Sounds great but that isn't the NSA's mission, not even the defensive mission.

Sounds great but that isn't the NSA's mission, not even the defensive mission. Their defensive mission is limited to DoD networks and national security related systems, and producing various recommendations. DHS and/or NIST cover commercial and non-DoD government. But even then it is a voluntary and/or advisory capacity too - there is no authority to make a company fix a software product (unlike say a car defect, which gets into liability issues nobody wants to open for software). As for discovering and preventing bugs, I think that would be a waste of time/effort in the current towards NSA and software in general. Nobody is going to take a binary patch from them, nobody is going to submit their source code for review, any help given to a company would draw complaints from their competitors, and fundamentally as long as companies aren't actually liable for damages due to bugs or security issues, they aren't going to care much about spending money to improve the situation. A corporation would just rather add another clause to a EULA to disclaim more and more responsibility. It's a free market failure since bottom line profits aren't affected so there is no incentive to improve. That leaves the question of whether the government should be subsidizing the business world's failure to meaningfully invest in bug fixes and security improvements.

Posted by thoth on Jun 29, 2015, 10:37 PM

Tags

• hackernews (SaaS)

Related issues

• That's the biggest problem with iOS because Apple can be ordered to block them from the App Store and it would be instantly kill these pr...
• I'm intrigued about the "Trip Planner" being a top-level app.
• This asymmetry is IMO the biggest problem with AI-driven output.
• This is one of the most important objectives in software today.
• At least in Europe - these rouge corporations need to be reined in or just leave the market.
• I was skeptical, but this looks genuinely useful.