Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source liability is coming

developersalliance.org

Post reply on HN
Print view View original

41–50 of 239 posts

Re: Open source liability is coming

#41

Post by Nifty3929 »

monooso wrote: post #25

There seems to be some confusion in the comments regarding what this means for people releasing open source software. The article makes it clear that (as the author understands it, at least) someone who uses open source software in their commercial product is liable; the people who wrote the open source code [1] are not. > If a user is harmed by software, the person they paid (targeted ads would count) must compensat…

"The article makes it clear that" - Sadly the article did NOT make this clear to me. I did finally pick up on it about halfway through, but until that point I was just as confused as everybody else. The title also doesn't help.

This is about liability for the organization that releases a product to be liable for it - all parts of it - regardless of whether some of those parts were developed by 3rd parties (e.g. Apache). But again, the headline and most of the article are not clear about this.

Re: Open source liability is coming

#42

Post by Mountain_Skies »

Hopefully this will change attitudes in application security. Developers often try to ignore vulnerabilities found in the libraries they used, coming from the POV of "well, that's not my code so it's not my fault" instead of "we chose that library so we're responsible for any vulnerabilities it creates for the company". If you're going to use FOSS and don't do anything to correct or mitigate the vulnerabilities in the part you choose to use, then it's your vulnerability. But they only see it from a POV of feeling blamed for something they didn't do as it's not their code and ignore the bigger picture of attackers not caring the slightest who introduced a vulnerability for them to exploit, they're just happy that it exists.

Re: Open source liability is coming

#43

Post by omnicognate »

withinboredom wrote: post #35
omnicognate wrote: post #29

Earlier quoted context omitted.

The article is misleading unless you read the whole thing and the reactions are standard knee-jerk ones from HN users that didn't need to read past "EU" to assume the worst possible misinterpretation.

I read the article, but it was quite ambiguous, at least to me. It isn't very well written / clear on what is actually going on.

I agree it's very ambiguous, but if you read the whole thing it's clear that when dev A releases code under an open source license and it's included in a commercial product by company B that then harms person C, the liability will be on company B. Most of the hot-under-the-collar responses here are assuming it will fall on dev A, which is a misinterpretation the article's author did not do much to discourage.

Re: Open source liability is coming

#44

Post by kragen »

sevagh wrote: post #14

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so har…

i think the article is deliberately written to be confusing

Re: Open source liability is coming

#46

Post by notfed »

omnicognate wrote: post #29
sevagh wrote: post #14

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so har…

The article is misleading unless you read the whole thing and the reactions are standard knee-jerk ones from HN users that didn't need to read past "EU" to assume the worst possible misinterpretation.

Are we reading the same article? The final paragraph even says:

> My prediction, for what it’s worth, is that open source’s days outside academia and hobbyists are numbered.

Re: Open source liability is coming

#47

Post by rebeccaskinner »

sevagh wrote: post #14

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so har…

I think that this part of it could break either way, but the concern is that when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. If so, that would be a net harm to open source and user freedom. I'm not sure it'll happen, but it might.

The biggest issue I see with this law is around liability for open source projects that people are using directly. It'll be disastrous if all open source software ceases to exist or be available in Europe because volunteers face legal liability if their code has a bug. In theory this could even impact people outside of Europe if they don't prohibit access to their code by EU citizens.

I release a lot of code on github. Most of it is just random crap that I wrote to solve a specific need or to explore an idea, and I put it up under an open source license because why not? If it helps someone, that's great. Now I need to be concerned that the random "example-service" project I wrote in C and published a decade ago to go with a blog post I wrote will end up costing me all the money I have ever or will ever earn in my career.

Re: Open source liability is coming

#48

Post by ctoth »

I use an open source screen reader, NVDA.

It is completely open, and they produce an installer for people or you can build it yourself from Git.

Can you help me understand now, if there is a bug in NVDA (which is under the GPL) and it causes me trouble, say, it can't read a webpage that I need for some government thing, I could now sue my screen reader, which is actually just a bunch of dudes hacking something together? Is that the new behavior that is enabled by this upcoming law?

Next question, if this is the actual state of things, why would anyone ever make anything open source and allow it to be distributed in the EU now? It sounds like, and please please correct me if I am wrong, but it sounds like you could sue the makers of The Gimp, for instance, if a bug caused ... what, your pictures to come out looking wrong?

> Someone, or some entity, will need to accept financial and legal responsibility for what the project does in consumer hands.

Here's a crazy idea, maybe that person should be the consumer?

Re: Open source liability is coming

#49

Post by mjr00 »

withinboredom wrote: post #32
rwj wrote: post #28

Earlier quoted context omitted.

Except that all the people using left-pad weren't paying for left-pad, and didn't have a contractual relationship with the author. IANAL, but I'm doubtful the courts would find there is enough of a relationship for the author to be liable.

That is what new laws are for.

No, they aren't. Even in the most liberal interpretation of the new laws, there's nothing specifying that you need to continue making your open-source package continually and indefinitely available.

Re: Open source liability is coming

#50

Post by sevagh »

omnicognate wrote: post #43
withinboredom wrote: post #35

Earlier quoted context omitted.

I read the article, but it was quite ambiguous, at least to me. It isn't very well written / clear on what is actually going on.

I agree it's very ambiguous, but if you read the whole thing it's clear that when dev A releases code under an open source license and it's included in a commercial product by company B that then harms person C, the liability will be on company B. Most of the hot-under-the-collar responses here are assuming it will fall on dev A, which is a misinterpretation the article's author did not do much to discourage.

Actually, I may have missed buried lede in this case where there is no company B, and citizen C is harmed by dev A's github project.

That is actually kinda concerning, if my MIT license of "no guarantee" won't protect me.

Other commenters who got it:

https://news.ycombinator.com/item?id=38808821

https://news.ycombinator.com/item?id=38808756

Post reply on HN