The scenario you paint for us would not happen, for reasons
more related to law than software.

1) The bugs you mention in sendmail and Sun sadmind were
years ago, and time to file suit has run out. In addition,
Solaris has had stack protection since version 2.6, and
sendmail is open source. A legal concept called "failure
to mitigate damages" applies to people who do things like
crash their car while leaving their seatbelt off. The
result is that they win their lawsuit but receive very
little in damage awards. If you *could* still sue Sun or
sendmail, you would be asked "Why didn't you use stack
protection/read the source code yourself?" And you would
probably end up winning $1 in damages.

2) No lawyer will sue someone who has no money, so OpenSSH
is safe. And, again, "Why didn't you read the source code?"

So, you kind of have it backwards. The only ones who would
be very threatened by litigation would be wealthy companies
who sell seriously defective, closed-source software. Such
companies would probably face a lot of big class-action
suits. About damn time if you ask me.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/47/9691#9691