Comment by kragen | Hacker News Reader

Comment by kragen | Hacker News Reader

Parent Full thread

The guy selling food on the street has liability in proportion to his profits; fifteen customers, fifteen potential food-poisoning cases. He can set his prices accordingly. Simon Tatham doesn't have any profits, but his PuTTY is installed on every developer's Windows machine. OpenSSL is installed on even more machines. How long do you think it would take your proposed regulatory regime to find that Kurt Roeckx owed several million dollars to every company that generated private keys with Debian's copy of OpenSSL? He did, after all, introduce the subtle security hole that left them wide open for years.

Maybe you could make the case that he was following best industry practices in doing so; after all, using Valgrind is a best practice, right? But you could also pretty plausibly convince a jury that he was negligent. Especially if you're IBM's senior counsel. Or, say, RSA's.

Now, is Kurt Roeckx or RSA going to be advising the US legislators who draft this candidate legislation, establishing the standards that they both must uphold?

  Simon Tatham doesn't have any profits, but his PuTTY is installed on every developer's Windows machine.

then isnt it up to the commercial vendor who bundled the software to properly vet it?

someone taking non-commercial products and commercializing it is where the line is drawn right?

That depends entirely on how the law is written. Legislators will ask commercial vendors how to write the law. Why would the commercial vendors choose to write it in the way you're describing?

That is for the law makers to decide,

If someone gets run down by a bicycle that a hobby repair shop failed to fix, it doesn't matter it was done for free by a guy that learned to repair bicycles during late nights.

The hobby repair shop can only be liable for a very small number of bikes, those they worked on. You cannot restrict the number of users of free source software, and you cannot restrict the user's risk profile. Like "good enough for an offline arcade game, but nothing else". Analogies have their limits.

But yes, lawmakers will decide, and given that they for instance try to de facto prohibit aftermarket OpenWRT installs, I have a guess how they would decide.

Sure and so what?

The company selling me a car is responsible to validate the security of each piece they got from a third party, and a restaurant is responsible to take care for the quality of the food it buys from the local bazar.

This is a completely unrealistic demand of software and security. I am really surprised of Snowdens arguments here.

The law makers cannot make the internet safer by one bit. Technical experts can and lawyers would dream to have leverage against them. They should be denied.

Nope, it is a matter to apply the same liability process that are already in place for high integrity computing and enterprise project deliveries.

I deliver software for enterprise and there is no such thing. I even develop software for medical appliances that have an extended software validation process.

It is about minimizing risk and it is a process that acknowledges that risk cannot be removed completely. It just forces you to work carefully and eliminates neglectful practices.

No serious developer will ever commit to ship software free of bugs. On the contrary, that would give people false security, which can in turn lead to further neglect.

People like Simon Tatham and Kurt Roeckx, however fallible they may be, are doing a much better job of deciding how software security should work on the internet than Nancy Pelosi and Mitch McConnell would. The question is not how we can give more power to Nancy Pelosi, Mitch McConnell, Amazon, Google, and whoever the Trump voters vote in as the next president, to regulate Sci-Hub, BitTorrent, Bitcoin, WikiLeaks, DeCSS, Matrix, GDB, and OpenSSL; the question is how we can take that power away from them.

When the wise must obey the commands of the foolish, disaster ensues.

Reply on news.ycombinator.com