Hacker News new | past | comments | ask | show | jobs | submit
It would be nice if we started treating security defects like hardware defects
Note in particular there is no statue of limitations on some issues. All that protects Ford from having to recall (as in government forced recall) every model T to install seat belts, airbags, crumple zones, TPMS, backup cameras and the like is the courts generally will agree that those things were now known back then and so we shouldn't hold old systems to new standards.

Note that buffer overflow attacks have been known since the 1980s. If there is a problem with internet connected windows 3.1 courts should ignore it since microsoft didn't intend for that to be connected to the internet. But windows 95 was intended to connect to the internet and Microsoft probably should recall and patch all buffer overflow vulnerabilities in it. (but they can continue to not support modern AES encryption because that was not know in 1995)

In my experience, hardware defects are usually ignored. If you're lucky, an "errata" will be published somewhere and you won't get a fix unless you buy a new one.