Hacker News Reader

Comment by pjmlp | Hacker News Reader

This should happen more often.

The software industry must come to the same level of responsibility and quality expectations of other industries.

This. But when we go here, and I believe we will, I am concerned of what happens to our ability to put alternastive firmware / OS / SW on a systems we've purchased. We already see this in regulated industries such as automotive. Part of the motivation not to let us replace software in an automotive infotainment system surely is a concern over a liability this might cause. It would be a sad day indeed when we would regulate out our ability to update vendor provided crapware with OpenWRT, Lineage OS, or what not.

In my opinion, progress in that domain should come in the form of mandatory warnings to end-users when selling technologies that do not meet acceptable standards.

A big warning on the package would be enough to turn away average users - thus forcing companies to comply - but wouldn't interfere with hacking activities.

"Voids the warranty" comes to mind.

IMHO, we can make parallels with RF spectrum. Global network and RF spectrum are globally shared resources, so some rules for RF spectrum should apply to global network too. If your system is beyond some minimal power level, e.g. less than 1000 hosts, you are free to do what you want without license, unless you are harming someone. For more than 1K network hosts exposed to global network, minimum safety requirements must be met.

Nice analogy. Expanding a bit, if a popular walkie-talkie brand from 20 years ago starts failing today in a way that switches it to aviation frequencies, I believe the manufacturer would be on the hook.

This is a reasonable stance, but remember who will bear the cost: the consumers. Demanding security for all these cheap plastic boxes will hopefully make it harder for DDoS attackers to gain cheap weaponry, but it won't come for free. I think it's too vague to just demand that the devices be "secure", as there is an infinite spectrum of security that these devices could live up to.

Also, let's say, theoretically, that I discover a software bug on the ftc.gov website that allows me to get the ftc.gov servers to execute a DoS attack against some target. Should I be able to sue ftc.gov for not securing their site well enough, or does this policy only apply to physical devices?

As a consultant working in the security industry, I get asked this question a lot. "How do we minimize liability when we know that security is never perfect?" The answer is best practices. I have never seen a company held liable for any breaches that occurred while they were following best practices. As long as you can show that you decided on a set of best practices before making/implementing your product, show that your product follows these best practices (or documenting why it doesn't), and show that you have a process to evaluate these best practices periodically against the latest industry standard, you're basically off the hook.

If FTC.gov was vulnerable to Heartbleed in March of 2014 and you suffered damages related to someone exploiting that, in practice FTC.gov holds no responsibility for that. They were following best practices, and no one knew there was a vulnerability. If they're vulnerable today and you suffer damages due to that being exploited, then you could make a case against them. They should have known better by now.

As for consumers bearing the cost, that's working as intended. Good security costs a little money. How many people do you hear complaining that consumers are bearing the cost of seatbelts and airbags installed in cars? We're willing to pay the few extra dollars because we all know how dangerous it is to not have those things. We could make cars a lot cheaper if they didn't have crumple zones, air bags, seat belts, roll cages, or steel frames. But that's not the world we want to live in.

The current state is not free either - the attacks cost money too, although it's paid by the targets and not the manufacturers. But ultimately it's paid by consumers.

> How many people do you hear complaining that consumers are bearing the cost of seatbelts and airbags installed in cars? We're willing to pay the few extra dollars because we all know how dangerous it is to not have those things.

This is not so black/white. Car safety constantly becomes more advanced over the years and it has become a competitive feature of cars to get "best safety rating". So they still spend a lot of R&D money to stay at the top of the line, regardless of fixed regulation.

Often best practices come baked into frameworks that we use now, such as Rails being relatively "secure by default". Which makes adoption of them easier.

But at the same time cyber security evolves quickly too and software updates quickly underneath it, exposing new threats.

So I believe it will always be an R&D investment that will evolve and change over the course of softwares line span.

The question is about incentives. Car manufacturers have a big incentive to make their cars safe because people know how dangerous cars are and consider that as part of their high-dollar purchase. There is also a big consumer reports style industry around car safety to inform users. Also car manufacturers (and physical products in general) actually kill people increasing the liability of a broken product.

Most software lacks those incentives for a variety of reasons. Such as low cost barrier to entry, lack of understanding of security, lack of tactile differences, low time investment evaluating alternatives, low cost to publishers when hacks do happen, etc.

I'm all for the cyber security industry maturing and software security best standards being taught to every developer. But I don't think we have the costs, consumer understanding, or infrastructure entirely in place or figured out yet to have an optimal effect.

At the same time it's very possible it might remain a constantly moving target and be a larger challenge than most other engineering safety standards, like buildings or vehicles. Something to consider.

You're 100% right, which is why "periodic evaluation of industry standards" is such a critical part of any SDLC or best practice. Tech moves faster than other industries of course, but in general technology is just a sped-up clone of basically anything else. We didn't (and couldn't) make a definitive set of best practices the day we invented the computer, we made them up as we went along. Like the car industry, where safety standards were tightened as technology improved.

We do have companies already making a stand on security, using it as a competitive advantage. Apple, for one, has staked their name on their security in the past few years. That's their competitive advantage, is how secure TouchID and their secure enclave is. You're right that consumers don't see security as entirely necessary yet, but it took a long time for seat belts and airbags to become standard in cars, and even longer for them to be appreciated. Even today, many people refuse to wear seat belts.

But bear in mind, automotive security is a moving target too. Seatbelts, then airbags, then roll cages, then crumble zones, then backup cameras, then backup sensors, then automatic parking, then self-driving. There's very little that's new in the world, it's almost always been done before.

To add up to it, here is one example of companies that validate security in high integrity systems.

http://www.ldra.com/en/software-quality-test-tools

Namely for C, C++, Java and Ada stacks on the domains of medicine, trains, aviation, automotive, factory automation.

This needs to be extended to other business domains.

I agree. There's no accountability for such neglect. There should be a fine, or even better, a tax on bad security.

True, but who will write the guidelines, what will they say, and how will they be implemented and enforced?

It's engineer duty.

http://www.ieee.org/about/corporate/governance/p7-8.html

http://www.acm.org/about-acm/acm-code-of-ethics-and-professi...

http://www.acm.org/about/se-code

https://www.isaca.org/Certification/Code-of-Professional-Eth...

http://www.bcs.org/category/6030

http://www.depts.ttu.edu/murdoughcenter/products/resources/r...

Reply on news.ycombinator.com