GitHubs next feature: litigation tracker.
Open source liability is coming
11–20 of 239 posts
Re: Open source liability is coming
#12This is ridiculous, all blame/liability should lie with either the provider of commercial software who chooses to rely on open source software or the end user for relying on free/open source software. I personally will not allow people in the EU to use any software I write going forward, I imagine other open source developers will take these steps as well.
This seems a bit extreme, it isn't even a law yet (or anywhere close). That being said, if you don't audit your open source libraries, you should be held liable. I've seen open source encryption libraries do some really dumb things that I wouldn't touch with a ten foot pole. Yet they are some of the more popular ones.
[deleted]
Re: Open source liability is coming
#13This is ridiculous, all blame/liability should lie with either the provider of commercial software who chooses to rely on open source software or the end user for relying on free/open source software. I personally will not allow people in the EU to use any software I write going forward, I imagine other open source developers will take these steps as well.
This seems a bit extreme, it isn't even a law yet (or anywhere close). That being said, if you don't audit your open source libraries, you should be held liable. I've seen open source encryption libraries do some really dumb things that I wouldn't touch with a ten foot pole. Yet they are some of the more popular ones.
Why should I be held accountable if you just run some code you found on GitHub? Am I reliable when I sell hammers and you bash your face in?
/e: let me clarify, I agree with the three comments under me. You, the commercial entity using my code, is accountable. I am not liable if you as a private person run my shitty code. I was thinking of private persons and being on the hook for my GitHub repos.
Re: Open source liability is coming
#14I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs.
Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so harm to our customers is not our fault!"
Re: Open source liability is coming
#15FINALLY. This industry needs some regulation... I'm mostly curious what that means for something like the MIT license... For those who need a refresher, this is the part I mean. > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYR…
> This industry needs some regulation Are there cases of open source projects being careless or negligent that have caused harm that this would address? Aside from some unintentional vulnerabilities that have been found, it’s hard for me to think of an example that would necessitate more regulation.
I can think of exactly one rather popular one: left-pad.
The author should have been liable for the damage they caused. The industry self-regulated itself but that is a case that I can think of, specifically caused by negligence.
Re: Open source liability is coming
#16Earlier quoted context omitted.
This seems a bit extreme, it isn't even a law yet (or anywhere close). That being said, if you don't audit your open source libraries, you should be held liable. I've seen open source encryption libraries do some really dumb things that I wouldn't touch with a ten foot pole. Yet they are some of the more popular ones.
Why should I be held accountable if you just run some code you found on GitHub? Am I reliable when I sell hammers and you bash your face in? /e: let me clarify, I agree with the three comments under me. You, the commercial entity using my code, is accountable. I am not liable if you as a private person run my shitty code. I was thinking of private persons and being on the hook for my GitHub repos.
No no, you should be held accountable if _you_ run some code you found on GitHub in your product that I pay you for.
Re: Open source liability is coming
#17This is ridiculous, all blame/liability should lie with either the provider of commercial software who chooses to rely on open source software or the end user for relying on free/open source software. I personally will not allow people in the EU to use any software I write going forward, I imagine other open source developers will take these steps as well.
It seems the author is refering to the EU Cybersecurity Act that should be voted early 2024.
The last draft clearly excludes open source software as long as there is no commercial activity associated. If voted in this state, it won't affect the vast majority of developers releasing some code under an Open Source license. But it will wipe out all small businesses: if you're a solo company selling support or feature development on some Open Source software you wrote, paperwork and liability are just not worth it.
And good luck selling anything relying on existing Open Source libraries, because you're now liable for them too. Given the cost of a security audit, you may as well stop trying and just sell SaaS (which is explicitely excluded from the bill, funny).
Larger companies of course won't care and will continue shipping buggy software riddled with security holes because they can afford the paperwork and absorb the legal risk.
Re: Open source liability is coming
#18FINALLY. This industry needs some regulation... I'm mostly curious what that means for something like the MIT license... For those who need a refresher, this is the part I mean. > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYR…
> This industry needs some regulation
I concur, but I don't agree this is in the right direction.
> I'm mostly curious what that means for something like the MIT license
I think the article addressed that. Let me quote it for you:
> Today you can license-away that liability by putting the onus on the user to accept the risk, since bugs happen and hackers hack. Not your fault, you did your best, and you told the user that upfront. My read of the emerging regime changes that. It forces you to prove your code wasn’t the cause of the harm – “strict liability” in legal circles. Products like cars often get regulated this way. Essentially, the carmaker is at fault when something goes wrong unless they can prove they’re not.
> A license like the one Apache provides won’t help, since state-imposed strict liability isn’t a harm that can be licensed away by private actors.
If strict liability isn't a harm that can be licensed away by private actors then the last sentence you quoted couldn't be enforced:
> IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Re: Open source liability is coming
#19Earlier quoted context omitted.
This seems a bit extreme, it isn't even a law yet (or anywhere close). That being said, if you don't audit your open source libraries, you should be held liable. I've seen open source encryption libraries do some really dumb things that I wouldn't touch with a ten foot pole. Yet they are some of the more popular ones.
Why should I be held accountable if you just run some code you found on GitHub? Am I reliable when I sell hammers and you bash your face in? /e: let me clarify, I agree with the three comments under me. You, the commercial entity using my code, is accountable. I am not liable if you as a private person run my shitty code. I was thinking of private persons and being on the hook for my GitHub repos.
I don't think it's like that.
Re: Open source liability is coming
#20GitHubs next feature: litigation tracker.
"Sue Request"