Why Software Isn't Liable

Almost everyone with a device (computer, phone, tablet) connected to the Internet worries about security or performance impact. Anti-virus packages can only help so much: they are engaged in an endless evolutionary war with the viruses: each side evolves, adapts and improvises, but neither ever wins the war for good.

Jane Chong asked the question as to why software companies are not held liable for the quality of what they sell. Why were there vulnerabilities that could be exploited? Shouldn’t it be the company’s responsibility to test it thoroughly? In exasperation, she writes:

“Dazzled by what software makes possible—the highs—we have embedded into our lives a technological medium capable of bringing society to its knees, but from which we demand virtually no quality assurance.”

She denounces the software industry’s response that bad things happen because users often “fail to implement adequate security”.

I don’t know if Chong understands the first thing about software, but Steven Sinofsky sure does. He points out that programming languages are just tools. It is humanly impossible for anyone to anticipate and prevent every conceivable misuse of the tool. Or to use an analogy:

“I used a screwdriver as a pry bar.  I used a wrench as a hammer.”

Also, in today’s world, if anyone identifies any vulnerability, the impact happens on an “Internet scale” at warp speed. Add to that, programmers are “always going to push the limits of what they do”, sometimes to show off, at other times, for malicious purposes. As Sinofsky says:

“There is simply no way to prevent clever uses anymore than you can prevent me from using my screwdriver as a pry bar.”

Removing all features that can be misused would just be throwing the baby out with the bath water:

“There will be cost and unintended side effects of those actions.”

So can nothing be done at all? All hope isn’t lost, because modern platforms, especially the mobiles ones, are better than their predecessors:

“We’re not there yet collectively as an industry on balancing the extensibility of platforms and the desire for safety, security, performance, predictability, and more.  Modern platforms are a huge step in a better direction.”