Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Insecurity Industry

edwardsnowden.substack.com

Post reply on HN
Print view View original

231–240 of 386 posts

Re: The Insecurity Industry

#231

Post by yosito »

kragen wrote: post #199
pjmlp wrote: post #188

"If you want to see change, you need to incentivize change. For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected. Imagine how quick…

If this happens, it will be the end of open source and the indie web. Only large companies with large legal departments and serious liability insurance, and anonymous underground hackers, will be able to afford to make software public for commercial use or run a website.

> it will be the end of open source

Not if the rules are carefully targeted at SaaS and not at codebases. If the rules are targeted at SaaS, the liability is actually lower for open source because of the inherent transparency of everything open source code does.

Re: The Insecurity Industry

#232

Post by otabdeveloper4 »

GauntletWizard wrote: post #187
otabdeveloper4 wrote: post #166

Earlier quoted context omitted.

> Linux kernel rather actively embraces experimental code written in Rust False. Which broken telephone did this come from? The Linux kernel has 0% Rust code in it and has no plans to change that.

https://lore.kernel.org/lkml/20210704202756.29107-1-ojeda@ke... - A patch to include experimental rust support, with support from Linus; I believe it's in the latest mainline HEAD.

Read my post again. There is 0% Rust code in the Linux kernel at the moment, and no plans to change that.

(And no, "including experimental Rust support" isn't a plan to change that.)

You don't need Rust to compile the kernel. What's changed now is that you could theoretically write a kernel module in Rust. (But you can, e.g., write a kernel module in C++ too, I've done it before.)

Re: The Insecurity Industry

#233

Post by yosito »

slickrick216 wrote: post #204
pjmlp wrote: post #188

"If you want to see change, you need to incentivize change. For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected. Imagine how quick…

Yeah imagine if we make pharmaceutical manufacturers accept liability for vaccine side effects. It’s the same argument right.

I don't think it's the same argument. Being liable for the things you actively and intentionally do to all of your customers is not the same as being liable for a risk inherent in a medical procedure that you've done your due diligence to prevent and warn about. In either case, there should be some form of accountability, but they are not at all the same thing.

Re: The Insecurity Industry

#234

Post by kragen »

yosito wrote: post #231
kragen wrote: post #199

Earlier quoted context omitted.

If this happens, it will be the end of open source and the indie web. Only large companies with large legal departments and serious liability insurance, and anonymous underground hackers, will be able to afford to make software public for commercial use or run a website.

> it will be the end of open source Not if the rules are carefully targeted at SaaS and not at codebases. If the rules are targeted at SaaS, the liability is actually lower for open source because of the inherent transparency of everything open source code does.

Do you think Nancy Pelosi is going to ask Richard Stallman, the Debian Project Leader, and the Apache Foundation how the regulation should work? Or is she going to ask SalesForce, Google, Apple, and Microsoft?

Re: The Insecurity Industry

#235

Post by eru »

pjmlp wrote: post #188

"If you want to see change, you need to incentivize change. For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected. Imagine how quick…

Eh, contract law gives you all the tools you need to create liability.

If you want software where the vendors are liable, you can get that today.

Re: The Insecurity Industry

#236

Post by eru »

kragen wrote: post #216
slickrick216 wrote: post #204

Earlier quoted context omitted.

Yeah imagine if we make pharmaceutical manufacturers accept liability for vaccine side effects. It’s the same argument right.

There are definitely a lot less pharmaceutical manufacturers now than there were before the Pure Food and Drug Act passed in 01906; ten companies have 40% of the whole worldwide drug market, and if you start openly making and selling drugs yourself (like Coca-Cola in 01886 and 7-Up in 01920), you will probably get arrested within a month. Almost nobody makes drugs as a hobby now. There are certainly people who would…

I am sympathetic to your argument, but be careful to avoid 'Post hoc ergo propter hoc'.

Re: The Insecurity Industry

#237

Post by kragen »

eru wrote: post #236
kragen wrote: post #216

Earlier quoted context omitted.

There are definitely a lot less pharmaceutical manufacturers now than there were before the Pure Food and Drug Act passed in 01906; ten companies have 40% of the whole worldwide drug market, and if you start openly making and selling drugs yourself (like Coca-Cola in 01886 and 7-Up in 01920), you will probably get arrested within a month. Almost nobody makes drugs as a hobby now. There are certainly people who would…

I am sympathetic to your argument, but be careful to avoid 'Post hoc ergo propter hoc'.

I think there's a clear line of causality here, though.

Re: The Insecurity Industry

#238

Post by pjmlp »

lionkor wrote: post #225
pjmlp wrote: post #191

Earlier quoted context omitted.

My experience with trying that in Visual C++, alongside the C++ Core Guidelines and "borrow checker" static analysers, is that there is what we wish to happen, and how the code actually looks like in reality.

I find that, if you enable all warnings, most as errors, and use clang-tidy and cppcheck, you end up with an incredibly powerful safe language. Now, combine that with some good patterns and avoidance of NIH syndrome, and you can get very far while keeping the huge amount of control and libraries that C++ gives. Edit: And, of course, a lot of forced static typing and avoiding global scoped stuff. So, for example, you'…

Even if we constrain ourselves to clang-tidy and cppcheck, and the platforms where they are supported, you can only assert that to your own code, and eventually third party libraries in source code.

Then even if you find issues in those third party code libraries, there is the issue of if you are allowed to change them yourself, or how those fixes get provided by the library vendor, warranties and so on.

Re: The Insecurity Industry

#239

Post by pjmlp »

throwaway210222 wrote: post #221
pjmlp wrote: post #189

Earlier quoted context omitted.

Definitly, liability needs to happen, sledgle with lawsuits hammer any company that doesn't take security seriously.

Sledge with lawsuits and company that knowingly buys uncertified software. Like the FAA does. Never, ever going to happen in enterprise and consumer software.

It already happens when that enterprise and consumer software is deployed in high integrity computing scenarios.

Re: The Insecurity Industry

#240

Post by Ma8ee »

eru wrote: post #235
pjmlp wrote: post #188

"If you want to see change, you need to incentivize change. For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected. Imagine how quick…

Eh, contract law gives you all the tools you need to create liability. If you want software where the vendors are liable, you can get that today.

Oh yea, I’ll definitely win if I sue Microsoft, and being in the right will absolutely make a difference.
Post reply on HN