The World Is Getting Hacked. Why Don’t We Do More to Stop It?
The article states this:<p>&gt; The money they made from these customers hasn’t expired; neither has their responsibility to fix defects.<p>This is wrong. We don&#x27;t ask for mandatory lifetime guarantees in any other industry I&#x27;m aware of, and perhaps more importantly, much of what is done in the field wouldn&#x27;t be possible if it did (could you imagine having to continue to maintain an IE5 webpage for another twenty years?).<p>It goes on:<p>&gt; In its defense, Microsoft probably could point out that its operating systems have come a long way in security since Windows XP, and it has spent a lot of money updating old software, even above industry norms. However, industry norms are lousy to horrible, and it is reasonable to expect a company with a dominant market position, that made so much money selling software that runs critical infrastructure, to do more.<p>If I buy a toaster it comes with a one year warranty, maybe. A nice car might come with a five year or two hundred thousand mile limited warranty. Microsoft sold a product at a fraction of that cost and supported it, unconditionally, for 8 years. 8. And they supported it for five more after that with appropriate arrangements with enterprises (and after a select few enterprises who somehow concluded that paying some engineering salaries at Microsoft for dedicated support was cheaper than upgrading). That&#x27;s a 13+ year lifetime of support on what was an $80 a license product. Industry norms can only be &quot;horrible&quot; insofar as there&#x27;s only been a serious industry for 30 years... And XP was supported for half of it (man, I suddenly feel old). My point is that there is no world in which the &quot;cash-strapped National Health Service&quot; is not the primary entity which was grossly negligent in its maintenance of critical infrastructure.<p>Stepping back and looking at the article as a whole and less at specific inflammatory parts, it is, well, filled with inflammatory parts. It starts as a thin attack piece on Microsoft for being slow to provide free support for a 16 year old product, offhandedly references IoT for some added scare factor, then starts calling for action (from both corporate and government actors) without any serious discussion on either the merits of the proposed actions or the impacts taking them would have on those organizations or the implications that they would create for future actors.<p>But hey, if you&#x27;re a fan of Bruce Schneier&#x27;s more recent musings, at least you&#x27;ll enjoy the conclusion: That we must legislate software, and fast.