Re: Nato warns of strike against cyber attackers

[Owen DeLong <owen () delong com>]

On Jun 8, 2010, at 9:26 PM, Steven Bellovin wrote:

> > Problem is there's no financial liability for producing massively exploitable software.
> > No financial penalty for operating a compromised system.
> > No penalty for ignoring abuse complaints.
> > Etc.
> >
> > Imagine how fast things would change in Redmond if Micr0$0ft had to pay the cleanup costs for each and every 
> > infected system and any damage said infected system did prior to the owner/operator becoming aware of the infection.
>
> It isn't Microsoft.  It once was, but Vista and Windows 7 are really solid, probably much better than Linux or Mac 
> OS.  (Note that I run NetBSD and Mac OS; I don't run Windows not because it's insecure but because it's an unpleasant 
> work environment for me.)
>
> Microsoft is targeted because they have the market.  If Steve Jobs keeps succeeding with his reality distortion 
> field, we'll see a lot more attacks on Macs in a very few years.  It's also Flash and Acrobat Reader.  It's also 
> users who click to install every plug-in recommended by every dodgy web site they visit.  It's also users who don't 
> install patches, including those for XP (which really was that buggy).  There's plenty of blame to go around here....
>
> A liability scheme, with penalties on users and vendors, is certainly worth considering.  Such a scheme would also 
> have side-effects -- think of the effect on open source software.  It would also be a lovely source of income for 
> lawyers, and would inhibit new software development.  The tradeoff may be worth while -- or it may not, because I 
> have yet to see evidence that *anyone* can produce really secure software without driving up costs at least five-fold.
Open source should be basically covered by the equivalent of a good samaritan clause.

After all, the source is open, so, anyone who wants it fixed can fix it.

OTOH, non-open-source software which is subject to dependency on a vendor who got paid
for the software as a professional development house should carry a different standard of
liability.

Just as the mechanic you pay at the local garage is held to a higher standard of liability than
the shade-tree mechanic on your block that changes your oil for free.

Owen