Beefy Boxes and Bandwidth Generously Provided by pair Networks
Your skill will accomplish
what the force of many cannot

Re: "Buffer Overflow" rant in Risks Digest

by Cybercosis (Monk)
on Jan 07, 2002 at 02:18 UTC ( #136716=note: print w/replies, xml ) Need Help??

in reply to "Buffer Overflow" rant in Risks Digest

The only problem with accusing programmers of negligence in their work because their software can be exploited is determining at which point "due diligence" ends and "criminal negligence" begins. It is not inconcievable that someone could write a program that, at the time of writing, has no known security holes, but is vulnerable to some technique not yet developed. Is the programmer to be blamed for not being clairvoyant?


nemo accipere quod non merere

  • Comment on Re: "Buffer Overflow" rant in Risks Digest

Replies are listed 'Best First'.
Re: Re: "Buffer Overflow" rant in Risks Digest
by Anonymous Monk on Jan 07, 2002 at 04:46 UTC

    I don't think anything in the article referenced mentioned anything about _unknown_ security holes. The topic was security problems that have been in existence for quite some time and have well known fixes (the example problem: buffer overflow, fix: bounds checking, existence: since before many of todays programmers were even born).

    Why would a buffer overflow problem "not" be considered negligence? While some of the jokes about what would happen if car manufacturers followed the design and implementation practices of some large software corporation have some humor in them, they generally fail to state the rather unfunny truth that a good number of both users and non-users of such vehicles would be dead.

    Does the software you write contain the standard liability disclaimers? Are you not willing to take full _responsibility_ and _liability_ for your software working according to spec and not failing in the face of *known* bugs and security issues? Are you prepared to pay damages if your software fails due to a problem widely known in the industry? If not, why not and why is it so acceptable for software to be a 'use at your own risk' product? Why is the software profession not really a profession at all? Why is there no infrastructure for the 'software profession'? No bar exam? No licence? Have you looked into malpractice insurance for the 'software profession'? Doctors, lawyers, engineers, etc. have licences to practice, and insurance, and risk losing them in the course of performing their practice.

    Bearing the cost of liability is not competitive if everyone isn't doing it, and everyone won't be doing it unless a regulative body is in place to define and manage the currently non-existent so-called software 'profession'. And none of that will ever get started unless at the very least the serious and widely known problems like buffer-overflow bugs in software become recognized as the gross negligences that they are and punishable with damages. Once potentially costly damages are in play, large software houses see a benefit in being able to hire licenced programmers if only there were some and the ball starts rolling. I would welcome that day both as a developer and as a consumer.

      Would a manufacturer of automobiles, for instance, be willing to warrant his products against catastrophic failure if he were forced to build his product using materials from sources who refused to make similar guarantees, because the materials from which they manufactured their products offered no guarantees?

      No. He'd be insane.

      When you write software, you can't guarantee much unless you can be certain that the software used to create it and the software upon which it depends come with the same assurances.

      What about liability? ISVs have been playing the blame game for years. They get away with it because their denials are plausible. I doubt this will ever change.

        A doctor can be sued for malpractice because the medicines s/he uses are certified by the federal government. An engineer can be sued because s/he does no building, only planning. If the building goes according to spec and the building fails, the design (aka, the engineer) is at fault.

        Hence, if compilers and toolkits are certified by some board/government, and I use them, and my software fails ... I am liable. If I create software that allows for a known hack, such as buffer overflow, to happen ... I am liable. If I make a design and it is faithfully executed, but the application fails ... I am liable.

        I think that programmer liability is a very good thing. It would require that programmers be certified, similar to a bar or CPA exam. I would take one and accept its results.

        It would require that the pace of innovation be slowed down so that advances are scrutinized. I would prefer this. (Think about it this way - would you want to go into an operating room knowing your doctor is using a technique he developed and no-one else has scrutinized?)

        It would require that there is some standardization in the world. As far as I know, there is no perlmonk who would vote against this idea. (Some of us might be out of jobs, but I know I don't like retrofitting interfaces ... do you?)

        I think that board-certifying programmers is an excellent idea. That way, employers have a guarantee on what that candidate can do.

        The first thing that needs to be certified is not products, but people.

        We are the carpenters and bricklayers of the Information Age.

        Don't go borrowing trouble. For programmers, this means Worry only about what you need to implement.

Re (tilly) 2: "Buffer Overflow" rant in Risks Digest
by tilly (Archbishop) on Jan 07, 2002 at 23:46 UTC
    This is not a question of being able to predict the future. It is a question of not making the most common, stupid mistake imaginable. For every year since they started keeping track, the most common cause of security holes announced on CERT has been the buffer overflow. This is true despite the fact that there have been programming environments for decades which stop this bug cold.

    At what point do you stop saying, "That is life." and start saying, "That is negligence?"

Log In?

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://136716]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others about the Monastery: (2)
As of 2022-11-28 18:12 GMT
Find Nodes?
    Voting Booth?