Posted by:
admin
15 years, 11 months ago
Time for me to weigh in on the subject of liability for software bugs. Bruce Schneier posted about it here, and Pete Lindstrom responded here. I agree with Lindstrom. It is an incredibly bad idea. Software liability laws will increase the costs of software development so high that it will drive small firms from the market, reduce customer choice resulting in less choice, less innovation and even worse software.
Schneier is correct that it is an economic problem, but writing indiscriminate laws doesn't solve the problem. Let's break down the problem: people buy software with bugs in it. They have no recourse because they 'agreed' to a EULA that stated as much. The agreed to the EULA because they had no choice, they needed the software and they were not powerful enough to demand a change in the license.
Think of a different situation. A large corporation is evaluating 3 software packages for a critical application from small companies. The large corporation wants a the vendors to pay rebate a portion of the costs if the software brings the server down. Will they get it? Probably.
What consumers lack is power. What are some market-based ways to create pressure on software providers?
- Governments and large buyers should adopt open standards for documents, allowing for more competition amongst productivity apps.
- Large buyers should push for more secure software.
- OEMs should offer multiple OSs and software packages.
- Consumer-oriented resellers like the big-box chains should push their OEMs for better licenses.
Recent Posts
- Blast-RADIUS attack
- The latest WiKID version includes an SBOM
- WiKID 6 is released!
- Log4j CVE-2021-44228
- Questions about 2FA for AD admins
Archive
2024
2022
- December (1)
2021
2019
2018
2017
2016
2015
2014
- December (2)
- November (3)
- October (3)
- September (5)
- August (4)
- July (5)
- June (5)
- May (2)
- April (2)
- March (2)
- February (3)
- January (1)
2013
2012
- December (1)
- November (1)
- October (5)
- September (1)
- August (1)
- June (2)
- May (2)
- April (1)
- March (2)
- February (3)
- January (1)
2011
2010
- December (2)
- November (3)
- October (3)
- September (4)
- August (1)
- July (1)
- June (3)
- May (3)
- April (1)
- March (1)
- February (6)
- January (3)
2009
- December (4)
- November (1)
- October (3)
- September (3)
- August (2)
- July (5)
- June (6)
- May (8)
- April (7)
- March (6)
- February (4)
- January (427)
2008
- December (1)
Categories
- PCI-DSS (2)
- Two-factor authentication (3)
Tags
- wireless-cellular-mobile-devices (7)
- Two-factor authentication (10)
- Wireless, cellular, mobile devices (6)
- NPS (1)
- Phishing and Fraud (111)
- Active Directory (1)
- pam-radius (3)
- privileged access (2)
- Cloud Security (10)
- Mutual Authentication (60)
- Web Application Authentication (1)
- Authentication Attacks (99)
- pci (50)
- Security and Economics (97)
- WiKID (133)
- pam (2)
- VPN (1)
- Installation (2)
- RADIUS Server (1)
- Open Source (64)
- Tutorial (2)
- Strong Authentication (35)
- Information Security (137)
- Transaction Authentication (13)
- Miscellaneous (100)
- Linux (2)
- transaction-authentication (6)
- Two Factor Authentication (254)