I don't think anything in the article referenced mentioned anything about _unknown_ security holes. The topic was security problems that have been in existence for quite some time and have well known fixes (the example problem: buffer overflow, fix: bounds checking, existence: since before many of todays programmers were even born).

Why would a buffer overflow problem "not" be considered negligence? While some of the jokes about what would happen if car manufacturers followed the design and implementation practices of some large software corporation have some humor in them, they generally fail to state the rather unfunny truth that a good number of both users and non-users of such vehicles would be dead.

Does the software you write contain the standard liability disclaimers? Are you not willing to take full _responsibility_ and _liability_ for your software working according to spec and not failing in the face of *known* bugs and security issues? Are you prepared to pay damages if your software fails due to a problem widely known in the industry? If not, why not and why is it so acceptable for software to be a 'use at your own risk' product? Why is the software profession not really a profession at all? Why is there no infrastructure for the 'software profession'? No bar exam? No licence? Have you looked into malpractice insurance for the 'software profession'? Doctors, lawyers, engineers, etc. have licences to practice, and insurance, and risk losing them in the course of performing their practice.

Bearing the cost of liability is not competitive if everyone isn't doing it, and everyone won't be doing it unless a regulative body is in place to define and manage the currently non-existent so-called software 'profession'. And none of that will ever get started unless at the very least the serious and widely known problems like buffer-overflow bugs in software become recognized as the gross negligences that they are and punishable with damages. Once potentially costly damages are in play, large software houses see a benefit in being able to hire licenced programmers if only there were some and the ball starts rolling. I would welcome that day both as a developer and as a consumer.

Would a manufacturer of automobiles, for instance, be willing to warrant his products against catastrophic failure if he were forced to build his product using materials from sources who refused to make similar guarantees, because the materials from which they manufactured their products offered no guarantees?

No. He'd be insane.

When you write software, you can't guarantee much unless you can be certain that the software used to create it and the software upon which it depends come with the same assurances.

What about liability? ISVs have been playing the blame game for years. They get away with it because their denials are plausible. I doubt this will ever change.

A doctor can be sued for malpractice because the medicines s/he uses are certified by the federal government. An engineer can be sued because s/he does no building, only planning. If the building goes according to spec and the building fails, the design (aka, the engineer) is at fault.

Hence, if compilers and toolkits are certified by some board/government, and I use them, and my software fails ... I am liable. If I create software that allows for a known hack, such as buffer overflow, to happen ... I am liable. If I make a design and it is faithfully executed, but the application fails ... I am liable.

I think that programmer liability is a very good thing. It would require that programmers be certified, similar to a bar or CPA exam. I would take one and accept its results.

It would require that the pace of innovation be slowed down so that advances are scrutinized. I would prefer this. (Think about it this way - would you want to go into an operating room knowing your doctor is using a technique he developed and no-one else has scrutinized?)

It would require that there is some standardization in the world. As far as I know, there is no perlmonk who would vote against this idea. (Some of us might be out of jobs, but I know I don't like retrofitting interfaces ... do you?)

I think that board-certifying programmers is an excellent idea. That way, employers have a guarantee on what that candidate can do.

The first thing that needs to be certified is not products, but people.

------
We are the carpenters and bricklayers of the Information Age.

Don't go borrowing trouble. For programmers, this means Worry only about what you need to implement.

At what point do you stop saying, "That is life." and start saying, "That is negligence?"