News for hackers. Stuff that matters.
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by sneed_chucker on Thursday September 21, 2023 @02:34PM (#37601986)
I mean, there's a reason most FOSS software licenses contain some variation of "THIS SOFTWARE IS PROVIDED 'AS IS' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES..."
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by numbsafari on Thursday September 21, 2023 @02:43PM (#37602109)
That's all software.
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by l33t7332273 on Thursday September 21, 2023 @02:53PM (#37602244)
I don’t think it is. If you pay for software it generally comes with some warranty and guarantee of fitness for purpose.
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by thesuperbigfrog on Thursday September 21, 2023 @03:11PM (#37602568)
>> If you pay for software it generally comes with some warranty and guarantee of fitness for purpose.

Generally it does not:

Microsoft Windows EULA states:

"Disclaimer. Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. Microsoft and the device manufacturer and installer exclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement. If your local law does not allow the exclusion of implied warranties, then any implied warranties, guarantees, or conditions last only during the term of the limited warranty and are limited as much as your local law allows. If your local law requires a longer limited warranty term, despite this agreement, then that longer term will apply, but you can recover only the remedies this agreement allows."

Source: https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/U...

Oracle EULA states:

"Disclaimer of Warranties; Limitation of Liability THE PROGRAMS ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. ORACLE FURTHER DISCLAIMS ALL WARRANTIES, EXPRESS AND IMPLIED, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT."

Source: https://www.oracle.com/downloads/licenses/standard-license.h...

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by inetknght on Thursday September 21, 2023 @03:14PM (#37602626)
> Generally it does not:

And that's a real damn shame, too. If only we had actual Engineering certifications for software engineers.

Things would be a lot more expensive... but perhaps they'd be a lot more consumer-friendly too.

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by glitchc on Thursday September 21, 2023 @03:38PM (#37603016)
Even in places where Engineers are distinct from Developers (see Canada above), it's not common to learn code safety as a core principle for writing good software. Safety critical and real-time software principles are topics often left to upper year electives.
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by josephg on Thursday September 21, 2023 @04:15PM (#37603637)
My university (UNSW in Australia) had a compulsory “Ethics for software engineers” course as part of my CS degree. It was shockingly interesting and relevant. We studied various ethical frameworks, went through case studies about bad software killing people and had class debates and things.

An ethics course is no panacea. But what I learned in ethics has been far more useful in my career than a lot of my hard CS subjects.

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by pgeorgi on Thursday September 21, 2023 @03:23PM (#37602787)
> If only we had actual Engineering certifications for software engineers.

See Canada: Software Engineers are called Software Developers there, problem solved.

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by mardifoufs on Thursday September 21, 2023 @07:40PM (#37605951)
No, we have actual software engineering degrees. So there are software engineers here too.
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by xmcqdpt2 on Saturday September 23, 2023 @07:03AM (#37622131)
Ton nom d'utilisateur ne me rappelle pas de souvenirs parce que j'ai tout oublié de ces mardis là
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by mardifoufs on Sunday September 24, 2023 @04:13PM (#37636696)
Hahahahaha I wish je pouvais oublier quelques mardi moi. Au moins c'était pas des jeudi :)
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by AnimalMuppet on Thursday September 21, 2023 @03:33PM (#37602943)
Microsoft doesn't provide any guarantee of fitness for use, and you blame that on software engineers being uncertified? Blame it on Microsoft!

(Now, there might be an argument you could make that, if software engineers had actual certifications, they would have the leverage to push back against Microsoft management and say "no, we're not going to ship that". But I'm pretty sure that wouldn't work, at least not at this stage of the game. Microsoft would just find coders in India or the Philippines or somewhere to implement it where there are no such professional regulations. No, when a company the size of Microsoft does something like that, the problem is not with the individual contributors.)

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by pjmlp on Thursday September 21, 2023 @03:49PM (#37603231)
Many countries have them.
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by josephg on Thursday September 21, 2023 @04:22PM (#37603742)
Yeah. I don’t think engineering certifications are needed. But I do think it should be illegal for companies to avoid legal liability for their products like this.

I mean, you don’t sign a 20 page contract when you visit a restaurant saying you agree not to sue them if you get food poisoning. Or sign something saying you take responsibility if you die in a plane crash, or from a shoddy building collapsing on your head. Companies in all other areas of society are held responsible for foreseeable harm caused by the products they sell. EULAs make a mockery of that, and the law should void or ban them.

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by eastbound on Thursday September 21, 2023 @04:49PM (#37604110)
Software has catastrophic bugs that make it more like house of card engineering than building engineering. But sure we can make NASA-grade programs, for NASA prices. Or actually we can’t, because there is an extremely limited supply of such scientists, who would also accept to work on a boring data entry app.

Software also suffers of untold expectations. Companies regularly spend as much time writing specs as developing the real software, and yet, imprecision still dominates the implementation.

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by delfinom on Friday September 22, 2023 @12:15PM (#37613913)
I assure you, software engineers have zero say in the licensing decisions beyond the size of a small corp. It's all the management and lawyers at work.

In fact, in the US, if you get a licensed engineer to do an inspection or design job, they will also often include a list of disclaimers to avoid liability. You often have to negotiate the lack of said liability waiver in advance for a higher fee. Note, liability waivers don't protect from negilence, just all other scenarios.

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by l33t7332273 on Thursday September 21, 2023 @03:30PM (#37602918)
Did you check the guarantee associated with Windows enterprise?
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by thesuperbigfrog on Thursday September 21, 2023 @04:36PM (#37603944)
>> Did you check the guarantee associated with Windows enterprise?

That's a deep rabbit hole that leads to the Underdark (https://en.wikipedia.org/wiki/Underdark) of Enterprise Legal Agreements.

Only high-level legal wizards and magisters can go there and expect to understand anything and keep their sanity.

Not a lawyer, but I expect it comes down to "if you follow our guidelines and pay us enough we can make the following guarantees, but there are certain things that we simply do not cover."

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by l33t7332273 on Thursday September 21, 2023 @05:39PM (#37604767)
>if you follow our guidelines and pay us enough we can make the following guarantees, but there are certain things that we simply do not cover

This is exactly what a warranty is though.

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by numbsafari on Thursday September 21, 2023 @05:57PM (#37604978)
Has the Commerce Dept gotten any money back?
Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by thesuperbigfrog on Thursday September 21, 2023 @06:03PM (#37605028)
>> This is exactly what a warranty is though.

Yes, but it is not for consumers. It is for big businesses that pay millions and have specific expectations. The more you are willing to pay to more you can get within specific limits.

Your original statement, "If you pay for software it generally comes with some warranty and guarantee of fitness for purpose." does not hold for consumers and only partially holds for enterprise customers.

It might be better stated: "If your business / entity / government has specific needs (e.g. compliance with legal or medical regulations, industry certifications, ISO requirements, auditing, etc.), has a large sack of money to pay, and a team of lawyers, then there are some software publishers who will sign contracts to guarantee you certain qualities about the software you license with them and perhaps some level of support of that software."

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by GoblinSlayer on Friday September 22, 2023 @06:27AM (#37610251)
It's in the next paragraph:

---

Limited Remedy. If Microsoft, or the device manufacturer or installer, breaches its limited warranty, it will, at its election, either: (i) repair or replace the software at no charge, or (ii) accept return of the software (or at its election the device on which the software was preinstalled) for a refund of the amount paid, if any.

---

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by nobody9999 on Thursday September 21, 2023 @03:42PM (#37603111)
>If you pay for software it generally comes with some warranty and guarantee of fitness for purpose.

Unless it's some sort of bespoke software with a detailed contract (the details of which aren't available), I don't believe that's true.

Every single software license (as well as websites and other services) I've ever read (over the past 30 years or so) has had some similar disclaimer.

Would you provide an example that doesn't follow that pattern?

Re:US Cybersecurity: The Urgent Need for Memory Safety in So... by NegativeK on Thursday September 21, 2023 @03:10PM (#37602547)
That's absolutely not all software.