<html><head></head><body><div class="gmail_quote">On 6 de mayo de 2014 09:10:10 GMT+01:00, Matthias Kirschner <mk@fsfe.org> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">I am interested in your feedback about the Heartbleed part of the May<br />Newsletter <<a href="https://fsfe.org/news/nl/nl-201405.en.html">https://fsfe.org/news/nl/nl-201405.en.html</a>>: <br /><br /><br /> == Heartbleed and economic incentives ==<br /><br />You probably heard about the bug in the Free Software OpenSSL nicknamed<br />"heartbleed". The FSFE already welcomed the industry initiative to fund<br />critical Free Software projects[1], and the topic was discussed in<br />several blog articles on the planet: Sam Tuke wrote about his<br />impression[2], Hugo Roy shared an XKCD comic explaining how heartbleed<br />works[3], and Martin Gollowitzer wrote about what the Heartbleed bug<br />revealed to him[4] about StartSSL certificate authority.<br /><br />But your editor is convinced that the main problem is not OpenSSL. It is<br />not Free Software. It is about companies not taking responsibilities and<br />about missing economic incentives to
ensure
security. Security expert<br />Bruce Schneier wrote in 2006[5]:<br /><br /> "We generally think of computer security as a problem of technology,<br /> but often systems fail because of misplaced economic incentives: The<br /> people who could protect a system are not the ones who suffer the<br /> costs of failure."<br /><br />In a nutshell, if your private data is exposed because your health<br />insurance, where it is stored, did not take care to secure it, you<br />suffer to a much higher degree than the health insurance does! You are<br />in no position to preasure the health insurance to change its level of<br />security, and they have no economic incentive to do so. In the article<br />Schneier further explains that the liability for attacks is diffuse and<br />that "the economic considerations of security are more important than<br />the technical considerations".<br /><br />Following the argument, the important question we face is, how can we<br />give the
right
economic incentives to ensure that: security relevant<br />software has the proper funding; third parties are auditing code; more<br />people are trained in computer security; programmers have time for<br />maintenance and are not forced to just develop new features; we have a<br />diversity of software[6] for different special purposes and therefor<br />prevent software monocultures[7]; companies run secure software instead<br />of just giving people a good feeling by performing a security theatre or<br />by delegating responsibility to others (for example the government), so<br />they can be blamed if there is a problem, and that also the security<br />interest of private users is fulfilled and not just those of big<br />cooperations.<br /><br />In the FSFE we thought about how to give good economic incentives for<br />Free Software development from the beginning, and now we have to think<br />more about economic incentives to increase security. It is a difficult<br />area,
so we
are looking forward to your comments on this topic and<br />invite you to discuss it on our public mailing lists[8].<br /><br /> 1. <a href="https://fsfe.org/news/2014/news-20140424-01.en.html">https://fsfe.org/news/2014/news-20140424-01.en.html</a><br /> 2. <a href="https://blogs.fsfe.org/samtuke/?p=718">https://blogs.fsfe.org/samtuke/?p=718</a><br /> 3. <a href="http://hroy.eu/notes/openssl-tragedy">http://hroy.eu/notes/openssl-tragedy</a>/<br /> 4. <a href="https://blogs.fsfe.org/gollo/2014/04/13/what-the-heartbleed-bug-revealed-to-me">https://blogs.fsfe.org/gollo/2014/04/13/what-the-heartbleed-bug-revealed-to-me</a>/<br /> 5. <a href="https://www.schneier.com/blog/archives/2006/06/economics_and_i_1.html">https://www.schneier.com/blog/archives/2006/06/economics_and_i_1.html</a><br /> 6. <a href="https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations">https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations</a><br /> 7. <a
href="https://www.schneier.com/blog/archives/2014/04/dan_geer_on_hea.html">https://www.schneier.com/blog/archives/2014/04/dan_geer_on_hea.html</a><br /> 8. <a href="https://fsfe.org/contact/community.en.html">https://fsfe.org/contact/community.en.html</a><br /><br />Best Regards,<br />Matthias<br /></pre></blockquote></div><br clear="all">Thank you is all I can say. Gave me another point of view about the need of funding free software projects.<br>
Thank you.<br>
-- <br>
Enviado desde mi teléfono con K-9 Mail.</body></html>