Should companies be held responsible for security flaws in their products?

[rcgreen]

This limited warranty gives you specific legal rights. You may have others, which vary from state/jurisdiction to state/jurisdiction.
LIMITATION OF LIABILITY. To the maximum extent permitted by applicable law, in no event shall Microsoft or its suppliers be liable for

Notice that they recognize that the laws can , and often do supercede
the language of the EULA.

These documents are nothing more than a "wish list", an opening gambit that
you can challenge in court, or ask your legislators to void by law.

I worked for years in the car repair business. On every repair order there is fine print
that says that the mechanic has permission to test drive your car, and if he crashes
it, the shop is not liable. But everyone knows that by law they are liable,
regardless of what the form says.

[str34m3r]

I think it's important to differentiate between a company being liable for a flaw in their product and gross negligence on the part of the company. The recent quirk that allowed a script to be run when a user used WMP and a browser in close succesion isn't very obvious, and thus should probably be considered just a bug. I know we all hate bugs, but they are always going to exist, no matter what legislation gets passed. On the other hand, how often has Microsoft shoved a product out the door knowing that large security flaws existed, but figuring that they could fix it in a subsequent patch. And how many thousands of systems are compromised because they didn't wait that extra month to fix the obvious flaws? In my opinion, that's gross negligence and that's when a company should be punished.