Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source liability is coming

developersalliance.org

Post reply on HN
Print view View original

181–190 of 239 posts

Re: Open source liability is coming

#181

Post by campbellcole »

treprinum wrote: post #175
warkdarrior wrote: post #168

Earlier quoted context omitted.

If the open source devs charge for their software, they should have the balls to accept the liability for whatever they are selling.

Really? Why? Just because somebody wants to regulate software? For what reason?

For the same reason literally every other industry does. You are forgetting that software is unique in not having these regulations. It’s not hard to figure out what life was like before these laws, and we don’t want history repeating itself on a platform that moves at light speed.

Re: Open source liability is coming

#182

Post by [deleted] »

TheBigRoomXXL wrote: post #177
treprinum wrote: post #163

Earlier quoted context omitted.

So basically open source devs can't make living off their work because some clueless EU regulator sees no other way? This is super heavy-handed and makes no sense outside ancient uncompetitive EU tech conglomerates trying to protect their turfs.

Be liable doesn't only mean that if the software you sold *harm* people then they can sue you. It doesn't mean they can sue you for every little bug. So yes if you sell software, whether it is open source or not, you better have the balls to be liable.

[deleted]

Re: Open source liability is coming

#183

Post by ImmutiableTruth »

mlinksva wrote: post #151
hutzlibu wrote: post #72

Earlier quoted context omitted.

Maybe, but maybe the legislation also is: "What if an open source project is used directly by consumers, and causes them harm? The public policy is clear: they must be compensated. Does it matter if they signed a license or didn’t pay someone? Their business is bankrupt, their files are in a hacker’s hands, or their own customers are suing them. Someone should be strictly liable. But who? The EU is grappling with tha…

The CRA is not about liability or consumer compensation. The remedies for non-compliance are fines or removal of a product from the EU market. The forthcoming update of the Product Liability Directive, which will probably take a similar approach (exempting open source unless it is placed on the market, so as the article describes, developers of products that are placed on the market are responsible for the security o…

[flagged]

Re: Open source liability is coming

#184

Post by ImmutiableTruth »

andrew_eu wrote: post #90

The article got me a bit worried about the idea of developing software out in the open, and the comments in this thread give me conflicting ideas. If I make a public repository `ComputerCleaner` with a single file: #!/usr/bin/env bash # rm -rf / Should I soon expect to be defending legal threats from random strangers who ran this code only to gasp find that it deleted their files?

> Should I soon expect to be defending legal threats from random strangers who ran this code only to gasp find that it deleted their files?

Yes. The developers of software have a fiduciary duty to users of their software.

The UK court of appeals already determined that the MIT license does not eliminate these duties when it found the authors of Bitcoin Core liable for billions of pounds of damages to Satoshi Nakamoto when they failed to change the Bitcoin protocol to return the coins that hackers took from him.

If you don't want to get sued and end up homeless and bankrupt like those Bitcoin Core developers you need to learn to obey the law and act in the best interest of your user.

Re: Open source liability is coming

#185

Post by jahav »

mistrial9 wrote: post #176
zoogeny wrote: post #133

Earlier quoted context omitted.

> This seems to me like unequivocally a good thing for open-source devs. I'm not certain the second order (or later) effects will necessarily be unequivocally good. Software supply chains are more like a double pendulum in that changes are probably chaotic enough to obscure their effects. For example, my very first thought was that large businesses are generally risk adverse specifically in the realm of liability. Ha…

> Alternatively, repackaging existing OSS as a commercial product while only adding some legal liability as an add-on might become a viable business. bingo

It's called tidelift.com

Re: Open source liability is coming

#186

Post by CrLf »

treprinum wrote: post #158
CrLf wrote: post #40

Earlier quoted context omitted.

It may be difficult to understand, but maybe the EU has other things where they want to be competitive instead? Maybe, I don't know, quality of life...? Please stop measuring the EU using US standards.

Maybe ask yourself how is EU going to pay for all that if it misses on all trends in the industry and over-regulating anything that could be the next growth factor.

Doesn't seem to be working too bad so far.

Re: Open source liability is coming

#187

Post by ImmutiableTruth »

paulgb wrote: post #9
withinboredom wrote: post #5

FINALLY. This industry needs some regulation... I'm mostly curious what that means for something like the MIT license... For those who need a refresher, this is the part I mean. > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYR…

> This industry needs some regulation Are there cases of open source projects being careless or negligent that have caused harm that this would address? Aside from some unintentional vulnerabilities that have been found, it’s hard for me to think of an example that would necessitate more regulation.

[flagged]

Re: Open source liability is coming

#188

Post by olliej »

Here's the problem as I see it:

* Person A makes OSS project P

* Organisation/Person B uses P

* A vulnerability in P causes financial harm to B

Is person A now liable under this law? What happens if person A has a Patreon or GitHub sponsor page? The latter seems to imply you're being paid for development and so this is now a commercial project?

Or is the requirement that the end user directly pays for the product? In that case this directive would not cover a variety of large objectively commercial products: Chrome, Slack, Java, arguably macOS and iOS (because you get new versions for "free" so the software is "free", right? Apple makes a point of stating its products are the hardware), etc - hence you can't say the "commercial" restriction requires money being exchanged directly for the software, but that gets you back to "does a Patreon, GitHub sponsor, etc mean you're now a commercial developer?"

Again the problem here is the ambiguity, and the massive disparity between revenue and liability. If you make a few hundred (or even a few thousand) a year from sponsorship should you be subject to massive liability because a huge organisation, or a large number of different organizations pick up your project, you could now be liable due to damages the organizations are subject to.

There's a lot of focus in these threads on "company uses your OSS project in products they sell and a a bug impacts their customers" rather than "company uses your OSS project, and a bug causes the company itself harm", e.g. the company is now the end user. To make it even more direct, what would happen if (as some companies do) the companies provide "sponsorships"(or whatever) for the OSS project development, now the company is the end user and they're paying for development and that sounds pretty "commercial".

But also this legislation completely undermines all OSS licenses as they all say the software is distributed without liability or warrantee. The liability restriction is completely neutered, so now contributing to any OSS project requires you to be able to afford a lawyer to determine whether you can do so without acquiring boundless liability, which seems like a sure fire way to immediately price-out the overwhelming majority of OSS contributors from ever contributing to any OSS projects.

[addendum] One other follow on from this would be that if you do have any sponsorship mechanism it would seem you're now liable for bugs in code submitted from other people unless you're paying every contributor for their contributions, specifically to transfer liability. If you don't do that you're acquiring liability for code written by others.

Re: Open source liability is coming

#189

Post by olliej »

monooso wrote: post #25

There seems to be some confusion in the comments regarding what this means for people releasing open source software. The article makes it clear that (as the author understands it, at least) someone who uses open source software in their commercial product is liable; the people who wrote the open source code [1] are not. > If a user is harmed by software, the person they paid (targeted ads would count) must compensat…

If you have any kind of Patreon, GitHub sponsorship, buy me a coffee, or anything to "support development" it would seem you have met the requirement of being a commercial developer who should be liable.

Re: Open source liability is coming

#190

Post by treprinum »

campbellcole wrote: post #181
treprinum wrote: post #175

Earlier quoted context omitted.

Really? Why? Just because somebody wants to regulate software? For what reason?

For the same reason literally every other industry does. You are forgetting that software is unique in not having these regulations. It’s not hard to figure out what life was like before these laws, and we don’t want history repeating itself on a platform that moves at light speed.

Why should a completely different industry be bent the same way legacy industry operates? Why does it have to be so? It makes little sense outside being "regulatory capture" of sorts for established players and a money maker for auditing companies.
Post reply on HN