linux, if susceptibility were merely a function of percentages. Not so. The fact is that unlike Windows, Linux stability is legendary, and so is the security. The properties were designed into Linux and the OpenSource paradigm is the major reason. "All bugs are shallow to a thousand eyeballs." Propriatary code can't match it. Another reason for Linux's security is that users don't run as root. Script kiddies running root kits have a much harder time breaking into a Linux box. That is why, when a Linux box is cracked, it becomes front page news, while the news about Microsoft cracks is how many millions of machines got compromised. Microsurfts failing to "patch" their boxes isn't the reason. The patches themselves can cause more holes than the ones they supposedly fix. The number of holes are so great it is becoming impossible for WinXX users to protect their machines. Anti-virus software can't work until the virus is trapped, analyzed and a fix created. By then many machines have bee compromised. It amazed me at work how much effort was required to clean up Natchi and SoBig, even though 6 MSCE labored furiously to secure our network before the infections were discovered.

Your comment reveals your ignorance about how Linux works but I'm not going to take the space here to explain it to you.

ENFORCE the antitrust laws

[dpbsmith]

The cause of the current problem is only partially due to insecure Microsoft software. It is very noteworthy that Windows 98 and 95 were immune from the latest round of malware (W32/Blaster, W32/Welchia, W32/Sobig.F). The main cause is monoculture--the dominance of a single operating system, Windows NT and its variants.

What we need is a truly competitive market in which many operating systems compete, no single operating system dominates, and a market that uses many operating systems therefore demands and rewards inoperability and writing software to standards rather than writing to a single vendor's API.

Why don't we have it? Because Microsoft was allowed to get a monopoly and the Justice Department is not doing its job and breaking it up.

It wouldn't be any different if IBM were the dominant company--as it was a few decades ago--or Apple, or what have you.

The problem is not Microsoft. The problem is monopolization. And the answer is not the free market--monopolies exist only when the market has already failed.

Regulation = Standardisation = More Worms

[R.Caley]

The main reason worms can cause such havoc is that they find themselves in a monoculture. We are in the software equivalent of the Irish potato famine.

What the government should do is enforce diversity. Requireing every government department above some minimum size to use systems from at least 3 independent sources would be a start.

Re:Regulation = Standardisation = More Worms

[Tony-A]

The main reason worms can cause such havoc is that they find themselves in a monoculture.
That makes it easy for the worms to cause havoc. The main reason worms cause so much havoc is the tendency to try to hide stuff from everybody.
CDs use Your computer to install and set up stuff so they can play themselves.
File extensions are hidden so you can click on a presumably well-named file and have the spreadsheet show up.
A general tendency to have to click on everything to be sure you don't miss something.
A belief that there's got to be a magic bullet that will make everything safe again. And the belief that with the magic bullet in place that everything is safe.
People click on things they shouldn't click on. Look at why they click on them.

"Regulation = Standardisation = More Worms"
You've got that right, but methinks there are secondary forces that are even stronger than the primary. There is a progression starting with Melissa. (Remember Melissa? Melissa was nice!) Methinks we're nowhere near seeing the end of it.

why do we tolerate anti-virus softare

[deafgreatdane]

"There are three major things every consumer and user of computers needs to do," Scott Charney, the security chief for Microsoft, said. "One, get antivirus software and keep it up to date. [...]"

I think this spin is one of the biggest problems with the public perception of computer security.

I find it appalling that we tolerate anti-virus software as a necessary solution. IMO, every virus is an exploitation of a bug in the software, and original vendor should be responsible for fixing the hole that allowed the virus to exist.

Why doesn't the press focus on the hypocrisy holding of software vendors more accountable for fixing their problems, while at the same time, advocating supporting a third part to fix the same problems?

I about blew my top when fixing my in-laws' machine for a case of blaster, and MS so "conveniently" linked one of the trusted anti-virus sites that offered removal tools. If it's microsoft's hole, why don't they provide a cleanup method?

(This is not to say we shouldn't have virus filters on SMTP and firewalls - there's nothing wrong with trying to block the spread of virii through multiple means)

Linux would never happen again

[kaybee]

The only way Linux, FreeBSD, and all of the other operating systems that have appeared over the years were possible is because of the lack of government regulation. Once the government steps in, it will only stifle creativity and limit consumer options.

Who is best to deal with government regulations? Microsoft.

Thanks, but no thanks. This issue will work itself out. We are in our growing stages. The government is not a solution to everything... actually, not much at all, really.

Toward a Programming Safety Authority?

[SysKoll]

Typical NYT drivel. A problem pops up? The Times clamor for government regulation. Astonishingly, when faced with a dramatic, err, bug in its own journalist monitoring activity, the NYT doesn't call for the gummint to create a Journalism Ethic Control Board. But these programmers guys? Yeah, they need to be kept under control.

The gummint will be only too happy to oblige and produce several layers of ineficient, costly, slow, slightly corrupt bureaucracy that will not solve the problem but will never disappear. As usual.

Let us put on our bureaucrat hat and see what can be done, in the immortal tradition of public service that gave us the Transportation Safely Authority. Let's see. Strip search programmers when they come to work in case they bring a copy of 2600? Have them remove their shoes? A nice start, but not enough.

See, the problem is that scumbags are writing programs that are up to no good. No scumbag coding, no worm and virus, eh? So let's put all compilers under lock. Let's make sure that scripting languages only accept input scripts that have been digitally signed by a new Programming Safety Authority. Let's make it a crime to use a computer without PSA-approved tools. Each program has to be certified by the PSA. Use the TCPA and Palladium chips to lock out all the bastards using non-PSA software and operating systems. Ban all non-Palladium computers and electronics. Do an FBI criminal check on each person entrusted with a compiler. And of course, recruits thousands of new civil servants to enforce all these new rules, at a low, low cost of [#insert eye-popping budget that will be overrun anyway].There you have, secure computing. A bit harsh, but it's for our safety, isn't it?

If you think the above is funny, I am sorry. I meant it to be ironic in a chilling way. Because when you start involving the government into a human activity, you never know how the bureaucrats are going to warp it.

So I'm gonna speak slowly so that even New York Times journalists can understand: KEEP GOVERNMENT OUT OF COMPUTING. Got it?

-- SysKoll

Regulation will stifle software

[scruffy]

Software engineering is unlike a lot of other engineering in that no one can predict with much certainty what a large program is going to do. This lack of certainly is not just bad engineering, it is a mathematically proven law of software. Add to that the fact that each computer runs a slightly different set of programs and is connected to a slightly different set of peripherals, then you have even a more impossible problem.

Software on airplanes work reasonably well because they test the hell of it and two airplanes of the same model are pretty much the same. Also, the users of the software (airplane crews) are well-trained. The exteme testing and thorough training though makes it very expensive. I don't think we can afford to hire software engineer and tutor for each household.

I would be afraid that regulation would not fully take into account the difficulties of making perfect software and dealing with untrained users.

Re:they forgot to mention

[archen]

If Linux were as popular as Windows, you can bet we'd be in the same situation. Why? Because the problem is only partially software.

I can download any Linux virus I want, and I can click on it as much as I want but guess what? It still won't run unless I mark it to execute. That practically eliminates email viruses that require people run them. Not to mention that hiding file extensions by default is really not user friendly in any way, and when your OS depends on the file extension to determine its action, HIDING the file extension is the last thing you want to do.

I'm careful what I wish for...

[cowbutt]

I do feel that, for a number of reasons, regulation will probably be the only way to make proprietary software vendors improve the quality of their products.

But on the other hand, if other industries are examined, such regulation will only turn into a further barrier to entry for new entrants to the market and non-commercial (i.e. Free and Open Source ) software.

I already see this when trying to sell FOSS solutions to the public sector, who invariably have successful "Common Criteria" evaluation as a "nice to have" (at least - in some cases it's mandatory).

Getting these evaluations done is expensive, so only the big boys get to play... Ironically, the people I talk with know that FOSS solutions are usually at least as secure as the products on their approved list, but their hands are tied by regulations and auditors.

--

Now watch as...

[Kyouryuu]

Now watch as Bill Gates and his cronies push for Trusted Computing, the Palladium project. After all, it's never Microsoft's fault that the bugs exist, right? It's always those darned users and by George we need to foolproof the system. Please. Trusting computing is a joke. It is a power play by top industry corporations to seize power and act as a yet another cohesive monopoly in a so-called free market. Just like the RIAA. Just like the MPAA.

Here's a thought. Hold the software companies responsible for their own goofups and bugs. Let the people sue. Let the people file their class action lawsuits against Microsoft for their errors. But don't let the government take control.

I don't want the ignorant US government, or any government for that matter, looking over the Internet and infringing on it any more than they already are. Half of those farts probably don't even know what the Internet is. I can't say I'd want these clueless individuals, easily motivated by legal bribery (lobbies) and big business (Palladium), to be involved. They will only serve to screw things up, pass ridiculous laws, and tax Internet commerce to death. Let the Internet be that one place government is unable to corrupt.

The problem is that the people who aren't on the Internet; the people who take passive interest in computers, are ignorant to these facts. That's why I feel, unfortunately, that things like Palladium are destined to pass. Microsoft and others are going to get these bills through the door while the politicians are still ignorant to computers.

I'd like to say we can stop them, but we don't have a $47 billion lobbyist group behind us.

Re:Why isn't security the ISP's responsibility?

[gr8_phk]

" Why isn't security the ISP's responsibility? "

You don't want the ISP to firewall for you. For this extra "service" you'd pay more. To open an extra port (to play quake for example) you'd have to pay extra. This would lead to every application using port 80 so they can get through the firewall, and then another mechanism (MS SOAP or whatever) to run other stuff through that port. At that point nothing is different except things are more complicated, and you gave up some freedom. Not to mention it makes the ISP responsible for the traffic on their network - something neither they nor you should want.

An incredibly BAD idea

[The Monster]

A little regulation would be nice

It is no more possible to have 'a little regulation' than to be 'a little pregnant'. Throughout the history of industrialized society, the same pattern has been repeated over and over with a new technology:

1. None of the existing agencies seems to have jurisdiction over the peculiar characteristics of the technology, so a thousand flowers bloom. Some work; others don't. The pioneers know this. They expect it.
2. The technology becomes sufficiently stable and productive, relative to existing alternatives, as to become important to the smooth flow of commerce. The 'civilized' people move into the former frontier territory, and expect services to be delivered on demand. They don't know nor care about the work done by the pioneers to get it to work as well as it does.
3. At a certain point, when the political climate is right, the Do-Gooders move in. They declare that the industry is rife with problems that only the government can solve. They seize upon some event (such as a multi-state/province blackout that can be plausibly traced to a computer worm) and demand a law to empower a new bureaucracy to oversee this wild, untamed industry.
4. Sooner or later, the law passes, and the Do-Gooders move on to the next Great Crusade. Meanwhile, the President has to appoint people to run the agency that regulates the industry.

   Now, who knows anything about the industry.... YES! That's right. The people who

   work in that industry (for companies that donated to my campaign).

5. The agency is now part of a revolving door system, where people put in a stint working for one of the major companies in the industry, then go to work for the agency that regulates them, then possibly back to private industry...

Regulating the software business per se would lead to a Federal Software Commission dominated by ex-MS employees, who would write regulations favorable to their former employer -- not even out of corruption but because they express the corporate culture inculcated into them. Mark my words: The day is coming when it will be as illegal to write computer software without a license from the government as it is to practice medicine, law, plumbing or cosmetology without one. Have you noticed that the more laws there are to regulate an industry, the more expensive it is to be a customer thereof? And if you think closed-source is bad, just you wait until the entire profession is reserved for those who take their apprenticeships with other members of the Guild.

Far better to fight laws like UCITA, DMCA, software patents, etc. that attempt to deprive software customers of the few rights they already have, than to try to push for empowering the government to screw customers even more.

Obviously, the free market isn't going to regulate itself when the consumer and even the government has decided that this is normal and that they will just 'put up with it'.

The free market has been forbidden to regulate itself. The customer has been forced to accept shrink-wrap licenses that deprive them, potential competitors, and independent consumer advocates, of the rights that would allow the free market to function correctly (by reverse-engineering to provide competing products, and benchmarking to judge performance and reliability). These licenses are already in violation of the fundamental principles of contract law.

We need to use the laws already on the books - how about a class action suit against a software company that puts out a shrink-wrap license that is fraudulent in the 48 states that haven't yet adopted UCITA (because it tells the customer that they must either accept its terms or return the software unopened for a refund, when no such license terms asserted after the sale can possibly be valid)? That would force the

Security and Open Source

[hackus]

After developing applications for a wide variety of banking industries it became clear that:

1) The only way to develope software systems, is to proactively secure the systems once they are deployed.

2) To proactively and continuously review and examine such systems, you must have the source code and build tools and access to the hardware engineering requirements of the systems involved.

3) The only known process where this can be achieved is through Open Source.

Closed binary proprietary software is not secure, cannot be MADE secure, is impossible TO secure and with patents and copyrights laws as written it could be quite possible you could be SUED for securing the software yourself.

Security became an extension of the software engineering process for the company I started previously, and it involved reviewing the source code and making changes, performing attacks, etc.

Critical to this process was to have as many eyes and opnions looking at the source code as possible. The more experienced professionals that had a chance to offer advice and opinions on the code, the better and more secure the code became.

An entire portion of the software engineering process cannot even be done with proprietary software, and I personally as a CIO, declared proprietary binary only software sales DOA in this industry 2 years ago.

-Hack

Some ISPs are getting clueful

[renehollan]

When I had DSL service, with a static IP address, in Allen, TX (a suburb of Dallas -- damn I miss living in Texas), my ISP made it clear to me that I should damn well get a firewall. Of course, (a) I knew this, (b) let them know, (c) told them I appreciated their efforts to educate their customers.

Now, this wasn't perfect, as they didn't require me to use a firewall, but it was better than nothing.

My ISP in Whitby, ON (Canada) (a suburb of Toronto -- damn I miss living in Texas), went a bit further: they were willing to provide me with a static IP address, if I could justify it to them. I let them know that (a) I liked to sink my own email with a backup MX if the connection went down and I did not run an open relay; (b) wanted to administer my home network remotely via ssh; (c) was planning to install a hardware firewall.

Interestingly, this ISP saved me the trouble of picking a firewall: they required that I use a particular brand of firewall/DSL modem. Unfortunately, it came configured wide open, but that was easy to fix. (amazing the traffic posting "crack past this firewall" to #2600 generates).

The Government Wants to Do _Something_

[Lucas Membrane]

How about revitalizing the role of government specs in government purchasing? The government is such a big customer, if they could simply stop buying system software products that presented too big a risk, the large vendors would find it advantageoous to provide software that didn't.

This worked for accessibility. When 11 state governments said that they would stop buying software with lousy accessibility for persons with disabilities, big software vendor(s) finally did something about it. Why shouldn't it also work for security???

This approach used to bring big advantages to the private sector, as manufacturers had to learn to do the right thing on many products. It has lost its impact recently, as the government has given in to business by buying COTS, no questions asked.

Re:they forgot to mention

[frovingslosh]

There's a reason they forgot to mention that. The effect of regulation like this will to be to keep many individuals and small shops from producing software. It might be a major step towards destroying Linux and other Open Source projects. Microsoft, big and rich enough to deal with any red tape and above the law when they do things illegal, will be unaffected. They will embrace it, may even be the force behind getting it started to smash those that dared to make better products.

Professional bodies / accreditation / problems

[Anonymous Brave Guy]

Certifying the developers wont help if the management is still pushing pushing to ship software with inadequate testing.

It will if those developers are personally responsible for the work, accountable to a supervisory professional body, and liable to lose their professional status and hence livelihood if they make a serious mistake. All the managers in the world won't get a known bad product out the door at that point, because every professional developer will tell them where to go. It's like unionisation, but with a somewhat different (and arguably less dangerous) slant.

The problem of course, is how to form a suitable supervisory body to do the accreditation. I sure as hell wouldn't trust most of the guys I've worked with to sit in judgement over the coding practices of another. Almost no-one invests the time and effort to get their skills to that level, because in most software development industries it's not worth it unless you're doing it as much out of interest and professionalism as out of a desire to earn your pay. In civil engineering, we have a long history of success stories and failures to provide concrete evidence (no pun intended) of what works and what doesn't. There is no analogue in software development today, and without it, who's to say what really constitutes "best practice"?

Re:Regulation is the goal

[ratamacue]

Name one monopoly that was achieved without the direct backing of government force, or more commonly, by exploiting an overly complex, ambiguous system of law.

Government is at the root of monopoly, not some "natural tendency of the market". The natural tendency of the market is to promote competition -- only government can prevent or eliminate it.