Open source liability is coming
developersalliance.org
Open source liability is coming
1–10 of 239 posts
Re: Open source liability is coming
#2[flagged]
Re: Open source liability is coming
#3This is ridiculous, all blame/liability should lie with either the provider of commercial software who chooses to rely on open source software or the end user for relying on free/open source software.
I personally will not allow people in the EU to use any software I write going forward, I imagine other open source developers will take these steps as well.
Re: Open source liability is coming
#4tl;dr Noooo I can’t be held liable for the (open source or not) code I commercially ship, how dare you.
Re: Open source liability is coming
#5FINALLY. This industry needs some regulation...
I'm mostly curious what that means for something like the MIT license... For those who need a refresher, this is the part I mean.
> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Re: Open source liability is coming
#6This is ridiculous, all blame/liability should lie with either the provider of commercial software who chooses to rely on open source software or the end user for relying on free/open source software. I personally will not allow people in the EU to use any software I write going forward, I imagine other open source developers will take these steps as well.
This seems a bit extreme, it isn't even a law yet (or anywhere close).
That being said, if you don't audit your open source libraries, you should be held liable. I've seen open source encryption libraries do some really dumb things that I wouldn't touch with a ten foot pole. Yet they are some of the more popular ones.
Re: Open source liability is coming
#7Honestly just sounds like a misreading of the law to me. I don't believe it. One part says
"If open source resources are in/called/touched your code, you’re responsible for their performance too. The open source resource licensed away their liability to you."
This is the norm. The private company holds responsibility for vetting everything they ship.
It's a speculation on how the law will be enforced for a law with no history and I don't see why you would assume the worst interpretation
Re: Open source liability is coming
#8[deleted]
Re: Open source liability is coming
#9FINALLY. This industry needs some regulation... I'm mostly curious what that means for something like the MIT license... For those who need a refresher, this is the part I mean. > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYR…
> This industry needs some regulation
Are there cases of open source projects being careless or negligent that have caused harm that this would address? Aside from some unintentional vulnerabilities that have been found, it’s hard for me to think of an example that would necessitate more regulation.
Re: Open source liability is coming
#10This is ridiculous, all blame/liability should lie with either the provider of commercial software who chooses to rely on open source software or the end user for relying on free/open source software. I personally will not allow people in the EU to use any software I write going forward, I imagine other open source developers will take these steps as well.
Perhaps less pitchfork brandishing, more reading the article?
> all blame/liability should lie with ... the provider of commercial software
Is precisely what the EU intend to do (according to the article - no idea how accurate it is), not put the liability on open source devs.
From the article:
> So, how is open-source software implicated? If a commercial software product causes harm, whoever put the software on the market will soon be strictly liable. You will need to prove that your code wasn’t to blame to escape the costs. But what if you’ve embedded open-source code, used open-source tools, or called open-source APIs? Under the pending rules, you’d be liable for any errors in those sources as well, regardless of whether you directly contributed or not. A license like the one Apache provides won’t help, since state-imposed strict liability isn’t a harm that can be licensed away by private actors. The user must be made whole, and that’s on you. Worse still, how will you in turn identify or sue the collaborator or collaboration that actually wrote the faulty open-source code to recoup your costs? In that case, the license you signed likely insulates your open-source partners from your claims.