Increased Software Vulnerability, Gov't Regulation

PogieMT writes "An article in the New York Times (registration required) suggests that the rash of security flaws, viruses and worms is leading a push towards greater regulation by the government, which, according to the piece, has largely relied on the efforts of individual companies."

Comments

Regulation is not the answer

[sql*kitten]

Regulation is not the answer - professionalism is. The government has oversight over the construction industry for example, but engineers are accredited and the profession is run day-to-day but the professional institution, in the UK this is the Institute of Civil Engineers. Same in medicine, the government oversees, but day to day regulation rests with the BMA, the British Medical Association, and doctors answer to them. Same with lawyers, accountants, investment bankers... even lifeguards and hairdressers have professional bodies.

Software development needs to become more like engineering, and software developers should be required to take a qualification like CEng (UK) or PEng (US) in order to work in positions of authority and responsibility. Remember that engineering is about public safety - bridges don't often collapse, buildings don't often topple, and that's all because the people designing them have been certified by independant bodies. Programmers of safety-critical systems are already often required to be certified by the relevant body, usually that of the electrical engineers.

Re:Hmmm

[rknop]

Call me cynical, but I don't think the US government are getting into this for the sake of safeguarding my PC from viruses...

It's cynical, but it's also not an unreasonable fear based on anybody who's been rationally observing the behavior of our government recently.

I fully expect that we'll see increased security resolutions which are ostensively tough on companies like Microsoft, but those companies will embrace them (while all the while getting good PR about "doing the right thing and making the right sacrfices") because ultimatly they will only be minor inconveniences... while the regulations that show up will all but prohibit free software (at least for commercial purposes, and possibly for anybody who wants to connect to the Internet), meaning that in the long run Microsoft benefits hugely from those "minor inconveniences".

Meanwhile, the regulations-- like a lot of what we've seen with airport security-- won't increase actualy computer security one whit, but anybody who complains about them will be chastised by John Ashcroft as a whiner who won't let the government do what it needs to safeguard our homeland.

Yeah, I'm cynical too.

-Rob

trusted computing anyone?

[Alien Being]

Gates is probably telling Bush "see, this is why we need trusted computing." Bush will declare that either you are with him, or you are with the terrorists.

Re:Regulation is the goal

[Eric Ass Raymond]

I'll choose a democratically elected government over a plutocratic regime of corporations (=markets) any day.

Them wanting to control the IT market

Not all government control over the markets is bad. It's a fact that a capitalist society cannot self-regulate - it's natural growth is always towards a monopoly. This unhealthy growth cannot be curbed by some internal mechanism inherent in he markets (as libertarians like to believe) and external control is always required at some stage.

An incredibly BAD idea

[The Monster]

A little regulation would be nice

It is no more possible to have 'a little regulation' than to be 'a little pregnant'. Throughout the history of industrialized society, the same pattern has been repeated over and over with a new technology:

1. None of the existing agencies seems to have jurisdiction over the peculiar characteristics of the technology, so a thousand flowers bloom. Some work; others don't. The pioneers know this. They expect it.
2. The technology becomes sufficiently stable and productive, relative to existing alternatives, as to become important to the smooth flow of commerce. The 'civilized' people move into the former frontier territory, and expect services to be delivered on demand. They don't know nor care about the work done by the pioneers to get it to work as well as it does.
3. At a certain point, when the political climate is right, the Do-Gooders move in. They declare that the industry is rife with problems that only the government can solve. They seize upon some event (such as a multi-state/province blackout that can be plausibly traced to a computer worm) and demand a law to empower a new bureaucracy to oversee this wild, untamed industry.
4. Sooner or later, the law passes, and the Do-Gooders move on to the next Great Crusade. Meanwhile, the President has to appoint people to run the agency that regulates the industry.

   Now, who knows anything about the industry.... YES! That's right. The people who

   work in that industry (for companies that donated to my campaign).

5. The agency is now part of a revolving door system, where people put in a stint working for one of the major companies in the industry, then go to work for the agency that regulates them, then possibly back to private industry...

Regulating the software business per se would lead to a Federal Software Commission dominated by ex-MS employees, who would write regulations favorable to their former employer -- not even out of corruption but because they express the corporate culture inculcated into them. Mark my words: The day is coming when it will be as illegal to write computer software without a license from the government as it is to practice medicine, law, plumbing or cosmetology without one. Have you noticed that the more laws there are to regulate an industry, the more expensive it is to be a customer thereof? And if you think closed-source is bad, just you wait until the entire profession is reserved for those who take their apprenticeships with other members of the Guild.

Far better to fight laws like UCITA, DMCA, software patents, etc. that attempt to deprive software customers of the few rights they already have, than to try to push for empowering the government to screw customers even more.

Obviously, the free market isn't going to regulate itself when the consumer and even the government has decided that this is normal and that they will just 'put up with it'.

The free market has been forbidden to regulate itself. The customer has been forced to accept shrink-wrap licenses that deprive them, potential competitors, and independent consumer advocates, of the rights that would allow the free market to function correctly (by reverse-engineering to provide competing products, and benchmarking to judge performance and reliability). These licenses are already in violation of the fundamental principles of contract law.

We need to use the laws already on the books - how about a class action suit against a software company that puts out a shrink-wrap license that is fraudulent in the 48 states that haven't yet adopted UCITA (because it tells the customer that they must either accept its terms or return the software unopened for a refund, when no such license terms asserted after the sale can possibly be valid)? That would force the