The point of an analogy is to point out that certain aspects of two things are comparable in a certain context. It's true that there are significant differences between cars and software, like, say, the presence of wheels, but those aren't relevant to the specific point I was making. What is it exactly that makes the development of regulation of car safety so different from the development and (potential) regulation of software security?

It's not the presence of wheels, it's the difficulty of even defining what software operating 'correctly' means. This is a fairly well-understood aspect of software in general, not just the security part - hence everything from the important (e.g. halting problem) to the silly ('software will eat the world'). Software represents models we make up and on top of that, ones we interpret. Cars are not like that. You don't say your car made a mistake when it refuses to start one cold morning. There's essentially universal agreement on the 'semantics' of cars and bridges.

The notion of software operating correctly didn't really come up. We're not talking about regulating the reliability or effectiveness of software, but rather the security vulnerabilities, and I suspect the regulations would treat the seriousness of different vulnerabilities by the actual harm they can do, just like flaws in the manufacturing of cars. And sure, there are still cases where one could argue about whether a certain attribute of a certain piece of software constitutes a security vulnerability or not, but that's okay. Laws aren't mathematical proofs. There is undoubtedly some ambiguity and room for reasonable debate in the specifics of car safety regulations as well.

> You don't say your car made a mistake when it refuses to start one cold morning. There's essentially universal agreement on the 'semantics' of cars and bridges.

Since you mentioned it...I don't know whether this is the case, but I would guess that there might be regulations about the temperatures at which car batteries and other components must be capable of operating at. And, as car automation software becomes more advanced and prominent, I think we'll be discovering that there is not in fact universal agreement on the "semantics" of cars. There is probably already considerable overlap in the subjects of my analogy, for recent self-driving capabilities but also for much older standard things like airbags and anti-lock braking systems.

I'm not sure how the security is different than the correctness. Security is just an aspect of it - the software doesn't do what it's supposed to, in some specific way.

But my broader point was that this analogy is basically what 'can god make a rock so big they can't pick it up' is to a discussion of theology.