Robert Pogson

There is news that the Stuxnet malware may have been aimed specifically at control systems in Iran’s nuclear programme. If so, it was an act of war. If the perpetrators are discovered this could get ugly. If the prerpetrators are not found, expect the attitude of Iran’s government to stiffen, if that is possible.

If I were in charge in Iran, I would rip out that other OS and beef up security. Control systems should not even be connected to the web when they are on-line. That is insane, like leaving the front doors of the building unlocked. I would bet the Iranians are making all kinds of plans to tighten things up. It’s not their fault. Everyone who has been working alone re-invents the wheel. The isolation with “the west” forced them to do many things on their own which may not have benefited from the mistakes everyone else has made in the nuclear age. They may have simply copied techniques they used for oil production which is not as a volatile/critical as a nuclear programme.

The twits who did this should be punished whoever they are. They are playing with fire. Dealing with an aggressive party with aggression is a sure way to escalate to all-out war. We don’t need that.

Lily Allen is suing Apple to get them to come clean on insecurity of her MacBook. She was damaged by disclosure of personal information from an intrusion. This could get interesting if everyone who lost data sued the provider of the software. M$ could turn out the lights immediately…

Maybe she should try GNU/Linux and hire someone to harden her system. By the scale in that link, I am not “truly paranoid” but at least I have not seen malware on hundreds of PC-years of usage. Lily Allen may indeed need the paranoid level of security. I do not.

The EULA of that other OS attempts to absolve M$ of claims of legal responsibility as does the GPL that covers most of GNU/Linux.
“15. Disclaimer of Warranty.

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.”

That is reasonable considering that the supplier cannot reasonably forsee all uses of the software and is not particularly being paid to provide security. However, a supplier can sell service which includes security protection to some extent. I doubt anyone can guarantee total security. Insurance, perhaps, but not certainty. On the other hand, the supplier of software who exhibits total disregard for security which M$ did until about 2000, should be sued for negligence, not reaching the ordinary duty of care required of everybody doing anything. Was it negligence to permit release of an OS with no firewall which at the same time was full of holes (XP before SP2)?

Did anyone sue M$ for the waves of malware that infected their OS? Yes. The shares of the company have done a dead-cat bounce since those days. Whether the suit, which was abandoned, or the malware was a cause of a lack of confidence or revulsion of M$ or just a symptom, it is bad business to produce a defective product. A thorough discussion of the issues generally about the legal responsibility for security of software is “The Tort of Negligent Enablement of Cybercrime”. Techs who neglect security can be fired. Maybe people should fire M$. I have.