Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Securing Open Source Software Act' introduced to US Senate

hsgac.senate.gov

Post reply on HN
Print view View original

181–187 of 187 posts

Re: 'Securing Open Source Software Act' introduced to US Senate

#181

Post by dllthomas »

aaubry wrote: post #164
dllthomas wrote: post #127

Earlier quoted context omitted.

That same solution still works for FOSS, you just actually need to pay for it. The situation for FOSS is even better because you also have the option of paying any other person to fix the code. Hopefully that's kinda what this bill does, though?

It's not so simple. The developers are not necessarily available for this kind of support. For example, I maintain an FOSS library, but I already have a full time job, and I'm not interested in working more hours. Unless someone hires me to work full time on this library, there is no chance that I provide paid support. I suspect that many other maintainers are in the same situation.

That's also potentially true of proprietary software, though. Not every company will offer a support contract, so if that's what you need you need to pick other software. I agree that probably a smaller fraction of FOSS projects offer first-party support contracts, but on the other hand third-party support contracts are a lot more reasonable in the FOSS context.

Re: 'Securing Open Source Software Act' introduced to US Senate

#182

Post by dllthomas »

kube-system wrote: post #142
dllthomas wrote: post #138

Earlier quoted context omitted.

You seem to be reading me as implying any use of FOSS is equivalent to having a support contract; it's not. I was claiming that having a support contract for FOSS is equivalent to having a support contract for proprietary software. If you need "support contract" level support you should probably be paying for a support contract. At least with FOSS that can be competitive for the same piece of software (although that…

I said the issues are different and you disagreed, so I detailed what I meant. It’s also not reasonable to require the government to just get 10,000 support contracts just to implement a single application. What makes the most sense is what they’re doing here: 1. come up with a strategy for managing these risks 2. Collectively work with OSS developers instead of treating every one of the governments 10 bazillion proj…

> I said the issues are different and you disagreed

I disagreed that things are all that different "if you have a support contract."

> It’s also not reasonable to require the government to just get 10,000 support contracts just to implement a single application.

I agree, but I'm not sure that's relevant? If a single support contract is sufficient for proprietary software - making them responsible for addressing (incl. possibly working around) issues in any dependency - why is that not also viable for FOSS software?

I don't disagree that what they're doing here seems likely to be a good idea, I just think you were initially selling "pay for support for the software you rely on as a big organization" a little short in its general applicability; indeed, this probably be viewed as providing that service internally.

Re: 'Securing Open Source Software Act' introduced to US Senate

#183

Post by kube-system »

yencabulator wrote: post #178
kube-system wrote: post #174

Earlier quoted context omitted.

Challenge accepted, here’s one that’s publicly posted. Most are not on public websites: https://www.vmware.com/solutions/industry/government/warrant... Warranties aren’t common in B2C or cheap boxed software. A few hundred or a few thousand dollars is not worth anyone’s time to negotiate special terms. In big dollar B2B or B2G, software isn’t usually as-is. Contracts are negotiated that specify what will be delivered…

Great example. Key quotes: > your sole remedy will be that VMware shall, at its option, > make a U.S. Person on U.S. soil available to provide technical support (in the case of non-conformity to the aforementioned Section (b)) or refund the license or service fees you paid > VMware receives prompt written notice of the non-conformity following delivery (in the case of Software So, If the product isn't accessible: the…

The VMWare warranty I linked was an example of one explict warranty, it is not representative of what all software warranties look like.

Some warranties are implied, as well, and you won't find them written down anywhere.

See this article for several further citations:

https://corporate.findlaw.com/litigation-disputes/performanc...

Re: 'Securing Open Source Software Act' introduced to US Senate

#184

Post by yencabulator »

kube-system wrote: post #183
yencabulator wrote: post #178

Earlier quoted context omitted.

Great example. Key quotes: > your sole remedy will be that VMware shall, at its option, > make a U.S. Person on U.S. soil available to provide technical support (in the case of non-conformity to the aforementioned Section (b)) or refund the license or service fees you paid > VMware receives prompt written notice of the non-conformity following delivery (in the case of Software So, If the product isn't accessible: the…

The VMWare warranty I linked was an example of one explict warranty, it is not representative of what all software warranties look like. Some warranties are implied, as well, and you won't find them written down anywhere. See this article for several further citations: https://corporate.findlaw.com/litigation-disputes/performanc...

My point is, all software warranties tend to be weasel words that don't amount to that much, as far as risk management is concerned. They especially don't usually obligate the seller to fixing anything, at most they undo the purchase.

Re: 'Securing Open Source Software Act' introduced to US Senate

#185

Post by kube-system »

yencabulator wrote: post #184
kube-system wrote: post #183

Earlier quoted context omitted.

The VMWare warranty I linked was an example of one explict warranty, it is not representative of what all software warranties look like. Some warranties are implied, as well, and you won't find them written down anywhere. See this article for several further citations: https://corporate.findlaw.com/litigation-disputes/performanc...

My point is, all software warranties tend to be weasel words that don't amount to that much, as far as risk management is concerned. They especially don't usually obligate the seller to fixing anything, at most they undo the purchase.

At most, a warranty failure may have associated damages that could far exceed the purchase price.

(This is why FOSS licenses almost universally disclaim both warranty and liability for damages, rather than ignoring the issue. Refunding the purchase price is not the worst that can happen.)

Usually in very large software purchases, fixing problems is often much cheaper than undoing a purchase.

While technically, you may be able to legally refund a $10,000,000 software purchase in lieu of buying a plane ticket for a developer, in practice, that's not really an option anyone takes.

Re: 'Securing Open Source Software Act' introduced to US Senate

#186

Post by yencabulator »

kube-system wrote: post #185
yencabulator wrote: post #184

Earlier quoted context omitted.

My point is, all software warranties tend to be weasel words that don't amount to that much, as far as risk management is concerned. They especially don't usually obligate the seller to fixing anything, at most they undo the purchase.

At most, a warranty failure may have associated damages that could far exceed the purchase price. (This is why FOSS licenses almost universally disclaim both warranty and liability for damages, rather than ignoring the issue. Refunding the purchase price is not the worst that can happen.) Usually in very large software purchases, fixing problems is often much cheaper than undoing a purchase. While technically, you ma…

Sure, sure, now note the part where VMware is not obligated to do either, they can just give you a helpdesk number and drown you in bureaucracy. And that is still only necessary if you noticed the problem "promptly" after delivery.

I think if you want to argue damages is a common contract clause in the software industry, it's only fair I ask you to name examples. Because it really isn't common.

Re: 'Securing Open Source Software Act' introduced to US Senate

#187

Post by leaflets2 »

kube-system wrote: post #175
leaflets2 wrote: post #162

Earlier quoted context omitted.

It's not OSS libraries they'd be worried about, as competitors, but OSS applications , I d think.

This bill is in response to a recent issue with an OSS library: log4j.

Maybe. At least that's what they want you to think
Post reply on HN