In the early 80s, speed was everything and security a non-issue. LANs hadn't even taken off yet, let alone the internet. But that's almost flip-flopped today.
"A consequence of this principle is that every occurrence of every subscript of every subscripted variable was on every occasion checked at run time against both the upper and the lower declared bounds of the array. Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to--they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980 language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law."
C.A.R. Hoare in his 1980's Turing Award speech.
In 1988, Morris Worm takes over UNIX
The problem is that no human can maintain proper discipline at all times, and it takes only one slip to create a bug.
And yes, programmers doing that would soon realize that ‘immutable by default’ leads to a better UX of a programming language. It’s way easier to be alerted by a warning ‘mutable’ keyword than by a missing ‘immutable’ one)
That’s why we should have linters that flag all missing ‘immutable’ annotations or incorrect usage of ‘mutable’ ones. Rust even adds something like that to the language.
I agree, those programmers should be properly flogged.
https://www.sonatype.com/national-cybersecurity-strategy-wha...
https://digital-strategy.ec.europa.eu/en/library/cyber-resil...
The rest will follow.
> Shifting liability for software products and services to promote secure development practices; and,
You’re not going to be able to apply breach of warranty under UCC. As a threshold matter, software might not even be considered a “good” and so it might not even governed by UCC. But if you did manage to apply UCC to software, the contract or license under which software is provided would have to be incompetently drafted if it were to be found that it did not effectively disclaim liability or if it was found unconscionable. There are some additional procedural hurdles concerning probity of contract but let’s leave it there
Under basic tort law, a software provider would need to be found to have a duty of care in order to be found negligent, but surprisingly, this is seldom found to exist. There is also no clear standard to measure whether a software provider may have breached that duty. Intervening or superseding cause exists in almost every breach, although for security-specific software, this might not be the case (e.g., a firewall fails open might be reasonably foreseeable to cause damage by means of a hacker, against whom the firewall is meant to protect).
Finally even if you get to this point, recovery may be barred or limited by the economic loss doctrine.
Defective product law is even worse, due to the (inscrutable) fact that while most courts would call software a good for UCC purposes, they would not call it a product for the purposes of product defect law. There are some additional wrinkles here concerning design of software versus manufacture of software in the context of defective product design law, but we’re starting to wander out of HN post territory and into CLE territory here.
Frankly if Joe Biden wanted to change every thing I just red it would be superb but I think we have to be realistic about how much influence the federal government can apply here without causing massive terrible second and third order effects. For example look back to 43 and Obama’s heavy reliance on cybersecurity insurance to advance national security interests and how quickly that turned into free payouts for everyone who could manage to get a random reared out to work.
"If you outlaw freedom, only outlaws will have freedom."
But even just reusing the architecture as-was, it would certainly be cheaper and need fewer chips today. It might be fun to have a cheap Raspberry Pi-like board with a 432 to experiment coding against.
"Although the 432 has bit-variable length instructions, it requires more space than either the 68000 in Pascal or the VAX in C. Reasons include the lack of immediates and the inability to refer to a local variable or constant using fewer than 16 bits of address."
(From a modern perspective, the test programs are absurdly small: 120-2900 bytes. Nowadays, you probably couldn't even create a program that small.)
[*] https://archive.org/details/PerformanceEvaluationOfTheIntelA...
I know it's not what you are looking for since it's not making nearly enough bounds checks. I thought I'd drop a mention since it's widely available.