Software Maker Liability Is Elusive Target of Biden Cyber Plan

[pimpbot]

1. Its a good idea, in theory

It will be hard to codify what exactly would make the software company liable.

The most obvious scenario is a flaw in the code which lets an attacker in. But what if the flaw is actually in an open source library that the software uses? Who is liable in that case? What if the software company releases a patch but the end user doesn't update?

Then we look at configuration. There are tons of configuration options for a typical enterprise software application. Companies will usually release a reference or recommended configuration, which end users will customize to fit their environment. What if someone configures the software in a way the developer never intended?

Will software makers start requiring expensive service contracts to ensure their product is deployed and configured in an approved way?

I commend the administration for releasing this guidance. But I also realize anything that makes it through congress and their lobbyists will probably have little to no teeth.