Slashdot Mirror
Increased Software Vulnerability, Gov't Regulation
PogieMT writes "An
article in the New York Times
(registration required) suggests that the rash of security flaws, viruses and
worms is leading a push towards greater regulation by the government, which,
according to the piece, has largely relied on the efforts of individual
companies."
Much like car safety between the '50s and '70s. Manufacturers simply didn't care about safety, because the customer didn't care.
Be wary of any facts that confirm your opinion.
Call me cynical, but I don't think the US government are getting into this for the sake of safeguarding my PC from viruses...
Regulation is not the answer - professionalism is. The government has oversight over the construction industry for example, but engineers are accredited and the profession is run day-to-day but the professional institution, in the UK this is the Institute of Civil Engineers. Same in medicine, the government oversees, but day to day regulation rests with the BMA, the British Medical Association, and doctors answer to them. Same with lawyers, accountants, investment bankers... even lifeguards and hairdressers have professional bodies.
Software development needs to become more like engineering, and software developers should be required to take a qualification like CEng (UK) or PEng (US) in order to work in positions of authority and responsibility. Remember that engineering is about public safety - bridges don't often collapse, buildings don't often topple, and that's all because the people designing them have been certified by independant bodies. Programmers of safety-critical systems are already often required to be certified by the relevant body, usually that of the electrical engineers.
Regulation may or may not work. What would really work would be if the government (Microsoft's biggest customer, I've heard) stopped buying their products in favor of others that are more secure. Re-evaluate that when Microsoft's products have less of an issue.
I know that all systems have some security problems or another. I don't recall any of them having sent me a thousand e-mail messages every day, though. And it's not like this is the first time.
Let the government talk with it's money and people will listen.
Personally, I don't really like my tax money going so much to Microsoft. For one thing, I don't like that the privacy of my information and security of the systems relies on something that seems to have so many problems.
Sean
I tried to submit something similar before as an article but it was denied
Personally I would stop using machines if it were possible to have some form of monitoring of my actions without my authorization. Aside from that it's not a secret that the NSA has been accused of corporate espionage, so I would hope large corporations would think twice about giving them any form of say when it comes to codes for commercial software.
MoFscker
It only appears so because Microsoft's is found on practically every desktop and on the majority of server computer too.
If Linux were as popular as Windows, you can bet we'd be in the same situation. Why? Because the problem is only partially software. The main problem is the clueless user and to a lesser extent the feature bloat required by the users.
Let's imagine that the open source zealots got their wish and Microsoft was broken down or, even better, stopped selling software altogether and Linux would suddenly be the mainstay operating system both for desktops and servers. Linux would suddenly be truly big business. Corporations would develop their own distributions and make them as feature rich and easy to use as the Windows was. In other words the (alleged) superior security of linux distributions would be broken down in a day: The systems would enable logging in as root and would run all the conceivable daemons by default to avoid problems with third-party software.
But getting back to the article. If operating systems were to become a government supervised commodity with stiff penalties for those who produce insecure software, would you be prepared to accept that open source companies (or the copyright owner, FSF) would get fined for every security breach - just like the manufacturers of proprietary software?
BOO! TERRO
Gates is probably telling Bush "see, this is why we need trusted computing." Bush will declare that either you are with him, or you are with the terrorists.
Notice how every software maker has advertised that their product is the very best, most secure product on the market? How can everyone be the best all at once?
...? I'm still waiting for the pepsi bottle that says "great taste, second only to coke"
Err.. on what planet do you live? this isn't new and it's not limited to the computer industry. What has that got to do with UCITA? Have you ever seen a company say anything else but "leader in abc", "best product of xyz",
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Regulating computer safety makes these guys exactly like the AT&T of yore. And don't we all know what happened with that?
So let some damned competition into the market. The only reason to trust these guys in any other situtation is to simply not understand the idea of a world without them, and sadly that seems to be the way most people think.
Them wanting to control the IT market
Not all government control over the markets is bad. It's a fact that a capitalist society cannot self-regulate - it's natural growth is always towards a monopoly. This unhealthy growth cannot be curbed by some internal mechanism inherent in he markets (as libertarians like to believe) and external control is always required at some stage.
BOO! TERRO
Any user who does not patch daily and harms another due to not being patched should be punished. Here is how I think it should work....
... "If you don't patch and change your behavior, we cut you off without warning."
A few big ISPs should simply start cutting service to those who have been backdoored and are zombies, have opened virus laden e-mails, or are otherwise infected and causing others problems. For example, no firewall on an open, always-on connection. Especially cable modem ISPs and DSL providers should do this. It should be VERY heavily marketed
My feeling is that by doing this, people will finally start learning how to patch and how to not open e-mail attachments. People will get firewalls and AV software ASAP.
I have seen the threat of this work on a small scale. ISPs are dimwitted morons for not requiring this in the first place. How stupid to give a bunch of newbies loaded guns and then deny responsibility. Buy stock in firewall and AV companies!
"If you want to improve, be content to be thought foolish and stupid." - Epictetus
Corporations would develop their own distributions and make them as feature rich and easy to use as the Windows was. In other words the (alleged) superior security of linux distributions would be broken down in a day: The systems would enable logging in as root and would run all the conceivable daemons by default to avoid problems with third-party software.
You may have a point. But if there were several corporations creating Linux distros, they would probably have different features, default deamons, etc. Virus would not spread as easily as they do now.
Also, with Linux an interested user can decide by himself what stuff he wants to install. If I don't want to use IE, Outlook express, Mediaplayer, etc, because I think they are full of spyware and insecure, it is quite difficult to choose something else under Windows. Not so on Linux.
Monopolies are bad. They make viruses spread more easily.
)9TSS
Suddenly a bug is discovered which will give others full control of your system. Acting quickly, a patch is created and a fixed version is put online, and warnings posted to all the regular places.
Several weeks later an exploit program is seen in the wild, attacking systems owned by CLUELESS USERS who either never knew of the problem, or were too lazy/overworked to fix it. The damage is immense, and in the current fingerpointing society most people blame this company even though they did everything that could be reasonably expected from them.
And now a growing group of people feel the government should be breathing down this company's neck for not making secure software?
Replace "company" with "group of OSS developers", and tell me how things should be different for this case, and why.
Mirrors suck, huh?
Get rid of the whole regulation issue. Thats not necessary. It would be far better to make the software publisher liable for any faults or flaws in the software that led to an incident such as MSBlaster, Slammer or any other number of worms out there.
Virii like SoBig.F are not something that can be avoided because the vulnerability there is the user themself. The only way to sort out virii like that is to educate users to not open email they are not expecting or recognise. Even then its still a risk.
If Microsoft were liable for the damages caused by the worms such as MSBlaster and Slammer because their software was vulnerable, don't you think their culture would change very rapidly? Instead of having the worst security reputation, they'd suddenly have the very best. Win2k3 is a good start in the right direction by disabling everything by default. I applaud that. Now they need to sort out their coding practices so that these sorts of issues are a non-event.
Governments don't need to regulate anything. All they need to do is make it illegal for a company to not take responsibility for faulty products, regardless of the product. It worked in the automobile industry, its worked in the medical industry, its worked in the engineering industry.
If my car explodes because of a fault in the fuel line at manufacturing, I'm perfectly within my rights to sue that company. If my computer becomes completely unusable because a vulnerability allowed someone to damage it or similar, why shouldn't I sue the publisher of that software? I'd also reserve the right to sue the person that exploited that vulnerability and caused the damage.
Don't need regulation, just liability and a warranty of suitability for a purpose. 'This OS is guaranteed to perform to XXXXXXX level and is considered suitable for XXXXXXXXXX purpose.'
The cause of the current problem is only partially due to insecure Microsoft software. It is very noteworthy that Windows 98 and 95 were immune from the latest round of malware (W32/Blaster, W32/Welchia, W32/Sobig.F). The main cause is monoculture--the dominance of a single operating system, Windows NT and its variants.
What we need is a truly competitive market in which many operating systems compete, no single operating system dominates, and a market that uses many operating systems therefore demands and rewards inoperability and writing software to standards rather than writing to a single vendor's API.
Why don't we have it? Because Microsoft was allowed to get a monopoly and the Justice Department is not doing its job and breaking it up.
It wouldn't be any different if IBM were the dominant company--as it was a few decades ago--or Apple, or what have you.
The problem is not Microsoft. The problem is monopolization. And the answer is not the free market--monopolies exist only when the market has already failed.
"How to Do Nothing," kids activities, back in print!
I find it appalling that we tolerate anti-virus software as a necessary solution. IMO, every virus is an exploitation of a bug in the software, and original vendor should be responsible for fixing the hole that allowed the virus to exist.
Why doesn't the press focus on the hypocrisy holding of software vendors more accountable for fixing their problems, while at the same time, advocating supporting a third part to fix the same problems?
I about blew my top when fixing my in-laws' machine for a case of blaster, and MS so "conveniently" linked one of the trusted anti-virus sites that offered removal tools. If it's microsoft's hole, why don't they provide a cleanup method?
(This is not to say we shouldn't have virus filters on SMTP and firewalls - there's nothing wrong with trying to block the spread of virii through multiple means)
The gummint will be only too happy to oblige and produce several layers of ineficient, costly, slow, slightly corrupt bureaucracy that will not solve the problem but will never disappear. As usual.
Let us put on our bureaucrat hat and see what can be done, in the immortal tradition of public service that gave us the Transportation Safely Authority. Let's see. Strip search programmers when they come to work in case they bring a copy of 2600? Have them remove their shoes? A nice start, but not enough.
See, the problem is that scumbags are writing programs that are up to no good. No scumbag coding, no worm and virus, eh? So let's put all compilers under lock. Let's make sure that scripting languages only accept input scripts that have been digitally signed by a new Programming Safety Authority. Let's make it a crime to use a computer without PSA-approved tools. Each program has to be certified by the PSA. Use the TCPA and Palladium chips to lock out all the bastards using non-PSA software and operating systems. Ban all non-Palladium computers and electronics. Do an FBI criminal check on each person entrusted with a compiler. And of course, recruits thousands of new civil servants to enforce all these new rules, at a low, low cost of [#insert eye-popping budget that will be overrun anyway].There you have, secure computing. A bit harsh, but it's for our safety, isn't it?
If you think the above is funny, I am sorry. I meant it to be ironic in a chilling way. Because when you start involving the government into a human activity, you never know how the bureaucrats are going to warp it.
So I'm gonna speak slowly so that even New York Times journalists can understand: KEEP GOVERNMENT OUT OF COMPUTING. Got it?
--
Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/
Software on airplanes work reasonably well because they test the hell of it and two airplanes of the same model are pretty much the same. Also, the users of the software (airplane crews) are well-trained. The exteme testing and thorough training though makes it very expensive. I don't think we can afford to hire software engineer and tutor for each household.
I would be afraid that regulation would not fully take into account the difficulties of making perfect software and dealing with untrained users.
Now watch as Bill Gates and his cronies push for Trusted Computing, the Palladium project. After all, it's never Microsoft's fault that the bugs exist, right? It's always those darned users and by George we need to foolproof the system. Please. Trusting computing is a joke. It is a power play by top industry corporations to seize power and act as a yet another cohesive monopoly in a so-called free market. Just like the RIAA. Just like the MPAA.
Here's a thought. Hold the software companies responsible for their own goofups and bugs. Let the people sue. Let the people file their class action lawsuits against Microsoft for their errors. But don't let the government take control.
I don't want the ignorant US government, or any government for that matter, looking over the Internet and infringing on it any more than they already are. Half of those farts probably don't even know what the Internet is. I can't say I'd want these clueless individuals, easily motivated by legal bribery (lobbies) and big business (Palladium), to be involved. They will only serve to screw things up, pass ridiculous laws, and tax Internet commerce to death. Let the Internet be that one place government is unable to corrupt.
The problem is that the people who aren't on the Internet; the people who take passive interest in computers, are ignorant to these facts. That's why I feel, unfortunately, that things like Palladium are destined to pass. Microsoft and others are going to get these bills through the door while the politicians are still ignorant to computers.
I'd like to say we can stop them, but we don't have a $47 billion lobbyist group behind us.
It is no more possible to have 'a little regulation' than to be 'a little pregnant'. Throughout the history of industrialized society, the same pattern has been repeated over and over with a new technology:
Regulating the software business per se would lead to a Federal Software Commission dominated by ex-MS employees, who would write regulations favorable to their former employer -- not even out of corruption but because they express the corporate culture inculcated into them. Mark my words: The day is coming when it will be as illegal to write computer software without a license from the government as it is to practice medicine, law, plumbing or cosmetology without one. Have you noticed that the more laws there are to regulate an industry, the more expensive it is to be a customer thereof? And if you think closed-source is bad, just you wait until the entire profession is reserved for those who take their apprenticeships with other members of the Guild.
Far better to fight laws like UCITA, DMCA, software patents, etc. that attempt to deprive software customers of the few rights they already have, than to try to push for empowering the government to screw customers even more.
The free market has been forbidden to regulate itself. The customer has been forced to accept shrink-wrap licenses that deprive them, potential competitors, and independent consumer advocates, of the rights that would allow the free market to function correctly (by reverse-engineering to provide competing products, and benchmarking to judge performance and reliability). These licenses are already in violation of the fundamental principles of contract law.
We need to use the laws already on the books - how about a class action suit against a software company that puts out a shrink-wrap license that is fraudulent in the 48 states that haven't yet adopted UCITA (because it tells the customer that they must either accept its terms or return the software unopened for a refund, when no such license terms asserted after the sale can possibly be valid)? That would force the
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.