But joking aside, developers do need to be held responsible for their work product. Every other industry that makes things is held responsible for the safety/workablity of their output, and many of those products (i.e., cars and planes) are far more complicated than software. [There are some narrow exceptions, i.e., vaccines, where the industry is shielded from liability because alternative mechanisms provide for consumer redress.]
This does not mean strict liability (i.e., liability without actual fault), but it does mean that negligence should be on the table.
What would negligent liability require?
Merely that developers follow best practices regarding their product. They already exist for the most common types of projects. Where no best practices exist, following standard conventions is usually sufficient.
Also, users can waive the developer's liability for simple negligence (but generally not for intentional negligence), so this is unlikely to impact most developers.
Cars and planes aren't under constant bombardment from invisible human adversaries all over the world. They're required to withstand failure in the face of known natural conditions and flawed workmanship, but not constant attempts by human adversaries to break them.
And an example that proves the rule - we don't sue car manufacturers when their lock system fails to prevent a thief stealing the radio or the car.
And, should we hold military vehicle and fighter aircraft manufacturers legally responsible for damage to their products by enemies shooting at them?
If a delivered software product doesn't meet a contractually-agreed-upon spec, then there is legal recourse for that. Maybe software contracts should specify exactly what penetration attempts it has been designed to withstand, and in very specific, not general, terms.
Comments
Yes. Lawyers need work.
But joking aside, developers do need to be held responsible for their work product. Every other industry that makes things is held responsible for the safety/workablity of their output, and many of those products (i.e., cars and planes) are far more complicated than software. [There are some narrow exceptions, i.e., vaccines, where the industry is shielded from liability because alternative mechanisms provide for consumer redress.]
This does not mean strict liability (i.e., liability without actual fault), but it does mean that negligence should be on the table.
What would negligent liability require? Merely that developers follow best practices regarding their product. They already exist for the most common types of projects. Where no best practices exist, following standard conventions is usually sufficient.
Also, users can waive the developer's liability for simple negligence (but generally not for intentional negligence), so this is unlikely to impact most developers.
Cars and planes aren't under constant bombardment from invisible human adversaries all over the world. They're required to withstand failure in the face of known natural conditions and flawed workmanship, but not constant attempts by human adversaries to break them.
And an example that proves the rule - we don't sue car manufacturers when their lock system fails to prevent a thief stealing the radio or the car.
And, should we hold military vehicle and fighter aircraft manufacturers legally responsible for damage to their products by enemies shooting at them?
If a delivered software product doesn't meet a contractually-agreed-upon spec, then there is legal recourse for that. Maybe software contracts should specify exactly what penetration attempts it has been designed to withstand, and in very specific, not general, terms.