Many Security Exploits Financial, Not Technical Issue

El Reg writes about an academic article that calls for making vendors liable for security exploits.

This is a good idea:

In the real world investment in risk avoidance may not be profitable. Security failures often arise due to perverse incentives rather than the lack of suitable technology. For example, credit card firms can rely on business models that push the cost of fraud onto merchants and consumers rather than investing in reducing the problem themselves. That's because such investments would place them at a commercial disadvantage to their competitors.

Establishing economic incentives for IT suppliers to produce more secure products is arguably an even greater problem because software publishers are not held liable for the shortcomings of their products. These shortcomings may damage consumer faith in ecommerce but fail to effect sales, so a market-based solution in absence of regulatory pressure is difficult to imagine.

Microsoft would be bankrupt in 6 months.