"So too, opinion seems to be that security holes are entirely the fault of the attacker, never of the software designers.... The point is, if software companies were liable for any serious defects, they might try harder. And if they were liable for ignoring those defects, I betcha they'd be able to find someone to get to work on it... We, the public simply need to weigh in with some careful legislation to balance those priorities with stability, reliability, and maturity. "
I'm sorry, but I simply don't agree with this point of view. Your heart is in the right place, but this is not the answer.
First, the hacker *is* guilty. Software is designed for a specific purpose (even general purpose software) and because of that, the creator of that software cannot and should not be held liable for that. Problem #1 is that software is written by humans, who are, by nature, error prone. Problem #2 is that finding defects and using them maliciously requires creativity. Because of this, there's no practical way for a software company to know that their software is 'liability free'. Problem #3 is that there are far too many products out on the marketplace today that can be misused in such a way that a simple modification would prevent that sort of behaviour from happening. Why single out software? Problem #4 is that in cyberspace, monetary damage is very difficult to measure. Problem #5 is that the environments that the software is run on are far too diverse to guarantee any sort of working order. As such, anybody 'relying' on a computer system would be incredibly ignorant without ways of minimizing damage due to loss of functionality or data. (I should pause here a sec to let you know that I'm quite fatigued, and I apologize if what I'm posting is difficult to read.)
Secondly, unloading legislation that says you are liable for an attack that somebody else carries simply because you didn't cover all your bases is going to do more harm than good. The Open Source Community will be hit the hardest. Who would want to contribute spare time to a project only to open the door for being sued because somebody decides to be a git? I mentioned in an earlier point that there's no real scientific way to certify the 'safety' of software. The only real way to approach that would be heavy testing on a very diverse range of platforms and configurations. I can see Microsoft with their 25+ billion in the bank doing this, I can't see a startup company doing that. Nor can I see that startup company surviving their first lawsuit over this. The only way to minimize this negative effect on the industry would be to tightly define very specific rules about very specific exploits, such as the one you mentioned with Apple. Well, what good is this legislation going to have if it only covers a limited scope? Okay, I'm drifting a bit here. Sorry. I just don't see this doing anything but making software development less accessible, and making megacorps like Microsoft stronger. Software could become 'less exploitable', but the cost of that is growth. Even then, defects will not disappear. BS like the Blaster Worm will still happen, it just might take a little longer.
Third, how does one even begin to define effective legislation here? In order to prevent a defect from being exploitable, one has to know every single way that defect can be used. I remember back in the Windows 95 days, you could rename your Windows folder. Doing so meant instantly breaking your system. A shortcut or batch file could be made to do this. If somebody sends out an email tricking people into running a shortcut to do this, how do you define Microsoft's guilt due to damage done? The rename feature works perfectly. Using it to rename your Windows folder is like cruising down the highway at 70mph and shifting into reverse. Sure, the car could be made to prevent that, but why would somebody do that in the first place? Should Honda be partly responsible because of deaths caused by somebody saying "
There was no need to defend Linux, I was not attacking it. I never said Linux was bloated, nor was that the point I was trying to make. Nobody modded me as funny because they thought I was saying Linux is bloated. Rather, I was modded up for pointing out how absurd it was to measure bloat by the size of the installation media.
"Presumably, they simply didn't take the issue seriously or deemed it unworthy of addressing for some other reason (which leads us back to just how trustworthy your computing really is, if you can't trust the company that designed it)."
The oft neglected third option is that there's a long list of things to do ahead of a given defect. There are only so many programming monkeys at Microsoft or Apple working on code. In other words: A neglected defect is not automatically an indication that a company is evil, incompetent, or uncaring.
"Your honor, the defense introduces into evidence this box of computer software, labeled 'Photoshop,' and these three photos which purport to show the defendant flying over the Washington monument in the fashion of a comic book superhero..."
It takes talent to do this undetectably, but yes it can be done. I saw some show where a man played a practical joke on his mom by having a video made of her summer home destroyed by an explosion. The effect was done well enough that she batman'd into the car and drove all the way to the house. All it took was some video of the house, some stock footageof explosions, and somebody fairly talented with After Effects (or similar).
Makes you wonder: how long before the video cameras inside of cop cars are challenged because of what can be done with modern computer hardware and software?
"...that's why you have the option to test the media before installing"
You should still have the option of being able to put another copy of the disc in. We have several laying around the office. If I could just have popped in another disk it would have saved hours.
... that highly specialized distros of Linux like these are going to be what gets it into households. Bonus points of they make it CD bootable like Knoppix.
Man I'd love to have a mail server distro. Just run the install, then get a little wizard thing that asks the questions it needs to know to be configured, then boom, you have a mail server.
Make another for web server, office workstation, game distro, artist distro, PDA distro, etc. If focus is given to suit these needs, people will be less shy about trying them out. I know I would be. It's rather daunting to set up Linux, then have NFI what you want to do next, then when you do get an idea it's a PITA to find out what you need to do it.
The simple solution is to mimick what is done on ICQ. It's just a simple whitelist with a method to request permission to be on that. I get 0 spam through ICQ. (Trillian, more specifically.)
I really hope one day email 'version 2' is implemented with this type of security in mind. Seems like a better effort than filtering.
Hmm. Is there a popular destination then that's 5 hours'ish? I was in Adelaide so I doubt it was like New Zealand. (T'weren't Perth either, it was from another country.)
"the new CAN-SPAM law will cost him an additional $3000 in costs to set up a genuine opt-out list. Anyone here feel sorry for him?"
Yes, I do, sort of. It's not $3,000 to set it up, it's $3,000 per month. I hate spam, I think even less of spammers, I want them shut down. But I think the only way this is going to happen is if they can work legitimately. Strange, eh? Well, if they're working legitimately, it means I can easily say "NO LEAVE ME ALONE" and they'll have to respect that to stay in business. That solves my problem. But if it's too hard/expesnive to operate legitimately, then what will it do to the SPAM market besidse move it's base to a place where US law doesn't reach? I'll still get spam and he's out of a job. (Sorry, I don't have enough anger in me to wish him homeless.)
Eh, maybe I don't feel all that sorry for him, maybe I just feel it's futile. I dunno. To be honest, I don't think he's the right guy to blame. He's providing a service and making decent money out of it. It's the companies providing the demand for that service who are the real problem.
"I have never once been ashamed of what I do," he said. "I feel this is a business that has afforded me and my customers a better way of life."
That's an astonishing line coming from him. Millions of people would love to kick him in the nads, and he's not ashamed of that? 50 million people in the USA stand up and say "We don't want telemarketing calls", and he's still not ashamed?
Slashdot Mirror
"The worm, first discovered Tuesday, is capable of spawning multiple instances of itself on one PC."
Something us Mac users don't have to worry about. We don't have pre-emptive multitasking! *SmUg*
.. they should just wait. The game is old now. By raising all these issues, GTA is going to experience a new wave of interest.
You'd think after what happened with Napster that people in general would learn not to draw extra attention to something you hate so much.
" I'd imagine that all sorts of issues get involved, from racial/ethnical issues ("Kill the Haitians!")"
Man, that shouldn't even be an ethnic/racial issue. The reference was to the Haitian gang, not the entire population from that background.
Why do people bitch about understandable typos in words that are not in the common daily lexicon when there's a perfectly good joke there?
"So too, opinion seems to be that security holes are entirely the fault of the attacker, never of the software designers. ... The point is, if software companies were liable for any serious defects, they might try harder. And if they were liable for ignoring those defects, I betcha they'd be able to find someone to get to work on it... We, the public simply need to weigh in with some careful legislation to balance those priorities with stability, reliability, and maturity. "
I'm sorry, but I simply don't agree with this point of view. Your heart is in the right place, but this is not the answer.
First, the hacker *is* guilty. Software is designed for a specific purpose (even general purpose software) and because of that, the creator of that software cannot and should not be held liable for that. Problem #1 is that software is written by humans, who are, by nature, error prone. Problem #2 is that finding defects and using them maliciously requires creativity. Because of this, there's no practical way for a software company to know that their software is 'liability free'. Problem #3 is that there are far too many products out on the marketplace today that can be misused in such a way that a simple modification would prevent that sort of behaviour from happening. Why single out software? Problem #4 is that in cyberspace, monetary damage is very difficult to measure. Problem #5 is that the environments that the software is run on are far too diverse to guarantee any sort of working order. As such, anybody 'relying' on a computer system would be incredibly ignorant without ways of minimizing damage due to loss of functionality or data. (I should pause here a sec to let you know that I'm quite fatigued, and I apologize if what I'm posting is difficult to read.)
Secondly, unloading legislation that says you are liable for an attack that somebody else carries simply because you didn't cover all your bases is going to do more harm than good. The Open Source Community will be hit the hardest. Who would want to contribute spare time to a project only to open the door for being sued because somebody decides to be a git? I mentioned in an earlier point that there's no real scientific way to certify the 'safety' of software. The only real way to approach that would be heavy testing on a very diverse range of platforms and configurations. I can see Microsoft with their 25+ billion in the bank doing this, I can't see a startup company doing that. Nor can I see that startup company surviving their first lawsuit over this. The only way to minimize this negative effect on the industry would be to tightly define very specific rules about very specific exploits, such as the one you mentioned with Apple. Well, what good is this legislation going to have if it only covers a limited scope? Okay, I'm drifting a bit here. Sorry. I just don't see this doing anything but making software development less accessible, and making megacorps like Microsoft stronger. Software could become 'less exploitable', but the cost of that is growth. Even then, defects will not disappear. BS like the Blaster Worm will still happen, it just might take a little longer.
Third, how does one even begin to define effective legislation here? In order to prevent a defect from being exploitable, one has to know every single way that defect can be used. I remember back in the Windows 95 days, you could rename your Windows folder. Doing so meant instantly breaking your system. A shortcut or batch file could be made to do this. If somebody sends out an email tricking people into running a shortcut to do this, how do you define Microsoft's guilt due to damage done? The rename feature works perfectly. Using it to rename your Windows folder is like cruising down the highway at 70mph and shifting into reverse. Sure, the car could be made to prevent that, but why would somebody do that in the first place? Should Honda be partly responsible because of deaths caused by somebody saying "
My dad's password was a little too easy to guess.
There was no need to defend Linux, I was not attacking it. I never said Linux was bloated, nor was that the point I was trying to make. Nobody modded me as funny because they thought I was saying Linux is bloated. Rather, I was modded up for pointing out how absurd it was to measure bloat by the size of the installation media.
"I heard that OSX is based on eunichs!"
Oh man, heh. I hope that gets modded up. It'll light a fire under the Slashdotters here to come up with something a little more edgy than 'Windoze'.
"Presumably, they simply didn't take the issue seriously or deemed it unworthy of addressing for some other reason (which leads us back to just how trustworthy your computing really is, if you can't trust the company that designed it)."
The oft neglected third option is that there's a long list of things to do ahead of a given defect. There are only so many programming monkeys at Microsoft or Apple working on code. In other words: A neglected defect is not automatically an indication that a company is evil, incompetent, or uncaring.
Ha! Us Windows users don't have this problem. Microsoft won't let us use a Windows OS that old! *SmUG*
Exchange LOL for "overlord".
"Your honor, the defense introduces into evidence this box of computer software, labeled 'Photoshop,' and these three photos which purport to show the defendant flying over the Washington monument in the fashion of a comic book superhero..."
It takes talent to do this undetectably, but yes it can be done. I saw some show where a man played a practical joke on his mom by having a video made of her summer home destroyed by an explosion. The effect was done well enough that she batman'd into the car and drove all the way to the house. All it took was some video of the house, some stock footageof explosions, and somebody fairly talented with After Effects (or similar).
Makes you wonder: how long before the video cameras inside of cop cars are challenged because of what can be done with modern computer hardware and software?
"...that's why you have the option to test the media before installing"
You should still have the option of being able to put another copy of the disc in. We have several laying around the office. If I could just have popped in another disk it would have saved hours.
Thank you for mentioning that! *bookmarked*
... that highly specialized distros of Linux like these are going to be what gets it into households. Bonus points of they make it CD bootable like Knoppix.
Man I'd love to have a mail server distro. Just run the install, then get a little wizard thing that asks the questions it needs to know to be configured, then boom, you have a mail server.
Make another for web server, office workstation, game distro, artist distro, PDA distro, etc. If focus is given to suit these needs, people will be less shy about trying them out. I know I would be. It's rather daunting to set up Linux, then have NFI what you want to do next, then when you do get an idea it's a PITA to find out what you need to do it.
The simple solution is to mimick what is done on ICQ. It's just a simple whitelist with a method to request permission to be on that. I get 0 spam through ICQ. (Trillian, more specifically.)
I really hope one day email 'version 2' is implemented with this type of security in mind. Seems like a better effort than filtering.
"Suggestions for a Home-Built Telescope"
Move into an apartment complex with attractive tenants.
Mozilla because I'm low on karma!
"Why doesn't anybody on Slashdot appreciate these anymore? "
Microsoft to Slashdot is like Michael Jackson to the outside world. Microsoft could cure cancer and people'd still be worried about DRM.
I didn't attack or make fun of Linux, not sure why anybody feels the need to redundantly defend it.
So yeah, whatever.
Okay, and?
Not trying to be an ass here, but I'm not sure why you're pointing this out.
Oops, sorry.
Hmm. Is there a popular destination then that's 5 hours'ish? I was in Adelaide so I doubt it was like New Zealand. (T'weren't Perth either, it was from another country.)
Sorry, it was back in 98 when I was there.
"If Windows included all the source to ALL the programs that it installed and/or recommended, I doubt 5 discs would even start. " ...and?
"the new CAN-SPAM law will cost him an additional $3000 in costs to set up a genuine opt-out list. Anyone here feel sorry for him?"
Yes, I do, sort of. It's not $3,000 to set it up, it's $3,000 per month. I hate spam, I think even less of spammers, I want them shut down. But I think the only way this is going to happen is if they can work legitimately. Strange, eh? Well, if they're working legitimately, it means I can easily say "NO LEAVE ME ALONE" and they'll have to respect that to stay in business. That solves my problem. But if it's too hard/expesnive to operate legitimately, then what will it do to the SPAM market besidse move it's base to a place where US law doesn't reach? I'll still get spam and he's out of a job. (Sorry, I don't have enough anger in me to wish him homeless.)
Eh, maybe I don't feel all that sorry for him, maybe I just feel it's futile. I dunno. To be honest, I don't think he's the right guy to blame. He's providing a service and making decent money out of it. It's the companies providing the demand for that service who are the real problem.
"I have never once been ashamed of what I do," he said. "I feel this is a business that has afforded me and my customers a better way of life."
That's an astonishing line coming from him. Millions of people would love to kick him in the nads, and he's not ashamed of that? 50 million people in the USA stand up and say "We don't want telemarketing calls", and he's still not ashamed?
Oooookay. I'm glad I have a soul.