Skip to content

Comment on Should developers be sued for security holes?parent

Comments

Sounds like some lawmakers would like to deny any professional stature to developers other than the right to be sued, as individuals, for their work.

Actually, one of the major features of being a "profession" is that the practitioner is held liable for the quality of their work (as measured against their adherence to pre-established standards). This is why teachers, businessmen, and programmers are not considered "professions": they do not have clearly defined standards for proper work conduct, or liability for their work product.

Here's the definition of malpractice from the free legal dictionary (IANAL, of course)...

(http://legal-dictionary.thefreedictionary.com/malpractice)

"The failure to meet a standard of care or standard of conduct that is recognized by a profession reaches the level of malpractice when a client or patient is injured or damaged because of error."

...

"Negligence is conduct that falls below the legally established standard for the protection of others against unreasonable risk of harm. Under negligence law a person must violate a reasonable standard of care."

So you're right, it's not so much quality of work as failure to meet minimum and pre-established standards of care. I suppose this might work with software - not so much "your code was low quality" as "you clearly violated one of the top 10 OWASP security vulnerabilities." Perhaps completely failing to validate input would be malpractice, whereas writing crappy code to do this wouldn't.

But this is all by the wayside, it's not really related to my main point - which is that I don't think there's any precedent for holding a practitioner liable for professional "malpractice" in the absence of a profession that sets standards (and controls the right to practice).

And, as I said above, I tend to be very suspicious of professional associations. I'm not saying I think there should be no regulation on who is allowed to be a medical care provider, but I do think the AMA (along with many other prof assns) show extremely cartel-like behavior that can be very damaging.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.