Comment by tcd | Hacker News Reader

Comment by tcd | Hacker News Reader

Parent Full thread

Yup. These days the law doesn't really factor in the consequences of code/programming as it's almost impossible to legislate that.

For example, you could run NPM update that installs a malicious package that is somehow able to connect to your MySQLD and access all the tables (that contain geolocation information on children) and execute a cronjob to perform a query to backup the .sql data and upload it to a remote server.

There would be 0 consequences legally for such an action (or development would cease to function entirely).

Besides, how is knowingly storing GPS information on children acceptable? They can't consent, so maybe it's time to apply that to things like geolocation as well.

Code has no consequences, because law makers likely don't "get" what that means. You may think it's just $GPSOfALLChildrenInTheDatabase but that variable can cause actual, real harm to humans.

There's totally a disconnect.

> They can't consent

The parents consented and the majority of states in the United States consider children property of the parents before they turn 18. It's sad, but normal.

Why can't we legislate that getting owned by npm is your own fault?

Driving a car that hasn't passed minimal safety and status checks in many European countries is forbidden, why not forbid the use of stupid package managers?

You realize that a car is much more dangerous than a GPS location right?

A package manager is just that, a package manager.

Legislate as much as you want over software where live are in dangers, sure. I would be happy to see legislation over software like the one for the Therac-25, but legislation over package manager? Yeah no...

You also want to add minimal safety laws over shoes too?

You realize it depends where and why the GPS location was collected? For example the GPS location leaked by a gay dating app in certain countries means certain death for the person.

Wow you were quick to read and comment. I updated it before seeing your answer.

Sure it depends, which is exactly the point that I meant. A package manager is a use case pretty large.

You wouldn't have the same safety requirement over both shoes and cars, thus the same apply to software.

Indeed, a piece of software needs to be looked at in proper context, but that doesn't mean we should continue with the current wild west - if you sell a piece of software why shouldn't there be authorities that monitor the software not to be malicious? We have alcohol licenses for example, why not have the same with software?

Or a malicius packages just updating Linux. It is a lot easier to hide than in NPM.

Reply on news.ycombinator.com