I don't think anything in the article referenced mentioned anything about _unknown_ security holes. The topic was security problems that have been in existence for quite some time and have well known fixes (the example problem: buffer overflow, fix: bounds checking, existence: since before many of todays programmers were even born).

Why would a buffer overflow problem "not" be considered negligence? While some of the jokes about what would happen if car manufacturers followed the design and implementation practices of some large software corporation have some humor in them, they generally fail to state the rather unfunny truth that a good number of both users and non-users of such vehicles would be dead.

Does the software you write contain the standard liability disclaimers? Are you not willing to take full _responsibility_ and _liability_ for your software working according to spec and not failing in the face of *known* bugs and security issues? Are you prepared to pay damages if your software fails due to a problem widely known in the industry? If not, why not and why is it so acceptable for software to be a 'use at your own risk' product? Why is the software profession not really a profession at all? Why is there no infrastructure for the 'software profession'? No bar exam? No licence? Have you looked into malpractice insurance for the 'software profession'? Doctors, lawyers, engineers, etc. have licences to practice, and insurance, and risk losing them in the course of performing their practice.

Bearing the cost of liability is not competitive if everyone isn't doing it, and everyone won't be doing it unless a regulative body is in place to define and manage the currently non-existent so-called software 'profession'. And none of that will ever get started unless at the very least the serious and widely known problems like buffer-overflow bugs in software become recognized as the gross negligences that they are and punishable with damages. Once potentially costly damages are in play, large software houses see a benefit in being able to hire licenced programmers if only there were some and the ball starts rolling. I would welcome that day both as a developer and as a consumer.

In reply to Re: Re: "Buffer Overflow" rant in Risks Digest by Anonymous Monk
in thread "Buffer Overflow" rant in Risks Digest by dws

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.