Web browsers, to start. Why are Apple and Google not liable for zero days of Safari and Chrome? How is it sane?
Grace period may be necessary, but it needs to happen.
Grace period may be necessary, but it needs to happen.
Is is even possible to make a browser without 0days?
Whether automatic liability makes sense, as argued in OP about workplace safety, is less certain, but probably yes. Many zero days are triggered by just clicking a link. For such cases, it is hard to argue one is operating it wrong.
Meanwhile equifax and co just leave your data unprotected, no adversary required
Not really. lightning and hail behave predictably. Attackers don't. Adversarial hail would be a hailstorm where the hail magically heat-seeked to the engine.
>Meanwhile equifax and co just leave your data unprotected, no adversary required
The parent poster argued for a much stronger statement than this, which includes only negligence.
What's the metaphor for privilidge escalation - you dress like a pilot and they let you drive?
Most hacks in computing are preventable by not using languages that are know to be unsafe or testing software priperly. We prioritiae features over safety or reliability.
They are not comparable to someone attacking a plane with a missile.
I think it should be clear to that designers of aircraft and airlines themselves take much more care and responsebility than software designer do.
But none of the attacks you outlined can actually be prevented by the manufacturer? eg. for luggage the manufacturer just provides a maximum takeoff weight, but that's only verified by the pilots/ground crew. The buffer overflow equivalent would be an app with a buffer overflow vulnerability, but it asks very nicely not to overflow it.
The buffer overflow equivalent would be an app written in a managed language like C#, where buffer overflows are basically impossible.