Sue Companies, Not Coders

Security Blanket Blog

Sue Companies, Not Coders - A former U.S. cybersecurity czar now advocates holding programmers liable for the security holes in their code. He's soooo close to getting it right. Commentary by Bruce Schneier. [Security Blanket]

Companies should be the one’s that is held liable for buggy and insecure programs, not the programmers that work for them. Only then would they actually release programs that work correctly and is secure, and not release programs known to be faulty, expecting to release patches for said programs later on. Since software companies have no real incentive to release secure programs right off the bat, other than the avoidance of the occasional bad publicity, they will continue to sell insecure programs. With the threat of litigation, software companies will find that it would be more profitable to spend the time and money to make more secure programs, than to have to face lawsuits from unhappy customers.

The problem of insecure software has gotten worse and worse over the years, especially with the advent of the Internet. The Internet allows a way for hackers to get on your computer and to exploit a flaw in a program in your computer to do malicious deeds. Also with the Internet, companies know that it’ll be a lot easier to distribute patches now that they can do it online, so companies know they can just release a patch online if their software is flawed. This has the effect of companies being less concerned about the quality of their software and so they spend less time debugging before selling the program.

Even when there is a program that is continuously insecure, for example Microsoft’s Internet Explorer, usually the company has such a monopoly on the market that it would be inconvenient for users to switch to another program, so they just accept the faulty program because they have no alternatives, or is unwilling to try another program because they’re afraid to learn how to use a new program. The companies might also have a good public relations team, so that they can spin whatever new flaw that’s found on their software into something less damaging to the company’s image.

Companies at fault

Coders should absolutely not be sued or held responsible for the security of the code they write. This would only make the current situation and quality of software worse. It is the companies who employ the coders who should be held liable. There is a definite need for software that is more secure. If companies are content with selling insecure software and doing damage control with patches, that need cannot be met. There needs to be an adequate disruption in this lazy cycle for true innovation and progress to be made. By allowing users to sue these companies, this type of disruption could occur. Someone needs to step up and break this cycle of settling for lousy software, no matter what the risks of lost profit are. Other companies will be forced to follow their competitor’s lead in order to catch up. In the end, everyone will benefit because users will get more secure software and the companies will all have taken a step up the ladder of progress.

Sue Companies

I completely agree, the companies responsible for designing, manufacturing, and selling computer programs should be the ones ultimately responsible for ensuring the safety and quality of their product. For one, it is a poor business strategy to make something that can not stand up against regular usage and stress - in the case of programs, the threat of security against hacking, tracking and viruses. When someone buys something, they expect that it should work and not have an immediate threat. Non-savvy consumers of computer programs are at a high risk for falling for faulty programs. They don't realize what is insecure and what is secure - they merely use the program that is most available or easiest to understand. They are putting themselves at risk, yes, but at the same time they trust the companies that have produced them.
At the same time, companies should be the ones responsible for their coding, not the coders. While a coder should obviously be responsible for designing a program to the best of their ability, they cannot be ultimately reponsible for any unforseen problems. The company hired them for their expertise to design the programs and should trust them to do so. If for some reason, there is a flaw in the program, consumers should target the companies instead of feeling the "heat" themselves, then the company should question the coders. From an outsider perspective, you cannot target the individual coder. The company should represent and defend their employees.

Software Bugs

Very good post both in the article and in this post that it is just cheaper for large companies to just produce faulty software and deal with the fallout rather than do it right the first time. In the long run, comapnies would save a lot of money and time if they would just make the software perfect in the beginning. To quote my mama down in Texas, "If you do it right the first time, you won't have to do it again." Hopefully, if enough consumers get fired-up about this issue, software companies will take notice and make good, affordable, user-friendly software and hardware from the get-go. I wouldn't hold my breath though. Companies don't seem to care about consumer trust.

In regard to the Internet Explorer entry, luckily as years go by, consumers are being offered more options to get browsers that are low-cost (or free,) that have minimal problems and offer greater protection from fatal flaws that can allow hackers to enter your system. Mozilla Firefox and Safari from Apple are good examples.