Sounds sensible to me. Similar laws exist for negligence with physical products that cause damages.
And it's kind of cute how SAP now fits in Microsoft's pocket.
Sooner or later this will be an EU proposal anyway like the GDPR.
> The more they trip themselves up, the longer the US can easily keep its crown and the trillions of dollars that go with it.
A lot of the success of the US tech giants is built upon the cost of people suffering in a myriad of ways, from the cost of following up with data thefts to literal death from exploitative working conditions. European countries - while not perfect - tend to value their citizens a bit more than the US... and if the US continues on its current path, it may very well see the consequences of dissatisfied citizens. The election of the 45th President was only the beginning of what may happen.
I have mixed feelings about a law like this but I can't say I don't agree with something like this as a principle for paid software. Maybe liability will reduce the number of backdoors in software that we pay for. As for FOSS projects on github and such, there is no contractual obigation of any kind as long as you don't see lic's or stuff like that. That being said... I've heard some horror stories that defy common sense so wouldn't be surprised by anything.
This is not draconian to reasonable software firms and is analogous to structural/civil engineering.
a) not look for vulnerabilities
b) if they are found anyway, to not classify them as vulnerabilities (but regular bugs)
Then what? Relying on unpaid people to find and disclose vulnerabilities?
And what about all the people who think that they found a vulnerability but didn't? Consider that there are US senators and governors that think reading HTML code is hacking.
What bureaucracy will we have to build to decide what is and isn't a vulnerability?
This is Germany. Lots of software companies already do this type of work with SOC2 or FedRamp contracts.
A vuln is typically reported to NIST and assigned a CVE record. That 3rd party system allows for embargo, publish, dispute, etc. If a manufacturer denies that is is a vuln, the researcher can release their work and malicious actors could prove the manufacturer wrong. I work in cybersecurity, so this isn’t new to me. Maybe it is new to you… ?
These companies already have reasons not to look for vulns. IMHo they need more incentives (eg. Regulator/economic pressure) to look for them.
My guess is that this rule is being pushed in the aftermath of Log4j, which is a publicly identified CVE/vuln, but which is compiled/linked into other products. Any proprietary product which uses a known vuln in their software supply chain should have to either fix it (by releasing a patch) or make a public statement that the upstream vuln does not create a software vuln downstream or suffer liability. This already happens with companies/products that do this with large contracts.
The Missouri Governor is a political stooge, but his Department of Justice is prosecuting what the journalist did after he took the PII that was embedded in the page. We will have to wait to see if that was legal. I suspect he took a SSN that was in the page and used it to fill in a web form, which could be prosecuted as fraud. That would be an example where good faith efforts by security researchers should be exempted from prosecution, but has no relevance to this German proposal.
Your complaints seem to be extremely defensive/reticent. I think such posture is only useful if you also consider the value