Security threats Toolkit
Story: Linux guru argues against security liability
developers not liable
"Microsoft's national technology officer, Jerry Fishenden, who spoke at the hearing, said the responsibility for security breaches should rest firmly with those perpetrating the breaches. "We're making software as secure as we possibly can. People don't look at window-lock makers for the responsibility for burglary — the responsibility tends to rest with perpetrators," said Fishenden."
... I am in agreement with the above statements, we as developers do due diligence to ensure that the code and software we produce is secure. However, due to the nature and interaction with different software on the same system that leads to insecure situation we should not be held liable.
As an example -- door maker built a most secure door possible, but the hinges that were used were not the best -- would this mean that door maker is liable when a burglar breaks into the house?
these are the points to look at
1. home owner bought a mediocre hinges -- should he be liable?
2. hinge maker made mediocre product -- should he be liable?
3. since door protects the home, door maker should be liable
4. the perpetrator should be held liable because he/she broke the law, not only invaded someones privacy, but also trespassed on private property and borrowed permanently something(s) that did not belong to them.
as you can see we as developers do our best to make the software secure and our reputation lies in making sure that is the case. We are there to meet consumer's needs by providing software that is valueable to them.
For mistakes in grammar, sentences or spelling -- purposely done to mislead the reader from true crux of the arguement.
nb
Full Talkback thread
