If there is harm in writing insecure software, hold software writers accountable -- including open source ones. It is unjust (and stupid) to hold corporations accountable for not producing what their customers are not demanding and what they have not promised unless there is a good public policy reason (i.e. harm to others). In short, there isn't (network attacks are harm but they can be addressed via tort law and anyways are not significant enough for major economic regulation; data loss is the accountability of the custodian of the data not of the vendor who disclaims all fitness for purpose!).

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/394/33385#33385