Hacker News Reader

Comment by personjerry | Hacker News Reader

No tool manufacturer is responsible for the outcomes of their tools (except the particular function they intended as a warantee)

View on HN

Boy is that ever not true.

https://www.woodshopnews.com/.amp/news/table-saw-suit-nets-1...

This guy was given a table saw with the guard already removed, and was using it on the floor (a table saw should be used at table height, so that you can have a foot forward to prevent falling into the blade). He was apparently not using push-sticks.

Somehow, the table saw manufacturer was found 65% liable in the case, because technology exists to reduce the likelihood of injury when flesh contacts the blade. Specifically, SawStop, which I believe senses capacitance and fires an aluminum block into the blade.

Here's a rather biased and snarky rundown of the whole thing that links some important bits of the backstory:

https://www.bob-easton.com/blog/is-it-your-table-saw-or-the-...

One thing he misses is that PTI, et al had explored flesh sensing technology and pretty much didn't feel like doing it. They also have opposed almost all safety standards.

Oh, did I mention the members have many more ridiculous patents than gass? They've sued each other over patents on worksite radios before. https://insight.rpxcorp.com/litigation_documents/3919186

They are also multi billion dollar conglomerates, often in countries with little respect for IP, so I imagine one reason he patented so much was to protect himself.

They are also a lobbying org, and he misses all the things they did, yet points out what sawstop did.

PTI has done a great job of lobbying here, unfortunately.

I am generally not a fan of the CPSC (what they did on magnets was beyond the pale), but here he also missed the biggest point they made: the cost of table saw injuries, to the government and insurers, is greater than the value of the table saw market!

I could go on. He seems like a mostly reasonable person (moreso than most on this issue), but yeah.

There really are two sides to that part. Neither side is deserving of adoration, honestly.

The court case is much simpler. For defective design liability in a lot of states, it's enough to show a feasible alternative design that would not have impacted function or price in a serious way. Most of the argument was about the latter.

This was the shocker to me:

> The cost of table saw injuries, to the government and insurers, is greater than the value of the table saw market!

...making it seem like the manufacturers are just taking the profits and dumping the externalities.

To be fair, it depends on what you consider to be the market. A lot of what used to be done here is now automated. For example, panel dividing:

https://www.homag.com/en/products/cutting/

https://youtu.be/ujgLsZZlOQg

This stuff is now very cheap. They are talking about the jobsite and home market, and if you compare that to what these videos show, yeah it's wildly unsafe

Most of these devices are insecure not because the attackers are hyper-sophisticated, but because the software is rushed and a second-thought to the hardware. There is no one (in power) at these companies that cares about crafting quality software. They just care about crafting the bare minimum to make their devices work.

I wager that "security" is something fairly far from their mind when they craft this software, which I consider especially negligent for any company that is dealing in networked devices.

It would probably be best to let the market regulate by itself but the issue here might be that it’s not visible to users that their router is infected.

That is right. This malware is an externality. Externalities typically need to be mitigated through regulation.

It's even worse: most of these companies don't even write the software for the low end consumer hardware. They just license it from a third party, usually in Asia, and pay them to turn features on or off and skin the UI for their branding.

It's no surprise that routers from competing manufacturers are vulnerable, since it's all the same under the hood. The companies that sell the finished product have zero insight into how secure the software is.

But there's open source software for this. Why don't they just use that?

There is no one to point the finger at (i.e. blame) when something goes wrong.

My router has the password saved in the page source ...

Not true. Product liability lawsuits have been around for ages. It's just that the tech industry has been able to escape them, by and large. I think one of the greater injustices in business was Microsoft's avoidance of a lawsuit from their spate of windows malware from roughly 2003-2010. They just sat on their hands and let for-profit A/V companies and nonprofit volunteers secure their platform, while consumers lost millions of hours and billions of dollars to simply be able to use their computers again after being rooted by 4 lines of JavaScript

> after being rooted by 4 lines of JavaScript

Could you provide any sort of source for this extraordinary claim of yours?

That's probably an exaggeration, but I agree with the sentiment of what they are saying. It's not crazy hard to write quality software. Most corporations don't bother because they know they don't have to, since they can escape liability laws. It's gotten to the point where most software developers somehow view this situation as "normal".

Do you have a QA department? What do they do? If you're like most software companies, they do testing. This is not QA, though, it's QV. The role of QA is to assure that the quality of your product is high. By the time you're testing it, the product is "done" - all of the defects are already there in the product. There is now nothing you can do to affect the quality of the product - all you can do is test and measure the overall quality of the product.

I mean, your tests will find problems, and you can fix those problems. But, if you keep track of how many problems you find, and how much test effort was involved to find those problems, you can plot a weibull regression and make a prediction about how many defects you haven't found yet. On any project I've been on where we ran this analysis, it was obvious that testing was finding almost none of the problems - barely skimming the surface. And, when you ran this analysis you could predict how many defects you will find if you spend X days testing, and on any project where I've seen this analysis run, those predictions have been highly accurate.

Really good automated tests can help with this, because they can do huge amounts of test effort "for free", but really QA should be about the process you follow when you write software - making sure you have a repeatable process, and then figuring out how to improve it. Almost no one does this.

This sounds like it's really expensive, and hard to prove the benefits of to most purchasers. I doubt we'll get the sort of industry change this would require without since strong formalization of the discipline.

I'm not sure whether you think a line of JS calling out to load a remote procedure would have been extraordinary, a root via a browser would have been extraordinary, any remote rootkit load would have been extraordinary, or whether the fact that it used to be possible to root Windows seems extraordinary. I'm no expert but none of this seems extraordinary to me. Things was loose in those days.

Source: The extraordinarily large amount of PCs I fixed for people during that era.

Here's a fairly recent one, I guess. The 3 lines of javascript do most of the work.

https://nakedsecurity.sophos.com/2013/10/11/anatomy-of-an-ex...

I'm not sure what the OP was referring to, but off the top of my head there was a security vulnerability in Windows disclosed last year which seems to fit that description[1][2].

[1] https://twitter.com/natashenka/status/861748397409058816

[2] https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

I won't provide a source but i'll provide a modified real life example, since i'm pretty sure this vuln is still in the wild.

I was doing a pen test on a router whose manufacturer decided it would be an OK idea to use GET requests to launch their ping diagnostic tool on their router's unauthenticated QA web interface.

this ping diagnostic tool was triggered by doing GET http://192.168.1.1/diagnostic/trace&ip=X.X.X.X

The IP address in the URL parameter would get plugged directly into a "ping" command line command, so you could obtain command injection by going GET http://192.168.1.1/diagnostic/trace&ip=X.X.X.X&&telnetd

You could exploit this from literally any website on the internet, and since it's a GET request and we don't care about what it returns, CORS won't save your router. I think that counts as a javascript one-liner, but you get the idea how fucking awful some of these routers are.

It might even be an evil pixel... E.g., worse than javascript-requiring exploits.

Car makers have been held liable for the lack of intentionally designed safety features

There’s plenty of precedent

I think lack of safety features that meet our current common knowledge of the potential failure scenarios should be enough to shut down a company

We can refuse to enable commerce that jeopardizes or personal safety (literal or ephemeral data theft)

Capitalists are just humans. They can be culturally pressured and shunned. Such behavior has been a hallmark of human society since they began

Physics is a vacuum of such rules. Human society has always had them

It took a concerted campaign by Ralph Nader to hold car companies liable.

It isn’t clear how that would work with software. Would FOSS authors be held liable? That would mean the end of open source.

Reply on news.ycombinator.com