<story><title>CISA boss: Makers of insecure software are the real cyber villains</title><url>https://www.theregister.com/2024/09/20/cisa_sloppy_vendors_cybercrime_villains/</url></story><parent_chain><item><author>hn_throwaway_99</author><text>At this point, I have to wonder what is even the point of missives like this. There are only two things that will solve the software quality problem:&lt;p&gt;1. Economic incentives. It&amp;#x27;s all just mindless blather unless you&amp;#x27;re actually talking about ways that software vendors will be held liable for bugs in their products. If you&amp;#x27;re not talking about that, what you&amp;#x27;re saying is basically &amp;quot;ok pretty please&amp;quot; useless.&lt;p&gt;2. Reducing the complexity of making products secure in the first place. Making truly secure software products is &lt;i&gt;incredibly hard&lt;/i&gt; in this day and age, which is one reason why demanding software product liability is so scary. Professional structural engineers, for example, are used to taking liability for their designs and buildings. But with software security the complexity is nearly infinitely higher, and making it secure is much harder to guarantee.&lt;p&gt;The other thing that people often ignore, or at least don&amp;#x27;t want to admit, is that the &amp;quot;move fast and break things&amp;quot; ethos has been phenomenally successful from a business perspective. The US software industry grew exponentially faster than anyplace else in the world, even places like India that doubled down on things like the &amp;quot;Software Capability Maturity Model&amp;quot; in the early 00s, and honestly have little to show for it.</text></item></parent_chain><comment><author>gwd</author><text>&amp;gt; At this point, I have to wonder what is even the point of missives like this. ...It&amp;#x27;s all just mindless blather unless you&amp;#x27;re actually talking about ways that software vendors will be held liable for bugs in their products.&lt;p&gt;I think that liability for bugs is exactly where she&amp;#x27;s going with this.  I&amp;#x27;m not an expert, but it sounds from a few things I&amp;#x27;ve heard on some Lawfare podcasts (e.g,. [1][2]) like the idea of software liability has been discussed for quite a while now in government policy circles.  This sort of public statement may be laying the groundwork for building the political will to make it happen.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=9UneL5-Q98E&amp;amp;pp=ygUQbGF3ZmFyZSBzb2Z0d2FyZQ%3D%3D&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=9UneL5-Q98E&amp;amp;pp=ygUQbGF3ZmFyZ...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=zyNft-IZm_A&amp;amp;pp=ygUQbGF3ZmFyZSBzb2Z0d2FyZQ%3D%3D&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=zyNft-IZm_A&amp;amp;pp=ygUQbGF3ZmFyZ...&lt;/a&gt;&lt;p&gt;EDIT:&lt;p&gt;&amp;gt; Making truly secure software products is incredibly hard in this day and age, which is one reason why demanding software product liability is so scary.&lt;p&gt;Loads of companies already are liable for bugs software that runs on their products: this includes cars, airplanes, and I would presume medical devices, and so on.  The response has been what&amp;#x27;s called &amp;quot;safety certification&amp;quot;: as an industry, you define a process which, if followed, you can in court say &amp;quot;we were reasonably careful&amp;quot;, and then you hire an evaluator to confirm that you have followed that process.&lt;p&gt;These processes don&amp;#x27;t prevent all bugs, naturally, but they certainly go a long way towards reducing them.  Liability for companies who &lt;i&gt;don&amp;#x27;t&lt;/i&gt; follow appropriate standard processes would essentially prevent cloud companies cutting security to get an edge in time-to-market or cost.</text></comment>
<story><title>CISA boss: Makers of insecure software are the real cyber villains</title><url>https://www.theregister.com/2024/09/20/cisa_sloppy_vendors_cybercrime_villains/</url></story><parent_chain><item><author>hn_throwaway_99</author><text>At this point, I have to wonder what is even the point of missives like this. There are only two things that will solve the software quality problem:&lt;p&gt;1. Economic incentives. It&amp;#x27;s all just mindless blather unless you&amp;#x27;re actually talking about ways that software vendors will be held liable for bugs in their products. If you&amp;#x27;re not talking about that, what you&amp;#x27;re saying is basically &amp;quot;ok pretty please&amp;quot; useless.&lt;p&gt;2. Reducing the complexity of making products secure in the first place. Making truly secure software products is &lt;i&gt;incredibly hard&lt;/i&gt; in this day and age, which is one reason why demanding software product liability is so scary. Professional structural engineers, for example, are used to taking liability for their designs and buildings. But with software security the complexity is nearly infinitely higher, and making it secure is much harder to guarantee.&lt;p&gt;The other thing that people often ignore, or at least don&amp;#x27;t want to admit, is that the &amp;quot;move fast and break things&amp;quot; ethos has been phenomenally successful from a business perspective. The US software industry grew exponentially faster than anyplace else in the world, even places like India that doubled down on things like the &amp;quot;Software Capability Maturity Model&amp;quot; in the early 00s, and honestly have little to show for it.</text></item></parent_chain><comment><author>Buttons840</author><text>A third option is to empower security researchers and hope the good guys find the security holes before the bad guys.&lt;p&gt;Currently, we threaten the good guys, security researchers, with jail way to quickly. If someone presses F12 and finds a bunch of SSNs in the raw HTML of the State&amp;#x27;s web page the Governor personally threatens to send them to jail[0]. The good security researchers tip-tow around, timidly asking permission to run pentests while the bad guys do whatever they want.&lt;p&gt;Protect security researchers, change the laws to empower them and give them the benefit of the doubt.&lt;p&gt;I think a big reason we don&amp;#x27;t do this is it would be a burden and an embarrassment to wealthy companies. It&amp;#x27;s literally a matter of national security and we current sacrifice national security for the convenience of companies.&lt;p&gt;As you say, security is hard, and putting liability for security issues on anyone is probably unreasonable. The problem is companies can have their cake and eat it too. The companies get full control over their software, and they get to pick and choose who tests the security of their systems, while at the same time having no liability. The companies are basically saying &amp;quot;trust me to take care of the security, also, I accept no liability&amp;quot;; that doesn&amp;#x27;t inspire confidence. If the liability is too much to bear, then the companies should give up control over who can test the security of their systems.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;techcrunch.com&amp;#x2F;2021&amp;#x2F;10&amp;#x2F;15&amp;#x2F;f12-isnt-hacking-missouri-governor-threatens-to-prosecute-local-journalist-for-finding-exposed-state-data&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;techcrunch.com&amp;#x2F;2021&amp;#x2F;10&amp;#x2F;15&amp;#x2F;f12-isnt-hacking-missouri-...&lt;/a&gt;</text></comment>