Re:Book Review: "This Is How They Tell Me the World Ends"
by tshaddox on Thursday February 25, 2021 @06:50PM
(#26269888)
> The situation you are describing is that automobile safety is implemented primarily by establishing standards and only secondarily by the existence of liability (though it's important).
Indeed, regulatory standards is what I was hinting at, not just civil liability (although I believe both exist for car manufacturers, and should probably exist for software vendors).
Re:Book Review: "This Is How They Tell Me the World Ends"
by joe_the_user on Thursday February 25, 2021 @07:30PM
(#26270188)
Yes, we desperately need broad but appropriate regulatory standards. Especially, security standards and research should focus on securing infrastructure and infrastructure type resources. The hacked water supply article from just a few days ago was shocking even to cynical me.
Things like institutes that study this situation outside the government itself may be necessary to establish trust at this point.
And you can't make the standards primarily about software vendors.
The situation you are describing is that automobile safety is implemented primarily by establishing standards and only secondarily by the existence of liability (though it's important).
Now, if you had a large company that bought cars and modified them, that company would itself have an obligation to do it safely too. And having regulations about that would be an absolutely necessary part of liability and safety.
...we absolutely have discovered some vulnerabilities which can be protected against using certain software development techniques, and I see no reason why software vendors ought not be liable for damages caused by their failure to follow these established techniques.
I would note that the existence of zero-days is absolutely not the most pressing problem of software security. Having a reasonable system of connecting X to Y is far more pressing. You can get in as much trouble with a misconfigured system as with a vulnerable system. But broadly, your point that there should be standards, is good.