Re: Thoughts on Shellshock and beyond

[Tim <tim-security () sentinelchicken org>]

> PS: fun fact, the only thing you _will_ get sued for are:
> software patents

Perhaps we should patent the implementation of vulnerabilities in
software.  Then go trolling. ;-)


Seriously though, I agree with you that some form of liability ought
to be introduced in order to create the business incentive to change
development practices.  However, the devil is in the details, and as
Michal pointed out, you don't want to squash open source innovation.

So how do you introduce liability for software defects while allowing
innovation to continue?  Initially, perhaps you could limit liability
to the cost of the software.  This protects open source projects while
creating a modest incentive for larger software companies to do
better.  But then you have cases like Adobe Flash/PDF/etc where they
don't charge and yet have created a huge problem in the industry.  How
do you address that?  Plus, if you did it this way, people might start
to assume all open source software is insecure just because there is
no liability.  

I don't know, I've thought a fair amount about this, and it isn't easy
to implement.  It would probably require multiple separate ways to
create incentives for quality.

tim