Open source liability is coming • Hacker News Board

Re: Open source liability is coming

#231

Post by rstuart4133 » Sun, Dec 31, 2023, 9:22 AM UTC

TheBigRoomXXL wrote: post #174

grumps wrote: post #152

Earlier quoted context omitted.

please provide a link to all your software, so I can find bugs and then sue you for everything you have.

You couldn't sue me for 2 reasons: 1 - This regulation only concerns commercial activity. So you could only sue the company I work for, and only if you've bought their products. Also by definition that excludes my personal projects. 2 - You can only sue for defects (in this legal context it means unsafe to use) or damage (physical or material). You can't sue for simple bugs. These kinds of liabilities already exist f…

> and only if you've bought their products.

If that's true (I have no idea if it is or not) - I'd class it as a bug in the legalisation. Consider a router I've purchased. It has a bug that allows 1000's of them to be corralled into launching a DDOS against someone. The reality is I don't particular care that happened - it didn't effect me. But the person it did effect didn't buy it.

Re: Open source liability is coming

#232

Post by rstuart4133 » Sun, Dec 31, 2023, 9:32 AM UTC

treprinum wrote: post #175

warkdarrior wrote: post #168

Earlier quoted context omitted.

If the open source devs charge for their software, they should have the balls to accept the liability for whatever they are selling.

Really? Why? Just because somebody wants to regulate software? For what reason?

> Really? Why? Just because somebody wants to regulate software? For what reason?

Because open source would then be used as a loop hole you can drive a A380 through. Say I say invent a "house hold chores" robot. The robot has a bug that kills you. But your family can't sue because they made the bulk of it's software open source, and say give it to you for free. You paid for the hardware.

Re: Open source liability is coming

#233

Post by rstuart4133 » Sun, Dec 31, 2023, 9:57 AM UTC

withinboredom wrote: post #5

FINALLY. This industry needs some regulation... I'm mostly curious what that means for something like the MIT license... For those who need a refresher, this is the part I mean. > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYR…

As far as I can tell whether you are libel has nothing to do with the licence, or whether the software is open source. Instead you must have gained revenue from someone (somehow, directly or indirectly) by providing the buggy software to them, and it must have harmed them. It's the same as getting a car with a defect. If you didn't buy it from them (eg, it was a gift) then the giver isn't libel. Even if you did pay for it, if it's not too serious they may get away with it. But if you paid for a new car, and you died because of a defect in it, then the manufacturer has a problem.

So if someone downloaded the software from some public repository without consulting you (let alone paying you), it doesn't apply to you. I imagine that would be true if they downloaded a binary and there was no source available (so it's not open source), and it had some horrible proprietary licence that nonetheless let you use it for free.

But on the other hand, if you made them pay for some GPL'ed software and them made the source available on request as the GPL insists you must, then it does effect you despite it being open source. So really, open source and open source licences have nothing to with it.

In fact from what I can tell, part of the reason this law exists it to forbid shrink wrap licences on paid software exempting the supplier from liability. The licence having no effect on the applicability of the law is a desired feature. If the consumer paid for it, it applies no matter what your licence says.

Why this wasn't always the case is what's odd here, not this attempt to fix it.

Re: Open source liability is coming

#234

Post by tesdinger » Sun, Dec 31, 2023, 4:38 PM UTC

TheBigRoomXXL wrote: post #230

tesdinger wrote: post #223

Earlier quoted context omitted.

No, it is bad because it could also apply to open source software aimed at consumers, not only commercial vendors integrating OSS. > whether “open source” is exempt from liability in a law designed to protect consumers. So far the answer is “probably not?” Exemption means consumers bear the cost – exactly what the law is trying to change. Perhaps if the open source in question remains an academic or research tool, ve…

The directive has not finished the legislative process yet so it's difficult to be exact but according to the briefing on the New Product Liability Directive redacted by the European Parliamentary Research Service > In the aim of not hampering innovation: (i) free and open-source software developed or supplied outside the course of commercial activity, as well as (ii) the source code of software, should be excluded f…

That's interesting. Where does Java script fall in this context, does it qualify as source code? I'm asking the EU lawmakers not you. I'm wondering how they would distinguish Java script source code and Java script product.

Re: Open source liability is coming

#235

Post by ImmutiableTruth » Sun, Dec 31, 2023, 4:45 PM UTC

grumps wrote: post #154

sevagh wrote: post #14

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so har…

How in the world is this good for devs? It's terrible. Do you really think that "big corp" will not figure out how to pass the liability directly to the author? What will happen the opensource world once you're held liable for some moron who uses some software I wrote for myself? or incorrectly uses it? do you really believe the curl should be held liable because some POST failed and a user lost something over it? wh…

[flagged]

Re: Open source liability is coming

#236

Post by grumps » Sun, Dec 31, 2023, 8:57 PM UTC

turquoisevar wrote: post #211

grumps wrote: post #204

Earlier quoted context omitted.

A law and regulation is written one way and interpreted a different way by the courts. In the USA it's all about case law. Hypothetical: I write a nifty alarm clock app. To cover some costs I charge a nominal fee. Some unknown condition occurs a user misses a flight and loses their job. According to your position I should be sued. Why should I be held liable? Daniel Stenberg has a blog post somewhere about all the ha…

> A law and regulation is written one way and interpreted a different way by the courts. In the USA it's all about case law. This is about the EU, not the US. As someone who used to practice law in the EU before moving into software development, I can tell you that your hypothetical will never lead to a suit nor judgment in the EU, nor is your personal experience concerning a subpoena a thing that happens in the EU,…

Fair enough w.r.t to how it works in the EU. I sort of knew that the legal system there was not as easy to bring suits etc.

As you said reaction is based on my personal experience in the US. However at times the US does pickup ideas and concepts from the EU, specifically California.

Re: Open source liability is coming

#237

Post by simne » Mon, Jan 01, 2024, 8:16 AM UTC

Could somebody predict, when these things could become power? How long to got approved by EU?

Must admit, they are two-sided proposals, but anyway, I think we should be ready to react in time.

My prediction, if this will happen, many people will remove their software from public repositories, to avoid liability.

And/or will be changed licenses, probably many OSS will become "only for educational purposes", something like this.

This is from one side, dangerous for OSS, as will lost many third part "unimportant" depends, but from other side, will be powerful opportunity to make paid version to cover costs of development and could significantly increase level of OSS quality.

Re: Open source liability is coming

#238

Post by simne » Mon, Jan 01, 2024, 10:35 AM UTC

sgt101 wrote: post #57

pylua wrote: post #36

Earlier quoted context omitted.

The article says it is not clear who provides relief if the user directly uses open source with no middle man. That is the most concerning part for me.

If you use open source you are accepting the license that says that there is no liability. This is similar to going walking in a national park, there is no liability for an injury that you incur. This is very different from walking in a shopping mall. If you fall in a hole on a mountain this is your problem. If you fall in a hole in a mall it's the mall's problem. The article is attempting to create a scare about thi…

> This is similar to going walking in a national park, there is no liability for an injury that you incur.

It's not exactly such way.

This is only case, if you are 21 or 25 years old (depend on country/state) and if you have insurance which cover this case, or if you have some juridical document for exactly this case.

For example if you toddler/teenager, NOT accompanied by an adult, will be responsible people, who have responsibility to restrict your appearance (entrance) in this park.

So in EU, usage of OSS or products with OSS dependencies, will be effectively prohibited for teenagers. This is not very large share of customers, but approximately 7% of EU residents.

Re: Open source liability is coming

#239

Post by simne » Mon, Jan 01, 2024, 10:47 AM UTC

bpfrh wrote: post #95

ctoth wrote: post #48

I use an open source screen reader, NVDA. It is completely open, and they produce an installer for people or you can build it yourself from Git. Can you help me understand now, if there is a bug in NVDA (which is under the GPL) and it causes me trouble, say, it can't read a webpage that I need for some government thing, I could now sue my screen reader, which is actually just a bunch of dudes hacking something togeth…

You can't. Product liability excludes non commercial open source software, see: https://www.europarl.europa.eu/news/de/press-room/20231205IP...

They said: "not apply to open-source software developed or supplied outside of a commercial activity".

As I understand, if you work making more than 90% of your income as gardener, but on free time develop OSS, you will guaranteed not liable.

But if you are professional software developer, and make for example 50% of your income from software, you will need some powerful proof, that OSS from case and made by you was not part of commercial activity.