Hacker News Reader

Comment by function_seven | Hacker News Reader

No, but those devices are their responsibility.

Car analogies are always fun, so here's one: The catalytic converter on my car is sawzalled off in the middle of the night. I drive around with the missing cat for a couple months. Then I fail a smog check, or get a ticket for loud exhaust. Is it my fault the cat was stolen? No, but I still have a responsibility to everyone else to not pollute (fumes or noise).

If the ISP supplies the router, then of course they should correct it. But if the subscriber brings their own equipment, then they take on the responsibility of maintaining it. Including replacement if it turns out not to be fit for purpose.

View on HN

I don't think that's a good analogy.

Car manufacturers are required to do recalls on cars that have airbags that explode rather than inflate. Even 20 year old clunkers. They widely publicize cars they think aren't actually safe anymore so customers can choose to update.

When food is shipped out to customers full of listeria, they don't say "you should have kept a full pcr lab in the kitchen and tested every bite, this is obviously the eater's fault", they flood the news with recall notices and take the food back and offer a refund. (and often are still sued because they too have responsibility).

The firewall stopped doing it's job, if it had done it's job properly the device wouldn't have been owned. Why shouldn't firewall manufacturers be required to have some responsibility when the firewall is shown to not actually firewall?

In my analogy, the motorist is the ISP customer, the thief is the hacker, and the DMV is the ISP. If I were to draw the corresponding links in your analogy, the motorist is still the customer, the auto maker is the router manufacturer. Whatever duty is owed to the owner of a faulty car, that duty is not on the DMV. It's on the manufacturer.

> Why shouldn't firewall manufacturers be required to have some responsibility when the firewall is shown to not actually firewall?

They should! I'm not arguing against holding companies responsible for their crap products. I'm arguing that the ISP shouldn't be forced to keep an attack vector on their network.

If a shitty home router becomes a bot in a DDOS botnet, that's not the ISP's responsibility. From their perspective, it's on the subscriber. From the subscriber's perspective, it's on the maker of that shitty router. (ISP-provided equipment is obviously different)

I say we punish the car manufacturers for making easy to steal catalytic converters. Take it all the way up the chain. It's their responsibility for designing a flawed product they knew was flawed. It's not your fault the cat was stolen. It was the manufacturers.

But in this case it wasn't your fault that the cat was stolen, it is however completely your fault to continue to operate an illegal vehicle no matter how the vehicle came into that condition.

>"It's not your fault the cat was stolen. It was the manufacturers."

Not, it is a fault of thieves. And maybe a police who prefer to generate ticketing revenue rather then go after real criminals.

Reply on news.ycombinator.com