Re: [Iotops] [arch-d] How old is too old and what this means for product lifecycles? Re: [Last-Call] [TLS] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice

[Michael Richardson <[e-mail]>]

Sávyo Vinícius <[e-mail]> wrote:
    > I really believe in the efficacy of an open source-based approach, but
    > there is a long way to develop a consistent framework (including community,
    > regulation, best practices, and other relevant stuff) to do it.
    > Still in this context, regulatory approaches need much attention because
    > they can be restrictive to those companies, and contribute to more
    > bankruptcies.

http://geer.tinho.net/geer.blackhat.6viii14.txt
and
https://www.blackhat.com/us-14/video/cybersecurity-as-realpolitik.html

What can the IETF do?
Mostly what we are already doing, which is to make it
cheaper and easier to build products where the clients and the servers don't
have to be vertically integrated.

... some text to tease you into going to read/listen-to the whole thing:

3. Source code liability -- CHOICE

Nat Howard said that "Security will always be exactly as bad as it
can possibly be while allowing everything to still function,"[NH]
but with each passing day, that "and still function" clause requires
a higher standard.  As Ken Thompson told us in his Turing Award
lecture, there is no technical escape;[KT] in strict mathematical
terms you neither trust a program nor a house unless you created
it 100% yourself, but in reality most of us will trust a house built
by a suitably skilled professional, usually we will trust it more
than one we had built ourselves, and this even if we have never met
the builder, or even if he is long since dead.

The reason for this trust is that shoddy building work has had that
crucial "or else ..." clause for more than 3700 years:

    If a builder builds a house for someone, and does not construct
    it properly, and the house which he built falls in and kills
    its owner, then the builder shall be put to death.
	-- Code of Hammurabi, approx 1750 B.C.

Today the relevant legal concept is "product liability" and the
fundamental formula is "If you make money selling something, then
you better do it well, or you will be held responsible for the
trouble it causes."  For better or poorer, the only two products
not covered by product liability today are religion and software,
and software should not escape for much longer.  Poul-Henning Kamp
and I have a strawman proposal for how software liability regulation
could be structured.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide