[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54365146.1090802@mittwald.de>
Date: Thu, 9 Oct 2014 11:11:34 +0200
From: Sven Kieske <s.kieske@...twald.de>
To: <oss-security@...ts.openwall.com>
Subject: Re: Thoughts on Shellshock and beyond
On 09/10/14 10:24, Michal Zalewski wrote:
>> vendors are not liable, not even for the most serious
>> software bugs. so there is no incentive for them to make
>> better software.
>
> On the flip side, would it have been better if, say, Chet could be
> sued for millions in damages for the bug in bash?
No, imho you can not blame a single person, but you can blame
huge multi billion dollar companies who incorporate software and
benefit from it, but don't want anything to do with fixing or
improving it.
If GM buys some breaks from $random_guy (hey, he even
gives them away for FREE!) they are still liable if these
breaks don't work in their cars.
so at least when you're making money of software you should
be responsible for this software.
that's also not just my opinion (and I didn't invent these
thoughts), some credit has to go out to mr Schneier who
you might happen to know ;)
see:
https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html
--
Mit freundlichen Grüßen / Regards
Sven Kieske
Systemadministrator
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
T: +49-5772-293-100
F: +49-5772-293-333
https://www.mittwald.de
Geschäftsführer: Robert Meyer
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
