Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source liability is coming

developersalliance.org

Post reply on HN
Print view View original

61–70 of 239 posts

Re: Open source liability is coming

#61

Post by tracerbulletx »

omnicognate wrote: post #29
sevagh wrote: post #14

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so har…

The article is misleading unless you read the whole thing and the reactions are standard knee-jerk ones from HN users that didn't need to read past "EU" to assume the worst possible misinterpretation.

The article literally ends in bold with "Someone, or some entity, will need to accept financial and legal responsibility for what the project does in consumer hands. No license can insulate them from that. " If people are having a fearful reaction to the article it's the authors fault.

Re: Open source liability is coming

#62

Post by formerly_proven »

galdor wrote: post #17
theLiminator wrote: post #3

This is ridiculous, all blame/liability should lie with either the provider of commercial software who chooses to rely on open source software or the end user for relying on free/open source software. I personally will not allow people in the EU to use any software I write going forward, I imagine other open source developers will take these steps as well.

It seems the author is refering to the EU Cybersecurity Act that should be voted early 2024. The last draft clearly excludes open source software as long as there is no commercial activity associated . If voted in this state, it won't affect the vast majority of developers releasing some code under an Open Source license. But it will wipe out all small businesses: if you're a solo company selling support or feature d…

He’s probably talking about the Product Liability Directive reform.

Re: Open source liability is coming

#63

Post by withinboredom »

mjr00 wrote: post #49
withinboredom wrote: post #32

Earlier quoted context omitted.

That is what new laws are for.

No, they aren't. Even in the most liberal interpretation of the new laws, there's nothing specifying that you need to continue making your open-source package continually and indefinitely available.

I don't mean THESE new laws, just new laws in general.

> nothing specifying that you need to continue making your open-source package continually and indefinitely available.

There's a difference between making it available, and deliberately causing harm and untold productivity loss in a single day. This was a case of the latter.

Re: Open source liability is coming

#64

Post by elicksaur »

I know this legislation is in the EU, but in the US such a regulation seems to run up against the concept of free speech. What is the difference between these hypotheticals:

Case 1: I have a blog that takes a conspiracy-level, anti-tax position. In it, I say crazy things like, “The IRS is illegitimate and financial records are unnecessary.” From reading this, someone shreds all their financial documents. As far as I can tell, the blog is perfectly legal under the First Amendment.

Case 2: I am an open source maintainer of a home assistant program. It includes personal file management. Due to a bug in the software, an end-user’s financial documents are deleted.

The easiest distinction is that the conspiracy reader is taking an affirmative act of destroying their own documents. But, I think that’s less different than at first glance. The software user is setting up a computer system based on an open source program that may have bugs in it, and that causes a loss of data. The conspiracy reader is setting up a worldview based on information that may have bugs in it, and that causes a loss of data.

Why would the software bug be regulated, but the conspiracy falsehood not?

Re: Open source liability is coming

#65

Post by flir »

lifeisstillgood wrote: post #51
rebeccaskinner wrote: post #47

Earlier quoted context omitted.

I think that this part of it could break either way, but the concern is that when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. If so, that would be a net harm to open source and user freedom. I'm not sure it'll happen, but it might. The biggest issue I see with this law is around liability for open source projects…

>>> when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. Not even FAANG can achieve this for 1/10th of the code they rely on.

Hmm. They can probably find other companies willing to sell them support contracts, and take on that liability. Even for things that are open source. You're back to the old enterprise software model then, really, even if the code in question is "officially" open source. You won't be able to run versions that your supplier hasn't certified, and the rate of change will slow to a crawl.

Re: Open source liability is coming

#66

Post by MauranKilom »

monooso wrote: post #25

There seems to be some confusion in the comments regarding what this means for people releasing open source software. The article makes it clear that (as the author understands it, at least) someone who uses open source software in their commercial product is liable; the people who wrote the open source code [1] are not. > If a user is harmed by software, the person they paid (targeted ads would count) must compensat…

Can you comment on the part starting with

> What if an open source project is used directly by consumers, and causes them harm? The public policy is clear: they must be compensated.

It's expressly not clear what the implications here are, according to the article.

Re: Open source liability is coming

#67

Post by Kon-Peki »

galdor wrote: post #17
theLiminator wrote: post #3

This is ridiculous, all blame/liability should lie with either the provider of commercial software who chooses to rely on open source software or the end user for relying on free/open source software. I personally will not allow people in the EU to use any software I write going forward, I imagine other open source developers will take these steps as well.

It seems the author is refering to the EU Cybersecurity Act that should be voted early 2024. The last draft clearly excludes open source software as long as there is no commercial activity associated . If voted in this state, it won't affect the vast majority of developers releasing some code under an Open Source license. But it will wipe out all small businesses: if you're a solo company selling support or feature d…

> as long as there is no commercial activity associated

My recollection, from previous discussion on HN, is that the definition of "commercial activity" is far more broad than the open source community would like it to be. And by "open source community", I mean the people that run various foundations and non-profits and things like that.

I don't think that throwing up a virtual tip jar on your Github page counts, but offering paid support would. If you collect telemetry and then sell "usage insights" that would also count as commercial activity. Advertising on the download page is commercial activity. If you have a Patreon account? I actually don't know about that. Anyone know?

Re: Open source liability is coming

#68

Post by d_tr »

withinboredom wrote: post #27
sevagh wrote: post #21

Earlier quoted context omitted.

Npm Inc. is the only party liable for left-pad.

NPM wasn't the one who pushed the "delete project" button, knowing full well what would happen.

You knew all this before you decided to use it. Next time make better calls instead of blindly pulling shit like an idiot.

Re: Open source liability is coming

#69

Post by jalk »

Mountain_Skies wrote: post #42

Hopefully this will change attitudes in application security. Developers often try to ignore vulnerabilities found in the libraries they used, coming from the POV of "well, that's not my code so it's not my fault" instead of "we chose that library so we're responsible for any vulnerabilities it creates for the company". If you're going to use FOSS and don't do anything to correct or mitigate the vulnerabilities in th…

I have never ever met at dev with that attitude. I've seen managers trying to postpone fixes, because they naively thought there was little chance it would be discovered by hackers. A quick tour of Shodan, logs of SSH access attempts and access logs with the various script-kiddy attempts, usually convince that type of manager to prioritize hardening

Re: Open source liability is coming

#70

Post by zitterbewegung »

sevagh wrote: post #60
rebeccaskinner wrote: post #47

Earlier quoted context omitted.

I think that this part of it could break either way, but the concern is that when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. If so, that would be a net harm to open source and user freedom. I'm not sure it'll happen, but it might. The biggest issue I see with this law is around liability for open source projects…

> >>> when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. All those coding jobs lost to AI will be regained when everything needs to be reinvented in-house.

Whenever there is some kind of innovation like AI that makes people think that their jobs will go away the easy response is that there will always be someone that can’t figure how to get it to work and skills just start to shift to that like prompt engineering or vector databases.
Post reply on HN