Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source liability is coming

developersalliance.org

Post reply on HN
Print view View original

141–150 of 239 posts

Re: Open source liability is coming

#141

Post by tester89 »

pylua wrote: post #105
TheBigRoomXXL wrote: post #88

Earlier quoted context omitted.

No you are not liable. Liability is linked to a commercial activity because it is meant to protect consumers. The article is very ambiguous in the way it describes the regulation. I recommended this one for more clarity : https://www.euractiv.com/section/digital/news/eu-updates-pro...

Would windows or whatever host operating system be liable potentially for the programs running on it even if they are open sourced programs?

I would think they would be *if* said program was included with the system, which makes sense. The manufacturer cannot be responsible for user-supplied programs, but they surely must know what they include with their system upon install.

Re: Open source liability is coming

#142

Post by cuu508 »

pylua wrote: post #119
cuu508 wrote: post #113

Earlier quoted context omitted.

What specific scenario are you thinking of? Who is trying to prove what?

Anything? I tried to send money to someone but the button did not debounce the request and I ended up with more than one payment ?

Ah, OK, so the end user is trying to prove there is a hard-to-reproduce fault in the software. I do not know how this is being handled in practice, but I think it would be reasonable to require evidence.

Re: Open source liability is coming

#143

Post by bpfrh »

friend_and_foe wrote: post #128
bpfrh wrote: post #109

Earlier quoted context omitted.

Maybe the article but the EU explicitly says opensource free of charge software is fine. https://www.europarl.europa.eu/news/de/press-room/20231205IP...

What if its free of charge but I'm rattling a tin can? Is that "thanks for making my life better free of charge, buy yourself a beer" or is it "here's a quarter in exchange for 100% insurance covering anything I use this free thing you made for"?

As far as I understood it it would be ok to have a option for donating.

But I have no real basis for that, I would assume that based kickstarter and co also getting money from consumers without having to abide by any consumer rights.

I assume that the option of donating while keeping the software available free of charge would fall under the same category as getting gifts from strangers

Contrary getting displaying ads directly in the app would fall under commercial activity because you force the user of the app to give you money(via an ad provider)

Re: Open source liability is coming

#144

Post by friend_and_foe »

bpfrh wrote: post #143
friend_and_foe wrote: post #128

Earlier quoted context omitted.

What if its free of charge but I'm rattling a tin can? Is that "thanks for making my life better free of charge, buy yourself a beer" or is it "here's a quarter in exchange for 100% insurance covering anything I use this free thing you made for"?

As far as I understood it it would be ok to have a option for donating. But I have no real basis for that, I would assume that based kickstarter and co also getting money from consumers without having to abide by any consumer rights. I assume that the option of donating while keeping the software available free of charge would fall under the same category as getting gifts from strangers Contrary getting displaying ad…

There's so many more things that are ambiguous.

If I give away the software but sell support, am I only liable to customers or to everyone? Similarly, if I let people opt in to commercialization of their data, am I liable to those that opt out? Does someone signing a terms of service qualify as commercial activity?

If I fork something and give it away can I sue the person I forked it from? If I tell people "YOU ARE NOT ALLOWED TO USE THIS BUT YOU CAN FORK IT" am I liable if they ignore me? Does a fork qualify as a new product or is the original author liable?

Re: Open source liability is coming

#145

Post by tomkarho »

This article reminds of Daniel Stenberg (the developer of curl) and the emails I recall seeing him display on occasion that think he is responsible for them being hacked etc. because someone (everyoneish) bakes curl into their tools.

I wonder if this new legislation might muddy the waters as to whether people like him might actually get sued for the software they provide to the world?

Even if the legalese doesn't actually support the notion that this could happen, we won't know for sure until someone puts it to the test. Which means someone needs to get sued so the actual law is tested in a courtroom. A chilling effect for any developer who doesn't have big money backing them. The risk of getting sued or even the very notion of it might just be too great to risk it and not worth the hassle for majority of people.

Re: Open source liability is coming

#146

Post by cryptonector »

flir wrote: post #65
lifeisstillgood wrote: post #51

Earlier quoted context omitted.

>>> when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. Not even FAANG can achieve this for 1/10th of the code they rely on.

Hmm. They can probably find other companies willing to sell them support contracts, and take on that liability. Even for things that are open source. You're back to the old enterprise software model then, really, even if the code in question is "officially" open source. You won't be able to run versions that your supplier hasn't certified, and the rate of change will slow to a crawl.

No, they can't. Paying for all code by paying employees or paying third parties is still paying for all code. That's not feasible. The EU regulators are simply nuts.

Re: Open source liability is coming

#147

Post by sgt101 »

orwin wrote: post #117
orangea wrote: post #85

Earlier quoted context omitted.

> If you use open source you are accepting the license that says that there is no liability. The article directly contradicts this: > What if an open source project is used directly by consumers, and causes them harm? The public policy is clear: they must be compensated. Does it matter if they signed a license or didn’t pay someone? Their business is bankrupt, their files are in a hacker’s hands, or their own custome…

The article is wrong. It is only the case if the consumers are paying a commercial license or are monetized via ads or tracking.

fair enough

Re: Open source liability is coming

#148

Post by cryptonector »

RamblingCTO wrote: post #39

The article leans a bit towards a pessimistic tone imho, so here's another source: https://www-heise-de.translate.goog/news/EU-Regulierung-Ausn... Apparently the current state of affairs is that open source (non-commercial!) devs and projects are safe. If you pack OSS as part of a commercial offering, you're on the hook for that as well (read: you're liable for the whole product you sell and can't put off some aspect…

I.e., TFA is just FUD.

Re: Open source liability is coming

#149

Post by bpfrh »

friend_and_foe wrote: post #144
bpfrh wrote: post #143

Earlier quoted context omitted.

As far as I understood it it would be ok to have a option for donating. But I have no real basis for that, I would assume that based kickstarter and co also getting money from consumers without having to abide by any consumer rights. I assume that the option of donating while keeping the software available free of charge would fall under the same category as getting gifts from strangers Contrary getting displaying ad…

There's so many more things that are ambiguous. If I give away the software but sell support, am I only liable to customers or to everyone? Similarly, if I let people opt in to commercialization of their data, am I liable to those that opt out? Does someone signing a terms of service qualify as commercial activity? If I fork something and give it away can I sue the person I forked it from? If I tell people "YOU ARE N…

I don't think that is ambitious:

With the aim of not hampering innovation: (i) free and open-source software developed or supplied outside the course of commercial activity[1]

You are only in a commercial activity if you sell that product to that customer or you sold it to a distributor who then sold it to a customer.

E.g. if a customer doesn't buy from you he has no commercial activity with you so no liability.

I would argue that code is code and only becomes a non fungible product in the instance of selling it and only then the laws apply

[1]https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/7393... => page 5 under the light gray box

Edit: fixed italics

Re: Open source liability is coming

#150

Post by cryptonector »

TFA is just a bunch of FUD. Non-commercial open source developers will be liable for nothing, and commercial software developers will be liable, and that liability will include their use of external open source, so what? Pretty much every bit of commercial software uses some external open source, and so what, using external open source does mean that one has to be able to deal with issues arising from that use. For example, even w/o liability if there's some bug in some external open source library that you use, you may have to spend time chasing it down and upgrading or contributing a fix, or locally patching the issue, etc. -- you used that external open source because it saved you time and money (but I repeat myself) and you took on some liability even before any jurisdictions might force you to take on even more liability. That's just normal. The calculus will almost certainly still be that using external open source is better and cheaper than writing your own bloat in-house, but you might need to do a bit more due diligence in picking better, safer external open source.

https://www.europarl.europa.eu/news/de/press-room/20231205IP...

Post reply on HN