Open source liability is coming • Hacker News Board

Re: Open source liability is coming

#191

Post by treprinum » Sat, Dec 30, 2023, 1:18 AM UTC

TheBigRoomXXL wrote: post #177

treprinum wrote: post #163

Earlier quoted context omitted.

So basically open source devs can't make living off their work because some clueless EU regulator sees no other way? This is super heavy-handed and makes no sense outside ancient uncompetitive EU tech conglomerates trying to protect their turfs.

Be liable doesn't only mean that if the software you sold *harm* people then they can sue you. It doesn't mean they can sue you for every little bug. So yes if you sell software, whether it is open source or not, you better have the balls to be liable.

"Harm" can over time mean your software was used to view non-approved content etc. Slippery slope...

Re: Open source liability is coming

#192

Post by olliej » Sat, Dec 30, 2023, 1:19 AM UTC

warkdarrior wrote: post #168

treprinum wrote: post #163

Earlier quoted context omitted.

So basically open source devs can't make living off their work because some clueless EU regulator sees no other way? This is super heavy-handed and makes no sense outside ancient uncompetitive EU tech conglomerates trying to protect their turfs.

If the open source devs charge for their software, they should have the balls to accept the liability for whatever they are selling.

Like having a Patreon or similar sponsorship? Sounds like a recipe for licenses that say "you are not permitted to use this software if a bug could cause you any harm"

Re: Open source liability is coming

#193

Post by treprinum » Sat, Dec 30, 2023, 1:20 AM UTC

fipar wrote: post #165

treprinum wrote: post #162

Earlier quoted context omitted.

Basically EU will treat open source devs as idiots by preventing them from making living off it. And you feel that's fine?

I have no idea how you interpret it this way. How does being liable for damages caused by software or services you sell equate to being an idiot? I just see it as the normal way to do business, and the reason why limited liability (the way I’ve been doing business for more than 2 decades) exists.

Example: I will make a library controlling some integrated circuit as open source and charge money for commercial use. My software has a little bug that occasionally causes misreading of the IC values. A military software company uses my open source library in their nuke platform. My library misreads values on one nuke that goes off. Are you telling me I am going to be liable for that? Let's say independent multi-pass root cause analysis pinpointed the problem to my library and only to my library.

Re: Open source liability is coming

#194

Post by treprinum » Sat, Dec 30, 2023, 1:22 AM UTC

CrLf wrote: post #186

treprinum wrote: post #158

Earlier quoted context omitted.

Maybe ask yourself how is EU going to pay for all that if it misses on all trends in the industry and over-regulating anything that could be the next growth factor.

Doesn't seem to be working too bad so far.

I must be living in another world then. GDP of EU is stagnant since 2008 whereas US and Chinese GDP exploded during that time. Ultimately whoever has the most money is going to win so let's not try to redefine economical indicators and say that GDP is no longer relevant etc.

Re: Open source liability is coming

#195

Post by jahav » Sat, Dec 30, 2023, 1:24 AM UTC

Mountain_Skies wrote: post #42

Hopefully this will change attitudes in application security. Developers often try to ignore vulnerabilities found in the libraries they used, coming from the POV of "well, that's not my code so it's not my fault" instead of "we chose that library so we're responsible for any vulnerabilities it creates for the company". If you're going to use FOSS and don't do anything to correct or mitigate the vulnerabilities in th…

That is already part of CRA:

> It is of particular importance for manufacturers to ensure that their products do not contain vulnerable components developed by third parties.

> Manufacturers shall, upon identifying a vulnerability in a component, including in an open source component, which is integrated in the product with digital elements, report the vulnerability to the person or entity maintaining the component.

EDIT: Also, I concur the poster below. It's developers who oppose against management to allocate time for bugs and technical debt instead of new features.

Re: Open source liability is coming

#196

Post by erik_seaberg » Sat, Dec 30, 2023, 1:29 AM UTC

campbellcole wrote: post #181

treprinum wrote: post #175

Earlier quoted context omitted.

Really? Why? Just because somebody wants to regulate software? For what reason?

For the same reason literally every other industry does. You are forgetting that software is unique in not having these regulations. It’s not hard to figure out what life was like before these laws, and we don’t want history repeating itself on a platform that moves at light speed.

Software is also unusual in being invented from scratch in living memory. Nobody knows how to do this flawlessly yet, and the few serious attempts (e.g., seL4) have taken stunning levels of time and effort.

In 1350, people were dying of the plague, and doctors didn’t know how to treat them. That sucks, but medicine wouldn’t exist if they couldn’t have kept trying and failing. That’s where we are.

Re: Open source liability is coming

#197

Post by mnau » Sat, Dec 30, 2023, 1:39 AM UTC

treprinum wrote: post #194

CrLf wrote: post #186

Earlier quoted context omitted.

Doesn't seem to be working too bad so far.

I must be living in another world then. GDP of EU is stagnant since 2008 whereas US and Chinese GDP exploded during that time. Ultimately whoever has the most money is going to win so let's not try to redefine economical indicators and say that GDP is no longer relevant etc.

As a member of eastern EU block, I sometimes look at avg. salary in China (114029.00 CNY/Year per [tradingeconomics](https://tradingeconomics.com/china/wages)) and wonder when will they earn more (though the wages are basically incomparable due to different taxes). It won't take a long time.

15% inflation in 2022 was fun, 11% in 2023 even more fun.

Re: Open source liability is coming

#198

Post by mnau » Sat, Dec 30, 2023, 1:52 AM UTC

olliej wrote: post #188

Here's the problem as I see it: * Person A makes OSS project P * Organisation/Person B uses P * A vulnerability in P causes financial harm to B Is person A now liable under this law? What happens if person A has a Patreon or GitHub sponsor page? The latter seems to imply you're being paid for development and so this is now a commercial project? Or is the requirement that the end user directly pays for the product? In…

Go to the source: https://single-market-economy.ec.europa.eu/system/files/2022...

> In order not to hamper innovation or research, this Directive should not apply to free and open-source software developed or supplied outside the course of a commercial activity. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. However where software is supplied in exchange for a price or personal data is used other than exclusively for improving the security, compatibility or interoperability of the software, and is therefore supplied in the course of a commercial activity, the Directive should apply

Wheather sponsors/patreon means "outside the course of a commercial activity" would likely be for courts to decide. It could mean that you only work on something that is "sponsored"... yeah, that would likely be covered. Getting few euros with no obligations hopefully not. But ultimately, it's a chilling effect, until some court decides.

Re: Open source liability is coming

#199

Post by mistrial9 » Sat, Dec 30, 2023, 2:00 AM UTC

jahav wrote: post #185

mistrial9 wrote: post #176

Earlier quoted context omitted.

> Alternatively, repackaging existing OSS as a commercial product while only adding some legal liability as an add-on might become a viable business. bingo

It's called tidelift.com

this looks interesting https://www.bestpractices.dev/en

... from a longer transcript here https://www.infoq.com/presentations/security-supply-chain-os...

Re: Open source liability is coming

#200

Post by treprinum » Sat, Dec 30, 2023, 2:13 AM UTC

mnau wrote: post #197

treprinum wrote: post #194

Earlier quoted context omitted.

I must be living in another world then. GDP of EU is stagnant since 2008 whereas US and Chinese GDP exploded during that time. Ultimately whoever has the most money is going to win so let's not try to redefine economical indicators and say that GDP is no longer relevant etc.

As a member of eastern EU block, I sometimes look at avg. salary in China (114029.00 CNY/Year per [tradingeconomics]( https://tradingeconomics.com/china/wages )) and wonder when will they earn more (though the wages are basically incomparable due to different taxes). It won't take a long time. 15% inflation in 2022 was fun, 11% in 2023 even more fun.

AFAIK Chinese workers are already more expensive than eastern EU ones (but tight logistic integration makes the overall manufacturing cheaper) and so are Indian devs in India already more expensive than eastern EU devs. "Prosperity"