Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source liability is coming

developersalliance.org

Post reply on HN
Print view View original

201–210 of 239 posts

Re: Open source liability is coming

#201

Post by mlinksva »

kragen wrote: post #172
mlinksva wrote: post #151

Earlier quoted context omitted.

The CRA is not about liability or consumer compensation. The remedies for non-compliance are fines or removal of a product from the EU market. The forthcoming update of the Product Liability Directive, which will probably take a similar approach (exempting open source unless it is placed on the market, so as the article describes, developers of products that are placed on the market are responsible for the security o…

as i understand it, the problem with some of the previous drafts of the produt liability directive was that by making a commercial product open-source, you could become liable for how random people who weren't paying you used it consider ghostscript, for example, which is open-source and a commercial product from artifex. the license terms are such that you generally only have to pay for it if you're embedding it in…

Wish I could say for certain, but we'd need the final texts of the CRA and PLD, and EU lawyers, to say for sure. This is the sort of situation that the general aim of the EU policymakers seems to be to avoid what they'd see as loopholes, where a business is avoiding responsibility simply by making a product open source, and avoiding destroying open source. It's plausible, perhaps likely, that open source ghostscript would be exempt, but the one there's a transaction for (clearly being placed on the market -- that, rather than "commercial product" is the key concept) would surely not be. The same vulnerability might impact both, but the developer may only be responsible for the latter. It's possible under the CRA artifex could be considered (very late addition) the steward of the open source version, which was intended largely to cover (give some responsibility to) foundations, but without any real penalties -- but, we'll see.

I'm not surprised that's what you think. I'm doubtful anywhere close to sufficient, as much as I'd like that to be true. The focus of the CRA is of course to make the manufacturer be responsible, including for providing security updates for as long as the product is expected to be used (5 years or more typically). There probably is a weak recital suggesting manufacturers might make source code available to other undertakings so that they might provide security updates after the original manufactuerer's support period, but no enforcement of this, and explicitly not requiring open source. Seems like a potential area for future regulation to improve upon.

Re: Open source liability is coming

#202

Post by mark_unwin »

treprinum wrote: post #193
fipar wrote: post #165

Earlier quoted context omitted.

I have no idea how you interpret it this way. How does being liable for damages caused by software or services you sell equate to being an idiot? I just see it as the normal way to do business, and the reason why limited liability (the way I’ve been doing business for more than 2 decades) exists.

Example: I will make a library controlling some integrated circuit as open source and charge money for commercial use. My software has a little bug that occasionally causes misreading of the IC values. A military software company uses my open source library in their nuke platform. My library misreads values on one nuke that goes off. Are you telling me I am going to be liable for that? Let's say independent multi-pas…

My take would be that if the military company paid you for the commercial use right, then you have "sold" the software and yes you would be liable. If they used it in an open source compatible way (no actual license is stated), and did not pay you for it then no, you would not be liable.

Re: Open source liability is coming

#203

Post by fipar »

treprinum wrote: post #193
fipar wrote: post #165

Earlier quoted context omitted.

I have no idea how you interpret it this way. How does being liable for damages caused by software or services you sell equate to being an idiot? I just see it as the normal way to do business, and the reason why limited liability (the way I’ve been doing business for more than 2 decades) exists.

Example: I will make a library controlling some integrated circuit as open source and charge money for commercial use. My software has a little bug that occasionally causes misreading of the IC values. A military software company uses my open source library in their nuke platform. My library misreads values on one nuke that goes off. Are you telling me I am going to be liable for that? Let's say independent multi-pas…

If you did not sell the library to the military software company then no, it’s them whom are liable (assuming they did sell their software, that uses your library, to whomever had the nuke that went off) and not you.

IANAL but it seems clear cut to me: if you asked for money in exchange for your software (or to access to your software through an API or similar), or if you asked for personal information (in exchange for your software) then you’re liable, otherwise, you’re not.

Re: Open source liability is coming

#204

Post by grumps »

TheBigRoomXXL wrote: post #174
grumps wrote: post #152

Earlier quoted context omitted.

please provide a link to all your software, so I can find bugs and then sue you for everything you have.

You couldn't sue me for 2 reasons: 1 - This regulation only concerns commercial activity. So you could only sue the company I work for, and only if you've bought their products. Also by definition that excludes my personal projects. 2 - You can only sue for defects (in this legal context it means unsafe to use) or damage (physical or material). You can't sue for simple bugs. These kinds of liabilities already exist f…

A law and regulation is written one way and interpreted a different way by the courts. In the USA it's all about case law.

Hypothetical:

I write a nifty alarm clock app. To cover some costs I charge a nominal fee. Some unknown condition occurs a user misses a flight and loses their job.

According to your position I should be sued.

Why should I be held liable?

Daniel Stenberg has a blog post somewhere about all the hate mail he gets over the fact that curl is bundled in some software. You don't think some litigious person won't attempt to go after him over it?

My family has personally impacted by a dumb lawyer trying to subpoena information incorrectly. Dealing with this was 7k in lawyer fees, covered by an insurance policy. Technically he could legally held for this terrible usage of the courts but it would have been an even bigger mess.

Re: Open source liability is coming

#205

Post by treprinum »

mark_unwin wrote: post #202
treprinum wrote: post #193

Earlier quoted context omitted.

Example: I will make a library controlling some integrated circuit as open source and charge money for commercial use. My software has a little bug that occasionally causes misreading of the IC values. A military software company uses my open source library in their nuke platform. My library misreads values on one nuke that goes off. Are you telling me I am going to be liable for that? Let's say independent multi-pas…

My take would be that if the military company paid you for the commercial use right, then you have "sold" the software and yes you would be liable. If they used it in an open source compatible way (no actual license is stated), and did not pay you for it then no, you would not be liable.

So basically I have no say about how my library is going to be used once I sell a license to a company, and if its use by a 3rd party leads to e.g. a mass-casualty event due to a bug in my code, I am liable?

Re: Open source liability is coming

#206

Post by grumps »

warkdarrior wrote: post #167
grumps wrote: post #152

Earlier quoted context omitted.

please provide a link to all your software, so I can find bugs and then sue you for everything you have.

Please provide receipts or contracts showing you purchased said software from them, before you can sue.

https://daniel.haxx.se/blog/2023/11/26/you-have-hacked-into-...

He's got many other examples of emails he gets from people. They find his name or whatever in some apps attribution.

It doesn't matter if there's legal grounds or not. Someone and some lawyer will make your life hell. They don't understand software nor do they care. It will be horrifically stressful and potentially very expensive for someone.

Maybe it's better in the EU but the second the lawyers or the insurance companies get involved it will make everything awful.

Re: Open source liability is coming

#207

Post by grumps »

moses-palmer wrote: post #169
grumps wrote: post #154

Earlier quoted context omitted.

How in the world is this good for devs? It's terrible. Do you really think that "big corp" will not figure out how to pass the liability directly to the author? What will happen the opensource world once you're held liable for some moron who uses some software I wrote for myself? or incorrectly uses it? do you really believe the curl should be held liable because some POST failed and a user lost something over it? wh…

I read the article twice, because the link title made me think that I as an open source contributor and publisher liable for complaints. My reading of the text is that the one actually selling the software product is the one having to abide by this law. Am I incorrect? How could this be negative? I presume that most publishers of open source software would prefer that some Silicon Valley Unicorn did _not_ half-hearte…

Because lawyers and courts become involved. They don't understand software or anything related to it.

Re: Open source liability is coming

#208

Post by olliej »

mnau wrote: post #198
olliej wrote: post #188

Here's the problem as I see it: * Person A makes OSS project P * Organisation/Person B uses P * A vulnerability in P causes financial harm to B Is person A now liable under this law? What happens if person A has a Patreon or GitHub sponsor page? The latter seems to imply you're being paid for development and so this is now a commercial project? Or is the requirement that the end user directly pays for the product? In…

Go to the source: https://single-market-economy.ec.europa.eu/system/files/2022... > In order not to hamper innovation or research, this Directive should not apply to free and open-source software developed or supplied outside the course of a commercial activity. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable…

> would likely be for courts to decide.

this is the core issue, essentially if you want to publish OSS code you now need to know you can afford a lawyer, because even if a court decides you aren't liable, getting to that point requires a lawyer.

Re: Open source liability is coming

#209

Post by kragen »

mlinksva wrote: post #201
kragen wrote: post #172

Earlier quoted context omitted.

as i understand it, the problem with some of the previous drafts of the produt liability directive was that by making a commercial product open-source, you could become liable for how random people who weren't paying you used it consider ghostscript, for example, which is open-source and a commercial product from artifex. the license terms are such that you generally only have to pay for it if you're embedding it in…

Wish I could say for certain, but we'd need the final texts of the CRA and PLD, and EU lawyers, to say for sure. This is the sort of situation that the general aim of the EU policymakers seems to be to avoid what they'd see as loopholes, where a business is avoiding responsibility simply by making a product open source, and avoiding destroying open source. It's plausible, perhaps likely, that open source ghostscript…

thank you very much!

Re: Open source liability is coming

#210

Post by dqv »

eggsboenk wrote: post #173
dqv wrote: post #114

Earlier quoted context omitted.

Why none of these articles (neither TFA nor the one you're linking) link to the actual directive is beyond me. But here it is: https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/7393... > With the aim of not hampering innovation: (i) free and open-source software developed or supplied outside the course of commercial activity, as well as (ii) the source code of software, should be excluded from the definition of…

Still not clear for me. What about a company open sourcing some libraries used in its product. Will it be liable? Or would this be 'supplied outside the course of commercial activity'

Take OpenSSL. Their open source product would be free of liability. Their commercial support offering of that same product would not be.
Post reply on HN