Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source liability is coming

developersalliance.org

Post reply on HN
Print view View original

161–170 of 239 posts

Re: Open source liability is coming

#161

Post by flir »

cryptonector wrote: post #146
flir wrote: post #65

Earlier quoted context omitted.

Hmm. They can probably find other companies willing to sell them support contracts, and take on that liability. Even for things that are open source. You're back to the old enterprise software model then, really, even if the code in question is "officially" open source. You won't be able to run versions that your supplier hasn't certified, and the rate of change will slow to a crawl.

No, they can't. Paying for all code by paying employees or paying third parties is still paying for all code. That's not feasible. The EU regulators are simply nuts.

The hypothetical company that warranties log4js is selling many of those contracts, but only doing the authentication work once for each release.

Re: Open source liability is coming

#162

Post by treprinum »

fipar wrote: post #73
sevagh wrote: post #50

Earlier quoted context omitted.

Actually, I may have missed buried lede in this case where there is no company B, and citizen C is harmed by dev A's github project. That is actually kinda concerning, if my MIT license of "no guarantee" won't protect me. Other commenters who got it: https://news.ycombinator.com/item?id=38808821 https://news.ycombinator.com/item?id=38808756

That is concerning, but I think the author’s interpretation of the upcoming regulation may be wrong. See here for example: https://www.euractiv.com/section/digital/news/eu-updates-pro... Specifically: “The Directive will not apply to free and open-source software developed or supplied outside a commercial activity. The liability rules apply when the software is supplied in exchange for a price or personal data used f…

Basically EU will treat open source devs as idiots by preventing them from making living off it. And you feel that's fine?

Re: Open source liability is coming

#163

Post by treprinum »

bpfrh wrote: post #95
ctoth wrote: post #48

I use an open source screen reader, NVDA. It is completely open, and they produce an installer for people or you can build it yourself from Git. Can you help me understand now, if there is a bug in NVDA (which is under the GPL) and it causes me trouble, say, it can't read a webpage that I need for some government thing, I could now sue my screen reader, which is actually just a bunch of dudes hacking something togeth…

You can't. Product liability excludes non commercial open source software, see: https://www.europarl.europa.eu/news/de/press-room/20231205IP...

So basically open source devs can't make living off their work because some clueless EU regulator sees no other way? This is super heavy-handed and makes no sense outside ancient uncompetitive EU tech conglomerates trying to protect their turfs.

Re: Open source liability is coming

#164

Post by warkdarrior »

treprinum wrote: post #162
fipar wrote: post #73

Earlier quoted context omitted.

That is concerning, but I think the author’s interpretation of the upcoming regulation may be wrong. See here for example: https://www.euractiv.com/section/digital/news/eu-updates-pro... Specifically: “The Directive will not apply to free and open-source software developed or supplied outside a commercial activity. The liability rules apply when the software is supplied in exchange for a price or personal data used f…

Basically EU will treat open source devs as idiots by preventing them from making living off it. And you feel that's fine?

If open source devs make a living off it by charging users for money (or PII), the devs should be liable for the code they are selling. It does not matter if it is open source. Whoever makes a commercial offering based on that software must be liable.

Re: Open source liability is coming

#165

Post by fipar »

treprinum wrote: post #162
fipar wrote: post #73

Earlier quoted context omitted.

That is concerning, but I think the author’s interpretation of the upcoming regulation may be wrong. See here for example: https://www.euractiv.com/section/digital/news/eu-updates-pro... Specifically: “The Directive will not apply to free and open-source software developed or supplied outside a commercial activity. The liability rules apply when the software is supplied in exchange for a price or personal data used f…

Basically EU will treat open source devs as idiots by preventing them from making living off it. And you feel that's fine?

I have no idea how you interpret it this way.

How does being liable for damages caused by software or services you sell equate to being an idiot? I just see it as the normal way to do business, and the reason why limited liability (the way I’ve been doing business for more than 2 decades) exists.

Re: Open source liability is coming

#166

Post by fipar »

dqv wrote: post #114
fipar wrote: post #73

Earlier quoted context omitted.

That is concerning, but I think the author’s interpretation of the upcoming regulation may be wrong. See here for example: https://www.euractiv.com/section/digital/news/eu-updates-pro... Specifically: “The Directive will not apply to free and open-source software developed or supplied outside a commercial activity. The liability rules apply when the software is supplied in exchange for a price or personal data used f…

Why none of these articles (neither TFA nor the one you're linking) link to the actual directive is beyond me. But here it is: https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/7393... > With the aim of not hampering innovation: (i) free and open-source software developed or supplied outside the course of commercial activity, as well as (ii) the source code of software, should be excluded from the definition of…

Thanks for linking to the actual directive!

In light of it, I think the article I found didn’t link to it out of sloppiness, because their summary seems reasonably accurate to me, and the fine article didn’t link to it because they want to spread FUD, as the text you quoted directly contradicts some of the fear mongering in the original article.

Re: Open source liability is coming

#167

Post by warkdarrior »

grumps wrote: post #152
TheBigRoomXXL wrote: post #75

This is great. Software is important, software has an impact, and so we need liability. This regulation ensures that whoever sells the software to the consumer is responsible, and that's the way it should be. The creator of a library doesn't know how his library will be used in the wild, he can't anticipate all possible problems, the product maker can. It is the product maker's responsibility to integrate external co…

please provide a link to all your software, so I can find bugs and then sue you for everything you have.

Please provide receipts or contracts showing you purchased said software from them, before you can sue.

Re: Open source liability is coming

#168

Post by warkdarrior »

treprinum wrote: post #163
bpfrh wrote: post #95

Earlier quoted context omitted.

You can't. Product liability excludes non commercial open source software, see: https://www.europarl.europa.eu/news/de/press-room/20231205IP...

So basically open source devs can't make living off their work because some clueless EU regulator sees no other way? This is super heavy-handed and makes no sense outside ancient uncompetitive EU tech conglomerates trying to protect their turfs.

If the open source devs charge for their software, they should have the balls to accept the liability for whatever they are selling.

Re: Open source liability is coming

#169

Post by moses-palmer »

grumps wrote: post #154
sevagh wrote: post #14

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so har…

How in the world is this good for devs? It's terrible. Do you really think that "big corp" will not figure out how to pass the liability directly to the author? What will happen the opensource world once you're held liable for some moron who uses some software I wrote for myself? or incorrectly uses it? do you really believe the curl should be held liable because some POST failed and a user lost something over it? wh…

I read the article twice, because the link title made me think that I as an open source contributor and publisher liable for complaints.

My reading of the text is that the one actually selling the software product is the one having to abide by this law. Am I incorrect?

How could this be negative? I presume that most publishers of open source software would prefer that some Silicon Valley Unicorn did _not_ half-heartedly integrate their library, causing security issues and tainting their library name?

Post reply on HN