1. Information Security CS 526 Topic 15a
Market Failure for Secure Software
CS526
Topic 15a: Market Failure

2. Why Software Has (or appear to have) So Many Bugs?
Software is complicated, and created by human
Software is no more buggy, is just more targeted?
Unique nature of software
Near-zero marginal cost
Market failure for secure software
Market failure: a scenario in which individuals' pursuit of self-interest leads to bad results for society as a whole
i.e., free market could lead to bad outcome
Users cannot just vote for security with their money.
lack of measurement for security
Vendor has no incentives to produce higher quality software.
Materials in the new few slides from “Geekonomics: The Real Cost of Insecure Software” by David Rice
Other things are also complicated and created by human.
Nothing can really stand against determined attackers?
Car window can be easily broken, unscrew tire. If people can tamper with it, it is not secure.
House can be easily entered.
How software and hardware differ?
Hardware needs to be produced, and bugs are more difficult to fix.
Creation process
People believe in free economy. Every agent pursues its own utility, the overall outcome is good. Companies compete, and better products win, right?
Economist George Akerlof examined the market of lemons in his notable paper: "The Market for Lemons: Quality Uncertainty and the Market Mechanism", published in Quarterly Journal of Economics in 1970, in which he identified the severe lemon problems that may afflict markets characterized by asymmetrical information. He eventually received a Nobel Prize for the broad applications of the theory in this paper.
Knows no quality of used car. Demand lower price. Sellers have no incentive to sell good used cars. This becomes a vicious cycle. Information imbalance between sellers and buyers.
With equal access to information (either ), then market will be okay.
Cars in the 50’s and 60’s are extremely unsafe, because no incentive to increase safety.
-Car safety standard (five star ratings) introduced in 70’s and 80’s help improve car safety. It is not easy to standardize this. Need to design & measurement. Without standard, people are uninformed about the actual safety.
CS526
Topic 15a: Market Failure

3. Guy Kawasaki: “The Art of Innovation”
Don't worry, be crappy.
An innovator doesn't worry about shipping an innovative product with elements of crappiness if it's truly innovative.
Churn, baby, churn.
I'm saying it's okay to ship crap--I'm not saying that it's okay to stay crappy. A company must improve version 1.0 and create version 1.1, 1.2, This is a difficult lesson to learn because it's so hard to ship an innovation; therefore, the last thing employees want to deal with is complaints about their perfect baby. Innovation is not an event. It's a process.
Let us look at what vendors think.
Due to Guy Kawasaki, Silicon Valley venture capitalist.
The first permutation of a innovation is seldom perfect--Macintosh, for example, didn't have software (thanks to me), a hard disk (it wouldn't matter with no software anyway), slots, and color. If a company waits--for example, the engineers convince management to add more features--until everything is perfect, it will never ship, and the market will pass it by.
I am sure that these are good advices, but it won’t lead to secure software.
To be fair, also include “Churn”
CS526
Topic 15a: Market Failure

4. Why Vendors Lack Incentive to Produce More Secure Software
Cash flows when product starts shipping.
Market dominance is key to success
being first often means becoming de facto standard
No liability.
Bugs can be patched with little cost. No expensive recall.
Thorough testing is inefficient. Let the users test it and fix only the bugs that affect users
For a software company to survive in the beginning, cash flow is key. For software startups, foremost self interest is survival.
No liability means no need to worry about correctness and thorough testing.
Find out which bugs matter most, and fix only them.
CS526
Topic 15a: Market Failure

5. The Perversity of Patching
Releasing a patch costs little
Buggy software can force users to upgrade
Achieving market dominance means competing with previous versions
Stop releasing patches for old versions can force users to upgrade
Patching provide an opportunity of offering new licensing terms
Even if thoroughly testing software were possible, Venders ultimately have a perverse incentive not to make better software. This is due to nature of software; patching.
CS526
Topic 15a: Market Failure

6. Topic 15a: Market Failure
Coming Attractions …
Discretionary access control
CS526
Topic 15a: Market Failure