Hacker News Reader

When an aircraft crashes and the NTSB gets involved to investigate, does the aircraft manufacturer get sued? I don't know. Why can't we set up something like the NTSB for critical infrastructure stuff at least? I can see how setting it up for consumer stuff would suck. But purpose of the org would be to make stuff safer and develop best practices, not assign blame. I'm probably naive, as I don't know all the good and bad details of how NTSB investigations work. But I figure that's a good place as any to find inspiration for something that could work?

OSS libraries are almost always shipped with a no warranty license. Your router however is not. The Vendor shipping a hardware product IS responsible for the quality and safety of that product. By shipping libraries as part of their product with a no warranty liability to lower their costs they absorb the liability.

If a software company tells me, that their software is safe, they should be liable in case it isn't.

Most FOSS licenses come with 'without warranty' notice. Businesses, who use it, should know that.

Sounds like it would be smartest for all software to come with a warning that it may be vulnerable to malicious interference. It'll be the software version of a Prop 65 warning.

There's no such thing as absolutely safe software.

We have fairly complex rules already in place when it comes to hardware safety. Manufacturers aren't liable if they can show that they performed due diligence in designing their product. Why can't we have something similar for software?

Except we can forbid by law to attach such devices to public networks. If you want to attach a router with no guarantees of security, by a router with guarantee of security and plug in it before vulnerable one.

Perhaps a “UL Labs” type of solution for software, so that if your software and organization are certified according to the current standard, then your liabilities would be reduced?

And yes, organizations and versions of software would have to be recertified on a regular basis.

You would want software versions to be able to be certified quickly and through an automated process, but there is already some best practice in this space — it’s just unevenly distributed.

Ask and you shall receive, something...

Past event: https://www.aei.org/events/securing-the-internet-of-things-a...

Partial event video: https://www.youtube.com/watch?v=DrnFcLuqzd4

If certification authority said that software is secure and then security flaws are found, then who is liable?

IMHO, we should have optimistic check: any public network device must have guarantee from the vendor to fix any remote vulnerability in 30 days after discovery by independent security organization(s), otherwise vendor liable for the damage done by his device.

> Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways.

When it comes to SOHO routers it's not as hard as it should be, by a long shot. Tons of hardcoded creds and pretty surface vulns in them.

> - Is the distributor of the router liable for a vulnerability in a used library? Surely they could vet and review libraries.

Yes.

> - What happens if that library is openssl and almost all webservers on the internet are vulnerable?

Everyone deploying it is liable.

> - What happens if the library is used in an insecure way? For example, if you seed openssl or libressl with weak random numbers, it is possible to attack algorithms provided by the library.

The company doing so is liable.

> - On the contrary, if the author of a library is liable, what's going to happen if I use a library of a company and build something vulnerable with it intentionally?

You are liable.

As in, the person who produces the product is liable for what they put in the product.

But, as I said elsewhere, this is all off the cuff and relies on a way to properly classify software, which is extremely hard.

But yeah, to your points, none of those feel hard to deal with at all.

I'm not a lawyer. This is not an area I'm so familiar with. But we already have some controls for CC info, and extending those further would be hard but a good start. This situation is extremely out of hand, whether I have the solution today or not.

I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’ve still shipped bugs. Should I be sued out of existence?

We don’t need hardware and software costs spirally out of control like healthcare because of the liability. If device makers would just support their products (bug fixes) for 10(?) years I think that would do it.

It seems to me this is one of those situations where the programmer mindset does not properly interface with the lawyer mindset.

In programming, you have true and false, and generally things fall into one or the other category with no human input.

In law, you have concepts like "reasonable", and a whole lot of human input, by design.

So my expectation would be that if software vendors were to be held responsible for bugs in their products, the standard they would be expected to adhere to would be "reasonable expectation of proper functioning", with humans intepreting what "reasonable" means.

On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.

What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it?

Change the phrase "software bug" to "engineering error". Then consider the liabilities involved with the manufacture of any real-world-might-kill-someone product. The lawyer's view starts to make a helluva lot more sense.

> What makes software so special in engineering, aside from the amazingly terrible culture we've crafted around it?

Millions of malicious people constantly attacking it with cheap equipment from a distance with little chance of being caught doing so?

Whilst that is true, it doesn't have to be that way. If from day one, liability for software bugs lead back to whomever wrote the code, then the world would be a much different place.

For one thing, we would be much more conservative in how we wrote code. Libraries would be vetted, with insurance contracts attached to them. Programming languages would not allow for dynamic data, type coercion, or weak typing. In the 80s, rather than C rising to prominence, Ada would have. Haskell would be our generations Javascript, and XHTML would have won over HTML5 simple because guessing how rendering should work would open up a browser maker to high fines and lawsuits.

We'd have to rewrite our entire software stack from the ground up. It's not impossible, but we'd have to view it as a multi-decade transition like how the chemical industry was slowly forced to not use heavily polluting procedures.

The pace of software innovation to lack of liability from simply writing code has brought us the entire information age.

Other engineering disciplines are very conservative. Due to age, this doesn't compare well to software.

There is tradition, but a lot of it military in origin, not civil: ARPA net, Grace Hopper, and the first bug, Turing and the Enigma. Stealworking as a military secret in comparison is thousands of years old. And so far, leaked DB content has per the official record not killed anyone ... perhaps a few astronauts but none of the people responsible in place to fix it, as would be the case in a family of incorporated electricians.

We need a code-code.

I've been shipping production software for years... I think you've misread my post if you think I said that every bug should lead to a lawsuit. It's right in the first part of my first post that we should not be holding every product equally liable for every bug.

There is a line somewhere, and beyond that line is negligence. A developer exposing a potential vulnerability in an internal service that does not handle sensitive information is clearly not across that line, a company that creates routers that constantly have serious holes, that handle sensitive information, seems clearly on the other side.

Deciding exactly where that line exists is obviously complex.

Why would routers be handling sensitive information? You're doing something seriously wrong. Perhaps you should be fined for not encrypting your communications?

wat

you mean like, say, routing all of the traffic from my system to the internet?

You should not be transmitting sensitive information to the internet.

So don’t use online banking, or email, or online insurance or any online healthcare, or ... ?

Do you seriously use any of those without TLS? In the year 2018?

>>>> - What happens if that library is openssl and almost all webservers on the internet are vulnerable?

>>> Everyone deploying it is liable.

> I've been shipping production software for years...

Have you ever shipped software which depends on openssl? If not, then pretend that you have. Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for because you deployed something using openssl?

Yes, I have.

> Since you believe that you are liable, can you give me a ballpark of how much money you think you personally should be sued for because you deployed something using openssl?

This is a really ridiculous question. I've already stated that these things are complicated - you're asking for a hard number?

Companies should take responsibility for their users data, which includes understanding the risk involved in third party libraries they use.

If they're concerned about fees, invest in the security of the project you're using.

But this is all based on some hypothetical, undefined 'law', so arguing about the specific mechanics is pointless.

>> can you give me a ballpark

> you're asking for a hard number?

No, I am not asking for a hard number, I specifically asked for a ballpark.

> invest in the security of the project you're using

I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security

> arguing about the specific mechanics is pointless

Agreed, my goal is not to flesh out the mechanics, it is to demonstrate the pitfalls of such a law. I'm only asking for a ballpark (again, not a hard number) so that you can personally understand why you and every other serious developer would be sued out of existence unless you propose obscenely small fines (which would make the whole idea useless, because then developers could easily afford to be negligent without getting too much of an increase in fines).

> No, I am not asking for a hard number, I specifically asked for a ballpark.

Yes, and it's a fake law that doesn't exist. How would I possibly answer this?

Off handedly, I'd say that the fine could really range depending on a lot of things. Was this an outdated version of OpenSSL that they just didn't patch? Was it a programmer error using the library? A 0day? All of these things would probably make a big different - charging companies for 0days in 3rd party code, in at least many cases, would not make sense.

> I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security

At some point if companies can't afford to keep users safe maybe they just shouldn't be companies. And if we're talking about router companies, they have the cash.

> why you and every other serious developer would be sued out of existence unless you propose obscenely small fines

I would imagine instead that companies would have insurance around these issues to cover developers, but again, the legal components of this are not something I'd want to get into since I'm not qualified to.

>charging companies for 0days in 3rd party code, in at least many cases, would not make sense.

Well you've just made the workaround trivial. Open source the majority of everything under a separate org and then use that stuff from the product being shipped. Therefore any vulns are not their problem.

>And if we're talking about router companies, they have the cash

I don't think you understand how tiny the margins are in consumer networking gear. Lowest price dominates.

>the legal components of this are not something I'd want to get into since I'm not qualified to.

Suggesting they be liable is a legal component.

If vendors refuse to update vulnerable OpenSSL library when fix is provided for free, risking their customers, then they should be punished until they change their altitude. Volunteers are doing that for free. Why businesses cannot pay to OpenWrt project for 10 year service for their products?

Most routers are shit. Manufacturers slap together a version of linux, some crappy web ui, and ship it. It is unlikely to receive any updates or patches.

Manufacturers should be liable for the poor quality of the devices they make. Software vulnerabilities are a fact of life, because there is no driving force to be better. Strict liability would force the industry to be more like other engineering disciplines.

Take the grand parent comment as written by a consumer, not a producer.

Given the above, consider the future of semi-autonomous and fully-autonomous vehicles.

Safety liability follows and ends with the chain of financial transactions.

No commerce, no liability.

> Software is complex, and bad software even more so, and an integrated hardware/software system is even worse.

You nailed the problem here, though you don't seem to realize it. Yes, software is very complex. Maybe it should be made simpler instead of buggier.

Do you sell the product? If you don't, why is this a concern? I think the parent's arguments are for software that's being sold, not just random silly project that you don't care about (which is obvious if you don't sell it).

Software is a mess by choice. Let those who made it a mess burn.

Nobody has half a fucking clue where the libraries they're slapping together come from, nor how they're maintained, nor how they're vulnerable. It gets worse every day with trash like DockerHub, and has no relief in sight.

So yeah -- let the folks who won't adhere to proper engineering burn.