Hacker News Reader

Comment by hendzen | Hacker News Reader

So are you personally volunteering to rewrite all of Linux and glibc in Rust? Are you or your employer volunteering to fund such efforts? There is a reason it hasn't happened yet - because doing so would be exceptionally time consuming and expensive.

View on HN

I think OP isn't naively assuming it would be easy, or any one person would do it. More the point is there probably isn't enough of an effort or emphasis on the Linux/OSS communities part to even attempt it.

Right now, companies that run linux on their servers don't have to pay huge fines when security meltdowns happen.

I imagine if they would, they would put more money into the problem: either fund linux development or created more of a market for commercial server operating systems (which can still be open source, at least in some interpretations of the term), for example.

No. Strict liability for third party software failure is not a good idea. Software gains much much more from the freedom to innovate than it loses from exploits. Strict liability would be a terrible blow against basically everything HN represents.

Well, there are areas where freedom to innovate is more important, and then there are areas where liability is more important.

May be US (as de-facto main government-level actor in IT and internet) could create voluntary certification that opened up companies to such liabilities? Small startup operating from a garage — no certification necessary, but users are aware that no one is guaranteeing anything. IBM? Level A certification which they advertise everywhere, with billions of dollars in potential fines.

If it was voluntary, I doubt many of those companies would see it as worth the risk. The problem is that these errors happen because so many people are working on interdependent parts. Many times, it's not even your error that can make your software vulnerable. I dislike making anything so risky, because we'll see much, much less good software at the end of the day.

Plus a culture of risk-avoidance, blame-shifting and bureaucracy-over-innovation.

I even feel the breath of having Ada (the language) enforced over all of us again, and similar ideas...

(Not that Ada is so bad as a language, it's more about the ideas of enforcement and top-down control...)

Reply on news.ycombinator.com