Hot take (?): No company should be the CNA for their own products.

[meatzie@infosec.exchange]

@cR0w @ckure @boblord rejected can mean a lot of things though. Some CNAs used to do that for records they didn't use, although they shouldn't be doing that as much anymore. Some stuff gets reserved early and turns out not to be an issue.

[cr0w@infosec.exchange]

@brahms @ckure @boblord It's a fair point but I dislike it specifically because if the arguing about it. Full disclosure means people are either patching / mitigating or they're whining.

[boblord@infosec.exchange]

@cR0w How do other sectors handle safety-related product defect notifications? I'm thinking about sectors covering planes, trains, automobiles, food, medicine, etc., all of which have achieved dramatic improvements in safety for both their customers, as well as the general public. 🙏

[cr0w@infosec.exchange]

@boblord First and foremost, they hold manufacturers responsible for poor engineering. In tech it's just "LOL patch if you can." Without that, respectfully, the comparison is not valid.

[boblord@infosec.exchange]

@cR0w If we want to improve the safety of software like we have for other sectors, we need to figure out how to build software informed by those truly incredible successes. That road may be long, but we can do hard things! 💪

[cr0w@infosec.exchange]

@boblord I believe you want to improve things, I really do. But I think in order to get there, computer science needs to be engineering-focused rather than business-focused. And it's not. Especially in academia.

[hotsoup@infosec.exchange]

@boblord @cR0w what was that when Boeing famously took over their safety inspections by providing trained inspectors to whatever acronym it was. I heard that went famously well for them. The kind of well that documentaries were made about it.

Edit: there to their

[boblord@infosec.exchange]

@hotsoup @cR0w It's true that no system is perfect, but we don't let car makers opt out of filing defect reports, for example. We should ask what types of incentives would create more transparency from commercial software makers. As we see from all those other sectors progress is possible. Which tactics would work best in the software?

[cr0w@infosec.exchange]

@boblord @hotsoup Fines. Look at the auto industry. Transmissions fail to park, gas tanks explode, Lancias rust like a trans girl's GitHub history, you get the idea. But they were fined. Publicly traded corporations only care about the feelings of their investors. Kick them in those plums and they'll start trying to improve instead of finding cheap ways to hide their cheap failures.

[hotsoup@infosec.exchange]

@cR0w @boblord those industries have actual, real, Big E, Engineers. With Standards. And stamps. And liability. And consequences.
They are held personally responsible for their mistakes, and are thus incentivized not to make mistakes. (And like you implied, maybe not intentionally, they are also incentivized to hide their mistakes. Which is why inspections need to be done by unbiased third parties).
That is what software needs. Standards, Regulation, enforcement, consequences. And third party inspections. Real Engineering.

Edit: part to party

[cr0w@infosec.exchange]

@hotsoup @boblord Exactly. So much in tech says it's engineering but it's not. Engineering requires an understanding of how things work. But tech is about how to make money the fastest.

[boblord@infosec.exchange]

@cR0w @hotsoup Great points! A really great book that describes these incentive structures is Geekonomics by David Rice from 2008. I highly recommend it. David identifies numerous gaps between other sectors and the software sector. It's worth a read!

[cr0w@infosec.exchange]

@boblord @hotsoup Thanks but I'm not in a position to make change through political or industrial ways. But some people are.

[vampirdaddy@chaos.social]

@cR0w
okay, give them a few days for the patching & QA work - maybe up to a week?
Zero days if a functioning workaround is known (even if with degradated performance/functionality).