[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20141009152823.GI12633@sentinelchicken.org>
Date: Thu, 9 Oct 2014 08:28:23 -0700
From: Tim <tim-security@...tinelchicken.org>
To: oss-security@...ts.openwall.com
Subject: Re: Thoughts on Shellshock and beyond
> PS: fun fact, the only thing you _will_ get sued for are:
> software patents
Perhaps we should patent the implementation of vulnerabilities in
software. Then go trolling. ;-)
Seriously though, I agree with you that some form of liability ought
to be introduced in order to create the business incentive to change
development practices. However, the devil is in the details, and as
Michal pointed out, you don't want to squash open source innovation.
So how do you introduce liability for software defects while allowing
innovation to continue? Initially, perhaps you could limit liability
to the cost of the software. This protects open source projects while
creating a modest incentive for larger software companies to do
better. But then you have cases like Adobe Flash/PDF/etc where they
don't charge and yet have created a huge problem in the industry. How
do you address that? Plus, if you did it this way, people might start
to assume all open source software is insecure just because there is
no liability.
I don't know, I've thought a fair amount about this, and it isn't easy
to implement. It would probably require multiple separate ways to
create incentives for quality.
tim
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
