Re: [tlug] System security and public policy [was: Anyone seen this gizmo yet?]

[Edward Middleton <ejdmiddleton@example.com>]

Stephen J. Turnbull wrote:
> Sotaro Kobayashi writes:
>
>  > Ahh... Thanks for comments.
>  > People should be more informed about securty vulnerabilty all over the 
>  > world :-(
>
> No, they shouldn't, any more than they should need to be informed
> about bicycle lock technology.  Systems should be constructed to be
> reasonably secure, and vendors made financially responsible for
> negligence leading to damage.
>   

My preference would be to go the other way.  Make willfully ignorant
users liable for damage caused by their computer usage, but pass on the
liability to vendors if the user has followed reasonable security
guidelines drawn up by a competent third party, be it NPO etc.  That
would force vendors to be clear about the security of their systems but
protect them from willfully ignorant users.  AFAICT most of the botnet
problems are caused by people failing to patch known security holes that
have vendor patches.  I don't think its reasonable to hold vendors
responsible for this.  Running a reasonably secure windows installation
means at the minimum avoiding outlook, using a virus scanners, setting
up a firewall, regularly security patching, taking seminars on the
latest fishing methods etc. there goes your TCO ;)

Edward