Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source liability is coming

developersalliance.org

Post reply on HN
Print view View original

51–60 of 239 posts

Re: Open source liability is coming

#51

Post by lifeisstillgood »

rebeccaskinner wrote: post #47
sevagh wrote: post #14

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so har…

I think that this part of it could break either way, but the concern is that when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. If so, that would be a net harm to open source and user freedom. I'm not sure it'll happen, but it might. The biggest issue I see with this law is around liability for open source projects…

>>> when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code.

Not even FAANG can achieve this for 1/10th of the code they rely on.

Re: Open source liability is coming

#52

Post by 2OEH8eoCRo0 »

> If a user is harmed by software, the person they paid (targeted ads would count) must compensate them for the harm – unless the software provider can prove their software played no role in the breach/loss/failure/psychological/physical/financial or other harm. If open source resources are in/called/touched your code, you’re responsible for their performance too. The open source resource licensed away their liability to you.

This, especially the last sentence, sounds like a good thing.

Re: Open source liability is coming

#54

Post by kstrauser »

omnicognate wrote: post #31
kstrauser wrote: post #22

This is BS. I've talked employers into releasing all sorts of useful things under FOSS licenses over the years. The conversation has always been like "we have this handy thing, and it's not related to our core business at all, and there's no way it'd be a marketable product, but other people could probably use it, too." And the release process has always been like "here's a thing we made to solve a problem we had, an…

This adds no new liability for the employers you persuaded to release that code open source, only for others that choose to include it in their commercial products. Please attempt to understand things before calling them "bullshit".

That strikes me as an unrealistically naive interpretation of what could possibly go wrong. When there's blood in the water, sharks may not be choosy in whom they bite.

I understand this. My reading and understanding of the issue leads me to believe that it's potentially disastrous.

Re: Open source liability is coming

#55

Post by zzzeek »

what's new here? A commercial entity selling a product that also embeds open source components is liable is that entity's product causes harm, even if the fault lies in bugs in the OSS code itself. is that new ? assuming their own license does not also indemnify them. The OSS code, at least if it's mine, has "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" right there in the license. What's the change?

Re: Open source liability is coming

#56

Post by theLiminator »

omnicognate wrote: post #10
theLiminator wrote: post #3

This is ridiculous, all blame/liability should lie with either the provider of commercial software who chooses to rely on open source software or the end user for relying on free/open source software. I personally will not allow people in the EU to use any software I write going forward, I imagine other open source developers will take these steps as well.

Perhaps less pitchfork brandishing, more reading the article? > all blame/liability should lie with ... the provider of commercial software Is precisely what the EU intend to do (according to the article - no idea how accurate it is), not put the liability on open source devs. From the article: > So, how is open-source software implicated? If a commercial software product causes harm, whoever put the software on the…

What does it mean if you publish your open source android application on the play store (with no ads or monetary compensation, simply just to make it easier for users to use?).

Seems to me that you'll be liable for any issues.

Re: Open source liability is coming

#57

Post by sgt101 »

pylua wrote: post #36
monooso wrote: post #25

There seems to be some confusion in the comments regarding what this means for people releasing open source software. The article makes it clear that (as the author understands it, at least) someone who uses open source software in their commercial product is liable; the people who wrote the open source code [1] are not. > If a user is harmed by software, the person they paid (targeted ads would count) must compensat…

The article says it is not clear who provides relief if the user directly uses open source with no middle man. That is the most concerning part for me.

If you use open source you are accepting the license that says that there is no liability. This is similar to going walking in a national park, there is no liability for an injury that you incur. This is very different from walking in a shopping mall. If you fall in a hole on a mountain this is your problem. If you fall in a hole in a mall it's the mall's problem.

The article is attempting to create a scare about things that have always been true. If a telco's services crash the telco has to compensate customers even if it was a postgres failure that caused it by failing to authorise handsets for a connection in a cell. For example.

Re: Open source liability is coming

#58

Post by d_tr »

withinboredom wrote: post #15
paulgb wrote: post #9

Earlier quoted context omitted.

> This industry needs some regulation Are there cases of open source projects being careless or negligent that have caused harm that this would address? Aside from some unintentional vulnerabilities that have been found, it’s hard for me to think of an example that would necessitate more regulation.

I can think of exactly one rather popular one: left-pad. The author should have been liable for the damage they caused. The industry self-regulated itself but that is a case that I can think of, specifically caused by negligence.

This is a very dangerous line of thought, and frankly, appalling.

Re: Open source liability is coming

#59

Post by MauranKilom »

omnicognate wrote: post #43
withinboredom wrote: post #35

Earlier quoted context omitted.

I read the article, but it was quite ambiguous, at least to me. It isn't very well written / clear on what is actually going on.

I agree it's very ambiguous, but if you read the whole thing it's clear that when dev A releases code under an open source license and it's included in a commercial product by company B that then harms person C, the liability will be on company B. Most of the hot-under-the-collar responses here are assuming it will fall on dev A, which is a misinterpretation the article's author did not do much to discourage.

That completely ignores the second half of the article. I agree that it's confusing why the article goes into so much depth on "companies are now liable, similar to how everyone expects" in the first half when the main talking point is/should be "open source devs are now liable if consumers use their software directly" (as discussed in the second half).

Re: Open source liability is coming

#60

Post by sevagh »

rebeccaskinner wrote: post #47
sevagh wrote: post #14

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely on open source software liable for bugs is fantastic news, that's how it always should have been. You can't have a commercial company throw their hands up and say "well github.com/cutefuzzypuppy is at fault for writing an open-source npm package we used so har…

I think that this part of it could break either way, but the concern is that when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. If so, that would be a net harm to open source and user freedom. I'm not sure it'll happen, but it might. The biggest issue I see with this law is around liability for open source projects…

> >>> when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code.

All those coding jobs lost to AI will be regained when everything needs to be reinvented in-house.

Post reply on HN