[joenathanone]

> Are we going to prosecute all long-tail problems in any product?

Hopefully yes, if it’s proven the vendor knew but released anyway or didn’t disclose.

[imglorp]

Realistically, no. Security is not a feature people are dying to pay for, it's just overhead. Look at Experian, on the front page again, still insecure. It's cheaper to make the defective product and say you're a little sorry, now and then.

[qchris]

Isn't this sort of what the lawsuit is for, though? Even if it's cheaper to make the initial defective product and say you're sorry after, if the sorry is both guaranteed (prosecuting even the long tail) and large enough, then hopefully at some point it raises the overall cost to the point where it's now cheaper to build things correctly.

[badrabbit]

Their decision not to fix is not the problem, their decision to keep the flaw a secret and sell products with a performance expectation set and then release patches that slow down that paid for performance is.