Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source liability is coming

developersalliance.org

Post reply on HN
Print view View original

171–180 of 239 posts

Re: Open source liability is coming

#171

Post by hcrean »

withinboredom wrote: post #15
paulgb wrote: post #9

Earlier quoted context omitted.

> This industry needs some regulation Are there cases of open source projects being careless or negligent that have caused harm that this would address? Aside from some unintentional vulnerabilities that have been found, it’s hard for me to think of an example that would necessitate more regulation.

I can think of exactly one rather popular one: left-pad. The author should have been liable for the damage they caused. The industry self-regulated itself but that is a case that I can think of, specifically caused by negligence.

Left-pad is a very good case study.

For most of my early career (Security focused), companies would download copies of packages for use, they would go through a rigorous security scanning and vulnerability management processes before being included into a whitelist of internally approved tooling for product dev. Licensing, regulatory compliance and international involvement in dependencies was reviewed at this stage.

In this type of environment, which is very good from a security perspective, it would be virtually impossible for the Left-pad removal to have the impact that it did. So the problem as I see it is not that the author of Left-pad did a naughty thing (he was well within his rights given the 'why' of it all), the problem is that generations of developers have been successfully trained to believe that all their assurance work has just magically been done for them: In many cases the modern ecosystems make it virtually impossible for them to verify and control packages themselves.

Re: Open source liability is coming

#172

Post by kragen »

mlinksva wrote: post #151
hutzlibu wrote: post #72

Earlier quoted context omitted.

Maybe, but maybe the legislation also is: "What if an open source project is used directly by consumers, and causes them harm? The public policy is clear: they must be compensated. Does it matter if they signed a license or didn’t pay someone? Their business is bankrupt, their files are in a hacker’s hands, or their own customers are suing them. Someone should be strictly liable. But who? The EU is grappling with tha…

The CRA is not about liability or consumer compensation. The remedies for non-compliance are fines or removal of a product from the EU market. The forthcoming update of the Product Liability Directive, which will probably take a similar approach (exempting open source unless it is placed on the market, so as the article describes, developers of products that are placed on the market are responsible for the security o…

as i understand it, the problem with some of the previous drafts of the produt liability directive was that by making a commercial product open-source, you could become liable for how random people who weren't paying you used it

consider ghostscript, for example, which is open-source and a commercial product from artifex. the license terms are such that you generally only have to pay for it if you're embedding it in a printer, which many manufacturers do. but virtually every gnu/linux box has it installed without needing to pay for a license. suppose a security vulnerability in ghostscript (of which there have been a number) allows an attacker to own a million ubuntu machines and inject ransomware into thousands of companies in the eu who have no relationship with either the ubuntu company or with artifex

as i understand it, previous drafts of the product liability directive would have made artifex liable for damages in this situation, creating a strong incentive against making any commercial software open-source. do we know this cra avoids making artifex liable for fines? it seems that liability for fines would create the same kinds of incentives

has this been fixed?

as you likely know, i think a necessary and nearly sufficient step to solving the iot security problems is requiring the firmware to be open-source so that consumers can update it whether the manufacturer wants to or not

Re: Open source liability is coming

#173

Post by eggsboenk »

dqv wrote: post #114
fipar wrote: post #73

Earlier quoted context omitted.

That is concerning, but I think the author’s interpretation of the upcoming regulation may be wrong. See here for example: https://www.euractiv.com/section/digital/news/eu-updates-pro... Specifically: “The Directive will not apply to free and open-source software developed or supplied outside a commercial activity. The liability rules apply when the software is supplied in exchange for a price or personal data used f…

Why none of these articles (neither TFA nor the one you're linking) link to the actual directive is beyond me. But here it is: https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/7393... > With the aim of not hampering innovation: (i) free and open-source software developed or supplied outside the course of commercial activity, as well as (ii) the source code of software, should be excluded from the definition of…

Still not clear for me. What about a company open sourcing some libraries used in its product. Will it be liable? Or would this be 'supplied outside the course of commercial activity'

Re: Open source liability is coming

#174

Post by TheBigRoomXXL »

grumps wrote: post #152
TheBigRoomXXL wrote: post #75

This is great. Software is important, software has an impact, and so we need liability. This regulation ensures that whoever sells the software to the consumer is responsible, and that's the way it should be. The creator of a library doesn't know how his library will be used in the wild, he can't anticipate all possible problems, the product maker can. It is the product maker's responsibility to integrate external co…

please provide a link to all your software, so I can find bugs and then sue you for everything you have.

You couldn't sue me for 2 reasons:

1 - This regulation only concerns commercial activity. So you could only sue the company I work for, and only if you've bought their products. Also by definition that excludes my personal projects.

2 - You can only sue for defects (in this legal context it means unsafe to use) or damage (physical or material). You can't sue for simple bugs.

These kinds of liabilities already exist for all the objects in your life and yet you don't spend your time suing people every time something does not work as expected I imagine

Re: Open source liability is coming

#175

Post by treprinum »

warkdarrior wrote: post #168
treprinum wrote: post #163

Earlier quoted context omitted.

So basically open source devs can't make living off their work because some clueless EU regulator sees no other way? This is super heavy-handed and makes no sense outside ancient uncompetitive EU tech conglomerates trying to protect their turfs.

If the open source devs charge for their software, they should have the balls to accept the liability for whatever they are selling.

Really? Why? Just because somebody wants to regulate software? For what reason?

Re: Open source liability is coming

#176

Post by mistrial9 »

zoogeny wrote: post #133
sevagh wrote: post #14

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so har…

> This seems to me like unequivocally a good thing for open-source devs. I'm not certain the second order (or later) effects will necessarily be unequivocally good. Software supply chains are more like a double pendulum in that changes are probably chaotic enough to obscure their effects. For example, my very first thought was that large businesses are generally risk adverse specifically in the realm of liability. Ha…

> Alternatively, repackaging existing OSS as a commercial product while only adding some legal liability as an add-on might become a viable business.

bingo

Re: Open source liability is coming

#177

Post by TheBigRoomXXL »

treprinum wrote: post #163
bpfrh wrote: post #95

Earlier quoted context omitted.

You can't. Product liability excludes non commercial open source software, see: https://www.europarl.europa.eu/news/de/press-room/20231205IP...

So basically open source devs can't make living off their work because some clueless EU regulator sees no other way? This is super heavy-handed and makes no sense outside ancient uncompetitive EU tech conglomerates trying to protect their turfs.

Be liable doesn't only mean that if the software you sold *harm* people then they can sue you. It doesn't mean they can sue you for every little bug.

So yes if you sell software, whether it is open source or not, you better have the balls to be liable.

Re: Open source liability is coming

#178

Post by anonzzzies »

bjornsing wrote: post #127
anonzzzies wrote: post #34

Earlier quoted context omitted.

Also the EU laws are read here, by people who live in countries where that would be the case, with way too much weight. People from the US putting cookie accept banners and gdpr blah on their sites while they don't have to, because they are not violating in the first place (the intent of the gdpr is very simple; don't do things you don't want to have done to you to others; tracking, collecting info you don't need to…

Yea, the “pragmatic” EU approach to legislation: write it in draconian language and let it carry incredible sanctions (like millions of euros), but then just don’t enforce it. Unless you anger some bureaucrat of course.

They enforce it, just not against small companies as that is not the intent of these laws. You know, unlike pragmatic US legislation where you can fuck over anyone anytime over nothing valid.

Re: Open source liability is coming

#179

Post by rebeccaskinner »

jchw wrote: post #104
rebeccaskinner wrote: post #47

Earlier quoted context omitted.

I think that this part of it could break either way, but the concern is that when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. If so, that would be a net harm to open source and user freedom. I'm not sure it'll happen, but it might. The biggest issue I see with this law is around liability for open source projects…

I think I must be misunderstanding. The article makes it seem like the user of open source code is responsible for making sure it is suitable and they are liable for when it fails. Doesn't that mean that someone who merely releases code onto GitHub will, in fact, not be liable, since it is the user of said code that is liable? As far as > when faced with a choice between being liable for their own code or being liabl…

There are two issues here. The first is when there's some product that's being sold. It could be directly, like selling someone software, or indirectly, like selling them a device that includes software. In that case, whoever sold the thing is responsible for all of the software.

I think that's more-or-less fine. There's a concern that companies don't want to be responsible for open source code, and will write everything in-house instead. I wouldn't be surprised if some companies do that, even if it's a bad idea. I don't know how common it'll be, but the worst case scenario is that it turns out to be bad for developers and for free software.

The second, murkier issue, is what happens when there is no selling involved at all. If I download a debian iso, or clone some random repository on github, then there has been concern that the author of that code will be financially liable for any errors in the software. That would be very, very bad. Early versions of the law seem to explicitly say that it would be the case. More recent versions seem like they might have an exception so long as there is absolutely no money changing hands. It's unclear what would happen in cases where open source software accepts donations. It could still end up being harmful to individual developers and to open source software in general. It's hard to say.

Re: Open source liability is coming

#180

Post by ImmutiableTruth »

This is already true in the UK. The "open source" developers of Bitcoin Core were personally bankrupt with a multi-billion pound judgement because they refused to alter the protocol to allow Satoshi to recover coins a hacker took from him.

Developers have a duty of care to their users which no license can remove. You either make good software and comply with your duty or you will be ruined. That is the law.

Next year those Bitcoin developers will go to prison because the have not paid the billions they owe. Open source communism doesn't protect you from the law.

Post reply on HN