Comments on: Are we being irresponsible?

By: Andy Willingham

Andy Willingham — Sat, 06 Feb 2010 16:35:53 +0000

Pat and Brian, I agree that the developers and vendors have a level of responsibility in this but that is another subject for another post.

Thanks for your input!

By: Brian Greer

Brian Greer — Sat, 06 Feb 2010 16:06:53 +0000

The users do have some responsibility. There is no doubt about that, in my mind. The question is whether they get the burden of ALL of the responsibility or not.

As Pat was saying, the real world analogy requires that the developers/vendors take some responsibility for their products, like car manufacturers. In my state, you cannot buy a car and take possession of it without first providing proof you are a licensed and insured driver. To put a PC on the Internet, it could be as simple as getting an old laptop with a wifi card and going to McDonald’s.

By: Pat

Pat — Fri, 05 Feb 2010 18:36:37 +0000

I agree with the responsibility of the user like you said, in the manner that user have to conduct their self in a good way like in a car etc.

But there is also the responsibility of the company that makes software should be held responsible exactly like the car manufacturer (lets take the Toyota example of these days) if there is a problem with the car, Toyota gets the responsibilities not the user!

Responsibility of the user AND company should be involved in your post.

By: andyitguy

andyitguy — Thu, 04 Feb 2010 20:55:55 +0000

Armorguy, I agree that in cases where the user gets pwned just because that is different. My concern is that there is a growing number of security pros who are saying “give up on the user and let them do as they will”. That takes ALL responsibility from them and allows them to do as the please while the rest of us suffer for their actions. Sounds like a lot of government programs doesn’t it. I just think that if we expect little we will get little and if we expect responsibility we will get a good deal more of it than we currently are. I’m also not advocating that we “make them pay” so much as we teach them and expect them to act in a responsible manner.

This sounds like a great conversation for a podcast sometime.

By: armorguy

armorguy — Thu, 04 Feb 2010 20:42:33 +0000

I agree there needs to be a level of responsibility assigned when folks act (or fail to act) according to generally accepted rules. I think the rub comes when, for no reason other than they were connected to the internet, people get pwned. For example, my parents don’t surf porn (as best I know and I’m not asking questions), have anti-virus up to date, and generally follow the steps we tell general users to do. Even with all that “bad things happen”. Can we hold them solely responsible?

I don’t think so. I think there’s enough responsibility (versus “blame” – which is a different conversation entirely) to go around. How we sort this out? I don’t know. But I’m puzzling it out…