Hacker News Reader

Comment by Jensson | Hacker News Reader

> As I write this on an early July morning, 200-plus corporations, including many retail chains, have inoperative IT because extortionists found a hole in some niche, third-party software product most of us have never heard of.

As I write this, millions of cars have gotten stolen due to vulnerable lock mechanism. A thief can with simple toools just open the door, start the car and drive away. Do we sue the engineer designing the lock for billions in damages? No. It isn't reasonable to blame engineers for everything.

View on HN

You having your car stolen, and software used across a company having a vulnerability are different in terms of scale though. If a whole shipment of cars was stolen due to a lock flaw (which is admittedly contrived), then I'd imagine whoever owned the cars would have a problem with the maker of the cars.

But almost a million cars gets stolen a year in US, totalling billions of value. How is that not the same scale?

Because it's distributed and the larger the spread, the smaller the obvious scale.

For example, let's say I'm a murderer and kill ever resident of a single street, one household a day. That's way too much of a coincidence to ignore. But if I did the same number across a larger area, maybe you get different police forces that haven't thought to talk to each other and no one spots the connection until much later.

The same applies here. If you personally have faulty software, it's not great, but you probably move on. If your employer buys the same software for all of its employees, then the scale of the problem is much more obvious and the actual cost of the problem is a lot larger to a single entity.

Sorry, this analogy does not hold up.

First of all, you're comparing unintended software vulnerabilities to physical locks; being able to open a lock with a lockpick is an element of the design! Everyone knows this going in!

That aside, ask yourself what car manufacturers have to do to prove the safety/security of everything in their supply chain down to nuts and bolts, and what the consequences are when they make a mistake.

Now compare that to how modern consumer software projects do dependency management and verification, and what happens when they have a whoopsie because some open source library they pulled from GitHub with a "no warranty" license exposed them to a critical data breach. In my experience they throw their hands up and say "meh sorry, software is hard."

It's not exactly the same though. Stolen cars does not have the potential to affect your daily day life as broken software can.

I agree that the blame does not lie on the engineers that created the cars or software though. In the end it's a problem of cost, you could write better software, but it would cost you time, money and shifted focus in the education of software developers and so on. Users are not willing to pay for that cost, they are very upset when reality bites them in the rear though...

You can't really steal a modern car, at least with simple tools. Everything is now digitally interlocked by a password contained within the key and keyfob itself.

Reply on news.ycombinator.com