Slashdot Mirror
Software Product Liability?
ben writes "Reuters just ran a story about the increasing number of calls for liability on the part of software developers, with a not-too-suprising focus on Microsoft and its uber-fallible IIS webserver. Given that many other engineering disciplines have some sort of accreditation and licensing body to enforce codes of professional ethics, I'm curious what impact the demand for such a creature in the software industry could have on Open Source developers, especially the part-time hobbyist ones. That is, establishment of some sort of Software Developer's license means the developer is potentially liable for whatever havoc his bugs may wreak, and traditionally the only environment with legal resources adequate to deal with such liability has been the megalithic corporate one."
Of course having to undo the shrinkwrap to read the EULA, and by having read in the EULA that by undoing the shrinkwrap you therefore agree with it.. that's another issue altogether
Evil ZEN Scientist
just blame your bugs on bad drivers.
What if they blame your software, when in reality it's the fault of some other software used in conjunction with it? Or it's a hardware problem? Or it's a user trying to cover their own ass when they screw up? It's not quite as easy to see what happened after the fact as it would be if say... a building fell down.
It's more analagous to doctors prescribing medications. They do their best to make sure the patient is in the right condition to take them, but they can't control what the patient takes them with, or how they might misuse them. But of course, malpractice insurance is quite expensive...
This is a serious question that always seems to be glazed over by the open source advocates. Most seem to see it only as a method of attacking MS.
Well, if liabilities become a reality, EULA's won't protect the company, otherwise every company just puts a clause in it and the liabilities cease to exist. The law would be required to allow very few, if any, exceptions.
If the open source community has to face this, what will happen? The next time there's an error (such as the recent Bind exploit) do the lawsuits begin?
There can certainly be some kind of liability for bad code that you deliver to clients under a contractual relationship, just like there can be malpractice if your doctor gives you bad advice.
But liability for a program that you've published on the net or sold retail? That's as bad as liability for publishing a book advising people to plan their finances by astrology or go on some quack diet to prevent cancer. Those books are published all the time and it's (rightfully) up to the buyer to take the advice or not take it.
Most buyers simply know better than to believe such stuff. And sooner or later they will hopefully know better than to run Windows. It's just a matter of the field getting more mature.
This could lead to all kinds of nastiness. If a software vendor wants to limit their liability, they may tie their software to a very specific hardware configuration. This could result in the unintended consequence of giving M$$$$ an unprecedented amount of control over the hardware manufacturers and resellers. So, instead of purchasing software to solve a particular problem, you purchase hardware to meet the requirements of a software package. This seems^H^H^H^H^H is half-assed backward.
Couple of quotes in the article I like:
The products are even less buggy than others, in terms of per capita usage, Microsoft Chief Executive Steve Ballmer has said.
So does that mean that because more people use Microsoft software they can have more bugs in it? This sort of statistic is like using "Revenue over number of employees named Frank" as an accounting measure for companies!
And the other one:
Mundie said. "Microsoft can't control that process. If the printer driver tanks the system, who do you hold liable?"
Now *that* explains what caused all those holes in my locked down IIS server!
Go out and get sailing!
Being liable is clearly a problem if you release your software for free (i use both meanings here). I think software companies should be liable if their software is not free. When you agree to give up money or "freedom" for software, It is my opinion that you should get a quality of service granted in exchange.
This should usually be handled by the invisible hand of competition, but huge software companies are so well-established that they can afford to give up on quality. I think that such a measure would protect the consumer from such abuses.
This is just an idea, it's certainly flawed and incomplete. Does anyone care to contribute?
Trollem mirabilem hanc subnotationis exigiutas non caperet
I think this would be an administrative nightmere for open source... Don't give me some B.S. about open source getting some kind of exemption cause its not gonna happen... also don't give me B.S. about open source not having security bugs... they DO!
Lets say this becomes true and Microsoft gets sued cause HyperTerminal (part of Windows) has an root exploit. Microsoft pays damanges and then will probably sue HillGrave Software (or whatever company they sub-contracted to write it). (or they have insurance). This will drive up the cost of software for sure..
Lets take a look at the open source way. Lets say some company using package X get rooted cause of an bug in package X. It sues the maintainer of package X. The maintainer then pays out. What does the maintainer do? sue the developer who wrote the chunks of code?
This will particularily bad for open source software for the following reason: large companies can afford insurance against this.. open source cannot... once open source gets one or two lawsuits cause of this... I expect more and more open source projects/developer to give up cause they can't afford to pay out..
-- Note: These Comments are Generated by ME! Not You! ME!
I doubt software vendors could continue to exist, if there were a level of performance required where NO bugs/faults were required. What may work though, especially when it comes to software like IIS and all of its fun vulnerabilities, is lemon laws similar to for cars.
A model of car needing a recall is no big deal - it's a bummer and an inconvenience most of the time, much as most software has the odd patch/upgrade for reasons of bugs appearing publicly. Continual faults/bugs/etc are a different matter entirely.
The notion also, of Unstable, Stable, Testing versions of software seems pretty sensible when it comes to the liability in open source software. Letting a user know what they're in for when using an Unstable product limits liability by saying "OK, this really could be crap" - miles more than IIS, to use one example.
a grrl & her server
The NIST commissioned a study (sorry, 1.4Mb
If you don't want to download the report, there's a brief summary in RISKS Digest 22.11, on comp.risks. If you do download the report, the final numbers are on p.174
Sheesh, evil *and* a jerk. -- Jade
- Non-Comercial For which money is not charged
- Commercial for which money is charged
- Licensed Commercial For which Money is charged, but for which no sale is made.
Commercial software would include the obligation of support, although the require period of time is open to debate. I would advocate 5 years, although this could be set to several classes, such as 1 year, 3 year, 5 year, and 7 year. Each with a degree of obligation of support, liability, etc.Non Commercial would not be subject to the warranty, and so would cover open source, donation ware, shareware, etc.
Shareware, etc. would probably have to be sorted out as software where no payment is required.
I advocate that any software not sold but merely licensed must have complete liability coverage and support for the duration of the License.
"It is a greater offense to steal men's labor, than their clothes"
I always point to the ham radio market. In general, there are very few pieces of "bad" ham radio gear sold. Some may be better than others, but none are truly bad. Why? I believe it is because the FCC requires that one understand the gear before they can get a license and use it.
Computer consumers, in contrast, often understand practically nothing about what they are purchasing. They do not understand how software (or hardware) works, how it is designed, what it is reasonable to expect a computer to do and what it is not. As a result, there are marketing droids demanding that people be able to cut & paste from video editing software to word processing documents. This leads to the software engineering team spending an inordinate amount of time creating bloatware with as many bugs as features. Adding to this problem are the EULAs that software vendors use to shield themselves from any product liability lawsuits ("it's not a product, it's just a license to use the software"), thus undermining the only thing that had any possibility of keeping the software quality in check.
If licensing improved the quality of software, then MCSEs would be turning out works of art. And I think that we can all agree that it's not happening.
What is sold as a product is not speech. If the courts have not been uniformly easy on code which expresses scientific ideas, written in an academic context, then certainly commercial software will not (and I think should not) enjoy protection as speech.
What would have to happen to change the current setting where commercial practice (and law) considers all software to be 'without warranty' is another matter.
The obvious reason that SW is presently very much a 'caveat emptor' instance is that most nontrivial software products are both comple and can be run in such a wide array of hardware and software environments that solid analysis of potential failures is clearly infeasible.
Linux is Linux, if One need clarify their dist: <Dist>/GNU Linux
bsds are of course just BSD
> If software was tested until there were absolutely zero defects in it you A) be waiting a long time to get it and B) you'd probably faint dead away when you saw the price tag.
That's certainly true today, but must it be true forever? I suspect we'll soon reach the point where the public says "Enough!" to crappy software, and then the eggheads with their code generators and correctness provers will crowd out us ordinary geeks with our bug-laden code.
Sheesh, evil *and* a jerk. -- Jade
This could generate an answer to the question "What is the difference between Red Hat/Debian/random-distro" of Linux -- the difference could be in how much they guarantee the liability in their software. Sure it's a risk for a distro to do so, but if they really believe the "many eyeballs == better software" theory, it's a risk someone may take.
- adam
disclaimers? prehaps for those "book" they have disclaimers and stuff ......
just like those "Psyhic (sp?) Friend Network" ads they have subtitles "for entertainment purposes only"
and labels on peanut choclate bars that says "this may contain nuts" (I know peanuts is not a nut but geeze).
people are STUPID enough to belive these things...
-- Note: These Comments are Generated by ME! Not You! ME!
lets consider two facts..
1) RedHat/Mandrake/Suse/Caledra has been the big push of open source for the business world... without them Linux would be dead in the business world...
2) companies in (1) released products for sale (you buy them) and they sometimes have security bugs (a lot of them has a recent exploit in SSH recently)..
3) companies who uses products by companies in (1) who get 'rooted will sue the companies in (1)
4) companies in (1) will die (they have lot less $$$ then MSFT)..
5) bad for Linux...
-- Note: These Comments are Generated by ME! Not You! ME!
I don't care what software package you are talking about, but I can find at least one bug in it. And I can set it up so that the bug in questions causes me some amount of damage. Then I just find a lawyer and sue. I could make quite a living. I just buy a new piece of software each week and manufacture another lawsuit.
If, however, I am the head engineer for a project, and it fails, my head should roll. This goes for things I would manufacture and sell.
If I putz around with some code, and share it, no big deal. As soon as I am in the software BUSINESS, and sell that code, however, I have a responsibility to the folks who use that code.
Most folks who write stuff in their spare time, write it first and foremost for their own use. Since they made the effort, many folks decide to share it with the world. Of course it won't be polished, but at least they try not to hurt themselves with it, so it follows they wouldn't be hurting others with it either.
Software vendors make software for a profit. And do a shitty job of it. They SHOULD be held accountable for their inferior shit that hurts individuals and businesses with lost productivity and data.
traditionally the only environment with legal resources adequate to deal with such liability has been the megalithic corporate one.
Professional engineers, doctors and lawyers are subject to liability claims arising from negligent behavior. There is also insurance available to cover these circumstances.
Megalithic corporations do not have any special exemption from disaster due to product liability claims. Many are driven into bankruptcy as a result of liability problems (Dow Corning, Johns-Manville, and Soon Arhter Anderson).
As a developer, I cringe at the thought of being liable for my code. We all know its next to impossible to make something completely bug free.
However, as a consumer, buying software should not be a risk. It should do what it says on the box, and if it doesn't, I should be entitled to have it fixed.
Of course, these sentiments are ingrained from my days as a Windows user. With Open Source, its a whole different kettle of fish. I've paid nothing for it, so I've gained by merely having the software. If it doesn't work, big deal, I either move on to another app, report it, wait for it to be fixed or if I'm really desperate dig the code out myself. At the end of the day, the worst situation that I can be in is that I'm back to where I started, it hasn't costed me anything.
If I recall correctly, all products have "implied" warranties that cannot be voided. So, if you ever sign something that "voids" your warranty when you buy something from a merchant ("as is"), it really doesn't mean anything if the product is deffective. Lawyers just like putting phrases like that in so that the people who don't know any better will say "shoot, I can't sue because I signed that paper . . ."
I think "common law" applies to non-merchants and is very different (your hobbiest), but I better shut up before I post some big mistakes.
Anyway, to begin, I am assuming that expecting hobbiest to be liable for their code is total BS. It is like making someone responsible if their post causes someone damages or to kill themselves. Not only do I think current "common law" would imply hobbiest to be free of liability, they could always just use an alias for their code contributions, making enforcement impractical.
However, as a merchant, I think that by giving out the source code of your product, all related parties would effectively have the ability to check the code before they use it, which would shift the responsibility to the consumer. Yes, this is impractical! However, why do you think CPA's exist? Accounting information is extremely impractical for each individual to analize, so we have something called "auditors" to do this for us. It wouldn't be weird if a "software auditor" were to come to be and would give an "unqualified opinion" if everything was in order in your favorite distro.
Companies who didn't release their source, however, would not be allowed to void their implied warranties because there is no way to check if the code will do damage or not.
This would be a drastic change but would probably increase the quality of software, in general. MS would probably be the only company left that could afford not to open their source, but that is fine by me. At least they would be responsible when their software deficiencies indirectly impair my bandwidth.
Sdelat' Ameriku velikoy Snova!
Now, ratifying this unreasonable expectation of software in law is misguided. There are already sufficient principles in law to handle the situation. People should be educated to understand what 'use at own risk' means. If you wish to have a piece of software that absolutely must work (and has been proven to do so) then you will need to pay the price to have such software developed. The fact that you desire mission critical software should not prevent me from obtaining and using 'at risk' software for my own use.
People sue too much as it is. Grow a spine and take responsibility for your own actions for once. You bought and installed the software. You have taken the risk and the responsibility. If that's unacceptable, cough up the dough to get someone to write a bulletproof webbrowser. Or use a typewriter.
Just because you're paranoid doesn't mean they're NOT after you.
On the other hand, program writing is too young a discipline to have yet evolved a set of absolutely-proven "natural laws" yet, especially when programming paradigms (high-level/structured/oop) change every generation or so.
Those "natural laws" just won't happen for a while, especially if the architecture eventually changes from Von-Neumann to something else (parallel/neural/photonic).
The main problem behind attribution of liability stems from the lack of "natural laws" governing programming itself, thus making the analysis of software failure a shaky endeavour.
Finally, the programming establishment will simply not accept liability, and, most importantly (to the point of dooming the whole liability scene), no underwriter will accept to back software liability insurers either.
I am having too many thoughts tonight (time to meet some beer). this would also be fairly bad for code resuse.
Lets say I own WangCorp and market a commerical linux application which say uses zlib. Now lets say that a bug in zlib causes my application to crash. One of the clients, SingerCorp lost some data cause of this.
1) does SingerCorp sue WangCorp or the writers of zlib? does it matter if zlib is GPL code?
2) assume that WangCorp does not link to zlib but instead another similar library but commerical. does that change the issue?
3) will the writers of a library be liable for damanges that the library causes if it used in another application?
4) for example: VMWare includes a copy of Samba for file sharing. lets say that Samba get rooted. do you sue VMWare Incorperated or the Samba people?
-- Note: These Comments are Generated by ME! Not You! ME!
I don't know who wrote this but it's a standard article of faith(sic) in the IT industry.
The only case I can think of in which a vendor provides a meaningful statement that a system operates with a particular fitness for purpose would be systems evaluated under Common Criteria orTSEC
And these systems differ from the vast majority of operating software systems in that:
So the current state of the art is "software is too complex to guarantee performance", this is codified in commercial code and practice. What this means for now is that entitities which use software cover themselves with insurance. (I have no idea what it costs to insure a commercial web-presence.)
I think changing things to hold producers of commercial software and systems would be a good step. I can't see however how this would happen without forcing considerable change in the practice of software design and development.
Either tehcnology and QA need to change, or software systems would need to become simple. Given the current set of assumptions it is effectively impossible to perform an analysis of any non-trivial code and determine that it is safe in the expected execution environment(s).
Simplicity sounds great on paper. At present there isn't a market for simple software that works with high assurance. (Look at the tiny marketshare for the BSD's). Even the systems that run over unix-like / oss show a degree of bloat that continues to push reliability out the window.
Prudence and solid engineering practice in operations dictate that we use the simpler / more robust tools in key locations. So BSD or secured versions of linux get deployed as firewalls etc, and critical application and database servers are run with various redundancies (clustering / failover etc), which effectively throws hardware at solving the software 'problem'
Which is just another name for insurance.
Linux is Linux, if One need clarify their dist: <Dist>/GNU Linux
bsds are of course just BSD
will this lead to code bloat? I mean think about this...
most software use a lot of libraries... you get into a lot of problems if the libraries are slighty different...
Lets say that my products works with a shared library version 2.4.292. Lets say that the implementors of the shared library makes a slight change in version 2.4.293. Lets say someone who uses it with version 2.4.293 crashes...
am I responsible? If I am... I am sure hell going to compile my executable statically linking every single shared library... (eek. on the code size)
-- Note: These Comments are Generated by ME! Not You! ME!
... is really pointless. The argument is: an architect designs a house that doesn't blow over, or a bridge that handles the traffic load without collapsing. However, in these cases, anyone who does something out of the ordinary with the house (fills it with water, tries to open the inside door without opening the screen door), would be laughed at if they called it a design flaw.
Take the usual punching bag for example: IIS. IIS, when used properly, works quite well. You might argue about the functionality/performance/cost compared to [insert favorite httpd], but pass over those arguments for now.
Security is a common complaint for IIS. However, if a person broke into your house by going in through a weak point (a window, the chimney, etc), you wouldn't blame the architect.
Zealots might say that backdoors in software are like using doors without locks. But this is ignoring the fact that software is often not an integration of existing, proven solutions, but an exploration of ways to attack a problem. Also, these failings are plain to the layman, whereas software bugs are often obscure to the guru. You simply cannot have the expectation that software will *NEVER* crash.
An architect has a given set of solutions for common problems (building codes, pre-existing designs, etc). If they can't solve a problem with an existing, proven solution (or a mild derivation of such), they probably wouldn't take on the job. Programmers do not have this luxury. We are inventing these solutions on the fly -- and we will make mistakes.
Actually, it's just as easy to do it with software, and you see vendors of 'turnkey' type apps do it all the time. "Run this software WITH this OS (or boot directly) with THIS hardware with THIS patch level and we guarentee the following things. Otherwise, you're on your own." This is why average software cannot be certified, as you say, there are too many variables. This is also why anything that you don't want going down at random times cannot be run on random software. That, of course, is why you go through a Professional Services firm, who WILL supply such a guarentee. With, of course, a shitload of stipulations as to hardware, other software, and so on.
Vintage computer games and RPG books available. Email me if you're interested.
Here is the problem as I see it. It's one of scale.
It is easy to certify most engineering professions. If you build a building, it must meet certain tolerances. A weld between two I beams would support so much weight. This is easy and empiracle (sp?).
You learn this, and are tested on it to get your license. How ever, in the current state of software engineering, you deal on a much more fine grained scale. How does an extra iteration of a loop affect the stability and security of the program. There is no algorithimic way of determining this, like building a building at the molecular level.
Essentially all software is licensed not sold.
A "copy" is the medium on which the program is fixed, i.e. the physical DVD-ROM on which Windows YQ ships. Copies of mass-market software are generally sold. Most EULAs state: "You own the copy, but we retain title to the program."
In the United States, the owner of a copy of a computer program has specific rights under 17 USC 117. The difference between grandparent's "commercial" and "licensed commercial" is that a "licensed commercial" case is a software rental in which the copyright owner retains ownership of the copy.
Will I retire or break 10K?
Negligence in software development costs other people/entities money. Cleary, liability is an issue.
I'm not sure, however, if all you programmers really want this cat out of the bag. Could you imagine someone suing you because something you developed didn't work and caused someone to lose money?
-Sean
He is the greatest unlicensed doctor ever. Unfortunately, like most other good things, he lives in the world of anime.
What we call folk wisdom is often no more than a kind of expedient stupidity.-Edward Abbey
This would vastly reduce the number of software firms and the availability of low-priced specialty software.
Hi, long time listener, first time caller and all that.
I think the question (ultimately) may come down to where the finger gets pointed. I saw a post reference to certifications for programmers, which KIND of goes to my point. Then, I read the post on gun companies getting sued for the actions of their customers. Getting closer. THEN, I read the post by "The Eric Conspiracy" about Doctors, Engineers, Lawyers, etc, and what they are liable for. This is what I was thinking.
In a corporate networked environment (I am narrowing it down here, I know, but bear with me), who IMPLEMENTS buggy software? How about the Sysadmin? Maybe not his or her IDEA, but they actually implement it. It ain't Joe Blow at his workstation who uses it. You are the one that put it out there for him.
"Hey, our software was tested at M$ (or wherever) and found to run ok. What's YOUR problem?" If it hoses your network, or you get rooted, or whatever, it happened on YOUR system! Your firewall, your OS mix, your internal and external apps.
I know this sounds far fetched, but look at Enron. They played fast and free with almost everything they did, and Arthur Anderson went along with it. Now, since AA got convicted, the Enron stockholders are going after THEM instead of Enron. Responsibility was neatly deflected from one to the other because it was EASY to.
If you implement software onto your network, my guess is that EVERYONE that had ANYTHING to do with making it will be pointing to you as the (ahem) "root" of the problem. After all, it happened on your watch. And, odds are, YOU have some certifications! Tsk, tsk, you should have KNOWN better!
Paranoid? Probably. Hopefully, anyway. But look at everything that has happened from day one on this planet. When something either goes wrong finally, or has gone wrong for long enough that people complain, the finger of blame always swings over to the easiest target.
"the only environment with legal resources adequate to deal with such liability has been the megalithic corporate one."
For "deal with" substitute "avoid"
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
I think mandatory licensing for developers is stupid. Last thing anyone needs is a new bureaucratic office dedicated to extracting fees from developers.
But warranties are a different matter. If you market your software as a commercial product, then it should have the same warranties as any other commercial product. This is common courtesy. It's also known as being ethical and moral.
If you claim that your software is suitable to be marketed by actually marketing it, then you need to back that up by NOT disclaiming merchantibility. If I buy a toaster and it doesn't work as a toaster, it has a warranty that says I can get it repaired or return it for a refund. Commercial software should be the same. If I spend $199 on a word processor and it fails to process words I want recourse. If a patch is available then I want to be able to get that patch without having to pay for it. If no patch is available, then I want my money back. Is this so hard to understand?
But before you all get your panties in a twist and start crying out that warranties will kill off Open Source, remember that this only applies to commercially sold software. No one expects merchantibility for freely downloaded software. Second, the warranty should reside with the seller, not the developer. So Redhat can sell your software and you are off the hook, because it is Redhat that is claiming the software is merchantable and not you.
(liability is a different matter. I believe that every competent business should have liability insurance. But I don't see any problem with disclaiming liability so long as the recipient knows of the disclaimer before using the software)
My current software has a warranty disclaimer. That's okay because I am not selling my software. If you wish to purchase my software, you will get a warranty with it. This warranty will cover replacement or repair of the software for one year.
A Government Is a Body of People, Usually Notably Ungoverned
The level of liability in other industries is dependant upon the job/product contract
where included in the contract may be a required level of liability coverage and like
insurance, the more coverage you pay for the greater amount of liability you are
covered for.
And I'd imagine that like health insurance where you get a discount on the cost
of the coverage for being a non-smoker or practicing preventitive medicine, the
same sorts of liability coverage would apply and take into account software
licenses approved by the OSI, such as GPL.
This will probably be viewed as a troll but I feel I have to say it:
The problem with software is that when a virus/cracker compromises your system, any resulting damage can not logically be attributed to the software developer.
Nobody is out there expressly trying to break and/or compromise Firestone tires. They were sued because the tires malfunctioned of their own accord.
If IIS blew up on it's own and erased your disk you would have a legitimate case. As soon as a third party maliciously tries to compromise it, the case is off.
If someone broke into your house would you sue the lock maker? Likewise, if someone deflates your tires you have no case against Firestone.
If you can show me one case where code in IIS itself was responsible for damage (i.e. damage occurred while the code was running normally without any provocation) then I'm all for this, otherwise (as much as I hate to stick up for MS) you can't possibly blame them for Code Red etc.
The real solution is just to get a better product; if you are having a problem with break-ins buy a better lock, don't just try to shift blame for your bad purchase decisions on someone else.
...and I wish they'd pass a liability law, 'cause then I'd sue Larry Wall for a refund of the entire amount I paid him for it.
Find free books.
Your example is too simplistic for the issues that must be resolved. Instead, consider:
Motherboard "A" works fine with SoundX soundcard VideoV video card. You (the consumer) hear about the new VideoVx with 3 trillion instructions per second it makes quake look like a movie.
Now you install the new card VideoVx. After doing so, the system crashes. You pull out the sound card and everything is fine.
Now who is at fault?
The Video card maker:
Do we force every hardware update to be backwards compatible with every combination of hardware?
The Sound Card maker:
VideoVx was not even available when SoundX was created. Do we force every hardware maker to test and supply fixes for every new piece of hardware made available everyday?
The mother board maker:
They let the hardware conflict in some fashion or the system would not have died? Picture the permutations of hardware that would need to be tested to ensure that every possible combination of sound, video, cd, dvd, scanner, camera, hard drive, chipset, bios and operating system worked in any combination.
The OS supplier:
Face it, they did not prevent the interaction that allowed the failure. Of course, everyone was using them as stated, this specific combination however was not forseen when you bought the OS two years ago.
People keep mentioning architects/structural engineers/etc. Consider building a bridge where the materials changed four times a year. Would you know that mixing bolts of MaterialX with sleeves of material "Z" were an issue until a reaction (created by runoff from the surface of the road) happened? Of course not, nor do we expect them too.
This is why new materials are so slow to move into construction. We cannot afford to have buildings fall down.
I'm a firm believer that, in general, ALL SOFTWARE (including Linux, BSD, and Windows) is full of show-stopper bugs, with a probability in proportion to the number of lines of code raised to some power. If one piece of software seems more secure, it's just because the bugs haven't been found yet. And this will get worse as time goes by.
(How the bugs are handled after they are found is another story, perhaps we should be focusing on that instead.)
Microsoft has lots of smart people working for them. Free Software has many smart people looking at the code. Yet, most of this code has bugs. When I write a 10-line Perl script, it has bugs (for instance, what does it do in a full disk situation? What does it do when run by root? What does it do if a Perl library is missing or upgraded?).
Making software writers/distributers liable for bugs is simply impractical. Software is simply not like a bridge or a toaster. Software is incredibly complex, and it runs on machines that are also highly complex, connected to other machines with equal complexity. All the interactions can't possibly be comprehended.
And just what is a bug? If the program malfunctions under certain unforseen circumstances, but when it was written it met all the specs, is that a bug? If you use a formal system to "prove" correctness, are the rules correct? Did anybody make a typo setting it up? Is the program that does the check itself bug-free?
I can understand that if Microsoft promises you a secure webserver, and it's found not secure, you feel Microsoft is to blame. But perhaps a "secure webserver" cannot exist. Even if it did, once installed, it would interact with other software to create a security hole (example: Apache + PHP + anonymous uploads into the web-accessible area + MySQL running as root).
If a law for software liability were passed, it would instantly kill all but a few software companies. Free Software would wither or go underground because no programmer would want to touch it. You would get zero support for your software, unless your setup was 100% EXACTLY the same as the one the corps will support. This would probably be enforced with some draconian DRM. Our lives would get worse.
Of course you say, they could make an exception for Free Software. But what would the criteria be? Exception for no-cost? No, that would mean you can't charge for Free Software beyond the cost of media. No more PayPal buttons on your web site, no corporate sponsorship. And Microsoft would just turn IIS into a free download. Exception for source-code-included? That would be better for little guy (no more binary-only distro though), but Microsoft could just invent a very-high-level language where MS Word is 5 lines, and distribute that along with it. They would find some other way to get around it. Any liability exception would be unfair to someone.
If anybody should be liable, it's the person or company who chose and installed a particular system. This entity put together the components, so this entity is responsible for knowing they all work together without bugs. But like I mentioned before, I don't think this is possible. And even just one small change or upgrade and you don't know any more if your system is still secure.
In 40-50 or more years, the software industry might stabilize to the point where all basic computer tasks are performed using well-known, publically available, stable components and formal systems, and then you could use the term "engineering" and you could conceivably have more predictable software. But I don't really think we're anywhere near that point now. Computer science is still in its infancy.
I'm not optimistic!
Say instead of being a software engineer, I was an enginner who built bridges. Can you image a boss coming up to me and saying:
"I need a bridge built in this location to move some things across the river. We will lose out to our cometitors if this takes any longer than three months, you have two and a half. Tell me tomorrow how much steel you need ordered and I will have the iron workers (actually guys off the street who could spell iron) to start putting it together."
Would you go across a bridge built like that? I wouldn't if I had a choice in the matter. How different is this from many software projects? Not very. Management doesn't care about the software quality since they don't understand it anyway, the coders are passivly taught not to care either because it costs more to write well architected, well tested code. Code can be solid if effort is placed on writing solid code. There will still be bugs, but nothing like is prevelent today in commercial software. Think of all the VB monkeys that managers consider real programmers. (Not that there are good VB programmers, but by and large...)
Welcome to the world of software. As long as the current market drivers are in place, nothing will change.
-Pete
Soccer Goal Plans
No. I don't think that most people would agree with that. It's just that they have resigned themselves into accepting it because they know they'd go bankrupt taking a major software house to court over a bug that caused them to lose business or money (the same thing right :-) ). XYZ Corporation will hide behind their EULA and who wants to gamble that they'll try the suit in front of a judge sympathetic to the consumer. Most folks aren't in the financial position to blaze that legal trail.
CUR ALLOC 20195.....5804M
If I owned a house that I'd determined (through some of my own testing) had a chimney which was more like ly to allow breakins because the architect has designed too large a hole at the top, and I then tried to publish information about the security concerns about that chimney, could the architect bring suit to stop me? I'd like to notify other homeowners to secure their chimneys, but the architect is trying to get laws passed saying that *I* am the danger to society - I'm causing more breakins - because I'm talking about the chimney. Is that right? That seems to be the direction the big boys want to move in (not just MS, but many large software companies, from what I gather).
creation science book
Maybe not. But if I were building a bank and the architect forgot something like a lock on the vault, I would feel justifiably aggrieved.
What's needed here is some concept of due diligence or reasonable expectations. As you say, it is impractical to expect software to be perfectly secure or robust. It is simply not viable with the nature of the beast, and with the methods known today, to provide such a product.
However, there are some tests that should be routine in any shop. If a software company allows its coders to write in a style that lets in buffer overflows, a common and well-known class of bug that is easily preventable with just about any development tools available today, then that should be treated as negligence. This is very different from expecting someone to write encryption algorithms today that can't be broken in 50 years with all the unpredictable advances in computing power and mathematics that may bring.
This is really no different to any other engineering discipline. I wouldn't expect someone architecting a bank to make the safe unbreakable in the face of the military weapons of 2050. I would expect them to put a lock on the front door and install an alarm system that did something useful in the event of a break-in.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
I develop some software that I've released free (as in beer and speech) under the GPL. I have a simpler way to deal with this problem.
Anyone who downloads my software and isn't happy with it is entitled to a full refund for purchase price.
Since the price happens to be $0, I'm not concerned. Then again, I wasn't concerned in the first place because I doubt that any such laws that would be passed in the U.S. would pass in Canada too.
You can accomplish anything you set your mind to. The impossible just takes a little longer.
Close, but that's not how software companies would build bridges:
"I need a bridge built in this location to move some things across the river. Our marketing guys say we need to get traffic on it with a month, and don't worry about it collapsing because it's more important that we get people lined up to use our bridge than to actualy get them across the river - that can wait for Bridge 2.0. Finally, we've already decided to use recycled steel (up to one ton, no more) 'cause I got a nice dinner at the local tittie-bar from their salesman - I don't want to hear any crap about tested structural steel and high-tension bolts. The decision has already been made, as has the placement of the piers. (A real professional can build on loose sand and clay, so I don't want to hear any more whining.) If you don't want to play by my rules (but take the blame when you can't meet my schedule or arbitrary restriction), we'll blacklist you as "unmanagable."
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
OK, So I'm an Architect, and just finished working on a bank to boot.
You are right that there is a reasonable level of liability and quality expected within my design for the bank.
If the bank was to get robbed via force, I wouldn't be liable, for it was never represented by me, or required by my client, for the bank to be 100% robber-proof.
My design was required by my client to meet their needs for security and safety, so it's more important that the vault is secure and that someone can't easily hold hostages within the bank than it is to make it so that someone can't walk in with a shotgun and run out with a few thousand dollars. It's impractical to make the bank 100% robber-proof.
Now if a flaw in my design allowed someone from the Togo's next door to open a hole in the wall, and gain immediate and complete access to the vault- well then I would be liable, and rightly so. If I designed a bank with hidden corners and nooks where one could hold up and defend the bank in a hostage situation, and someone was gravely injured because of it, then I would be held liable. My design failed. I was negligent.
See there is a scale to this, a level of reasonable liability and requirements.
As an Architect, I am liable for everything I do, just like a lawyer or doctor or engineer. And just like a doctor or lawyer, I must complete tests and a certain amount of training to gain licensing to call myself an Architect and sign drawings as such.
Now any kid could design a house. That doesn't mean the roof won't leak and that it will survive an earthquake. That's the point of licensing in Architecture; I gain the legal right to sign drawings (a requirement for anything bigger than a house) and the legal right to call myself an Architect (that's right, all you 'software architects' our there are technically breaking the law- it would be like calling yourself a 'software doctor'- no one takes this seriously, but still that's the law) at the cost of accepting the liability for the work I do and the advice I give.
Now the software most Architects use is horrible. It doesn't perform as advertised, costs a fortune, and the licensing is draconian. It's frightening and sad. Now if it crashed now and then ok that's reasonable because there is no such thing as %100 stable software, just like there is no such thing as a %100 robber-proof banks.
However when there are GLARING deficiencies in a design, I believe that the people should be held liable for their work. In every other industry and business this is the case.
I don't think requiring licensing or liability for software development would have the 'sky-is-falling' response most of you geeks are saying it would. I think it would provide a much better, and respectable, industry in general.
To compare this to Open Source software; just because I design a house and freely publish the plans doesn't mean I am liable for every house that SOMEONE ELSE builds from my plans. If you bought my plans, and built the house I designed; well it's on your head to make certain the roof don't leak. But if you hire me to sign those drawings, or design the house or oversee it's construction then it's my legal and moral duty as an architect to make certain that the roof don't leak. See the difference?
(I am over-simplifying this; I know. But I'm proving a point here)
So if I download Debian, and compile it myself, the Debian project is not responsible for how I did it, nor has any control over how I did it, so therefore they shouldn't really be held responsible for my actions.
But if I hired someone to do it for me, or bought an off-the-shelf copy from Microsoft, and it has GLARING design deficiencies that cause it to fail in it's advertised abilities, well, I should be able to at the very least get my money back.
Software Developers should be ashamed that they don't hold themselves accountable for their own products.
Microsoft will actually sign with customers of big contracts agreements which assure that Microsoft will taking liability to ensure uptime, security and safety something.
One of the major bonehead CIO bloated to others that agreement and said "Now that's what we need - an assurance from a big corp.! What more can we ask for!"
Until I show him the following line:
8. LIMITATION OF LIABILITY.
Microsoft's entire liability and your exclusive remedy under this EULA shall not exceed five dollars (US$5.00).
God, he signed a $10,000 assurance agreement for a liability worths US$5.00. You gotta see his face when he figured this out.
On the other hand, I have found some of the responses educational.
One angle is the "follow the money" angle
Another, equally viable, is the "See the Source Code" angle.
As seen in this PDF file, property rights are often considered as a "bundle of sticks", a collection of rights which taken collectively create the concept of property and ownership. (although this is usually seen in land and realty situations, I can see how it applies elsewhere)
This ties directly into the license vs ownership arguments, etc. and would have to be sorted out in detail
"It is a greater offense to steal men's labor, than their clothes"
The risks,issues and solutions for providing a more secure operating and application enviroment have been known for decades. Those who do not already comprehend the issues and are willing to learn, should take some time out to listen to some of the speeches at Dr. Dobbs Journal's Technetcast security archives, starting with Meeting Future Security Challenges by Dr. Blaine Burnam, Director, Georgia Tech Information Security Center (GTISC) and previously with the National Security Agency (NSA)
The design and implementation of some applications and servers are just too unsafe to use in the "open ocean" of the internet.
Numerous security experts have railed against Microsoft's lack of security, best summed up by Bruce Schneier Founder and CTO Counterpane Internet Security, Inc who rightly stated ...
However Microsoft's products are not alone in the presence of vulnerabilities, this is a major issue for Linux/BSD and Unix as well as any other OS and vendor.
In a recent speech Fixing Network Security by Hacking the Business Climate Bruce Schneier claimed that for change to occur, the software industry must become libel for damages from "unsecure" software, however historically, this has not always been the case, since most businesses can insure against damages and pass the cost along to the consumer.
The Ford Pinto and more recently the Ford Explorer's tires are two examples of public and media pressure being more successful than just threat of lawsuits. Even so, eventually though public pressure the governments around the world have to step in and pass regulations that set up a minimum set of requirements an automobile has to meet to be deemed "road worthy". This includes crash testing as well as the inclusion of safety equipment on all models. The requirement are not constant and change to meet the expectations and demands of the public and lawmakers.
The onus is not only on the automotive industry itself but also on the users. Most countries require that all automobiles undergo regular inspection and maintain an up to date "Warrant of Fitness".
In the same way, if you want a secure IT infrastructure, eventually the software design, implementation and each deployment will have to undergo the same type of regulation and scrutiny.
There are two ways in which it would hurt the open source movement:
Companies wanting to open up software would quickly keep there source closed in fear of being sued for the bugs found. So while you may hurt Microsoft you have just turned every software company into Microsoft.
What if an open source coder has his/her program included into a distribution or linked into a another peice of software, then being sued for a bug in your code.
Seems like this short-sided idea has become a nightmare. Maybe I am over reacting but I just do not trust law makers (with no software experience) to make complicated software liability laws.
(From NT EULA)
:)
6. NO WARRANTY.
Any use of the software is at your own risk. The software product is provided for use only with Microsoft Windows NT Server. To the maximum extent permitted by applicable law, Microsoft and its suppliers disclaim all warranties and conditions either express or implied, including, but not limited to, implied warranties of merchantability, fitness for a particular purpose, and noninfringement.
7. NO LIABILITY FOR CONSEQUENTIAL DAMAGES.
To the maximum extent permitted by applicable law, in no event shall Microsoft or its suppliers be liable for any special, incidental, indirect, or consequential damages whatsoever (including, without limitation, damanges for loss of business profits, business information, or any other pecuniary loss) arising out of the use of or inability to use the software product even if Microsoft has been advised of the possibility of such damages. Because some states and jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you.
And my all time favourite:
8. LIMITATION OF LIABILITY.
Microsoft's entire liability and your exclusive remedy under this EULA shall not exceed five dollars(US$5.00).
It's effectively saying: You got what you asked for. Here's your five dollars, move along.
Somehow I think it's much worse than the big cap 'NO WARRANTY' in all GNU software license.
When an SUV rolls over someone dies.
When children's clothing chokes a child, someone dies.
When a doctor screws up a surgery, someone dies.
When IIS is hacked, L331 H4XOR OWNZORZ JOO.
No doubt there are bad programmers around, and the numbers are increasing mostly because corporations are trying as much as they can to reduce pay. Only crappy programmers are willing to take the low salaries that can compete against things like H-1B.
If the software is crap, blame first the company that sold it. Then let them review their procedures on how it got to be so crappy.
"We need this package done in 2 months." "OK, 2 months and it will be done. Then 7 more months and it will work right." You think that programmer gets to keep his job, even if he's telling the truth?
now we need to go OSS in diesel cars
What rules? I've never agreed to them.
Now, if I had sold my software according to a contract or an EULA with terms of service embedded - fine. Apply rules.
If I just write stuff and say "here - it works for me but don't know if it works for you, use it if you want to and don't if you don't" then there cannot be any assumption of liability by the user of whatever I've written.
Cheers,
Ian
If you had to prove code is solid, functional programming languages like LISP and ML would certainly make a come back. So it's not all bad. :)
Right now it's almost impossible to get good information on the quality of software. Heck there are even laws preventing it (like Oracles and Microsofts "no external benchmarking" BS).
How to do this right is a real problem. I would think though that one of the recognized bodies could set up some rules for the levels. (1. will not kill user, 2. will not format hard drive before use, 3. will not format the hard drive in standard use, etc..:) And the government would require software to carry a level that they promise the software will live up to.. even if it's no guarantees (the lowest level).
It just seems to me that software users need to be informed better what they can expect and then they will make the right decisions and over time their expectations/demands will increase.
DescSuit
Seriously though, there is no way you can fix "all" bugs, so releasing ANY software will just open you up to various lawsuits.
There is also a matter of who will be allowed to sue. For example, someone discovers a flaw, sues Microsoft, gets paid lots of $$$, Microsoft fixes the bug, posts a patch on their site, and a month later some other nut gets effected by the same bug. Should Microsoft pay that other nut as well just because they didn't upgrade? Many software problems are fixed soon after they're discovered, yet a vast majority of the people never bother to patch. (that's why these internet worms can spread, etc.)
Another issue is that many problems arise from improper use of the software. Most buffer overflow is definitely "improper use"... it is a security hole? Sure! But is it "regular" use? No! Software is designed with some proper use in mind, if you start to improperly use it, then sorry to say, the software wasn't designed for it. (well, granted, buffer overflow shouldn't be allowed, but just making a point).
In general the liability strategy will degrade software reliability, since a company will do a lot of in-house testing, etc., not releasing it into the public in fear of being sued. Now, no matter how many QA testers Microsoft or anybody has, they will NOT find all the problems in their software (60 million lines of code in WinXP???), AND they'll find a LOT less bugs than the general public. I know it's not nice to use your users as beta testers, but that's how software becomes reliable. People find bugs, complain, company fixes bug, and software becomes better and more reliable for everybody.
Then there is this whole thing about it being next to impossible to prove the correctness of a program...
"If anything can go wrong, it will." - Murphy
I was in architecture for 4 years before I moved to IT. Atchitects are responsible for every build they built until they die. I believe they're estates can be sued if a building falls down. Point is, Software is getting more and more important to money, wellbeing, and the market today. Wouldn't we want venders and even coders to be accountable for they're work. Open Source work its great but its not exempt from accountability...unless you just keep your code to yourself.
I guess I wouldn't buy plans for my house from a guys on the street corner, so I guess I wouldn't secure my computer systems with open source written by some kid in his basement. Only problem in that is the kid probly writes better code the Microsoft.
-- Disclaimer: I can't really back up anything I post on
If you want some kind of reliability guarantee, can't you already outsource to a services company like IBM and say "keep this system running, doing this, with -figure- availability and -figure- mean time between failure"? And have a failure to meet this commitment result in significant loss of payment to IBM?
Of course, such contracts don't come cheap. But then, we're comparing the creation of software to the engineering of bridges, skyscrapers, and bank vaults, and last time I checked bridges weren't cheap either.
This is what I suggest: /. has for Micro$oft. The courts must recognise that the implicit trust consumers have for megacorporate EULAs is illegal because you don't read the agreement. A questionnaire should follow the following format:
Companies selling software with a market capitalisation of over $100,000 have their EULA's have no meaning in a court of law UNLESS they quiz the customer so that he understands the EULA. This'll stop the "implicit trust" that everybody apart from
Who is legally liable for a failure in this software? (you must answer - I, the user am solely responsible)
User types: Me, I am solely responssiible mommy
What use restrictions are on this software? (you must answer - only me on my own computer and laptop)
User types: Only me on my own computer and laptop.
This is the *ONLY* way to get Joe sixpack to think twice about "signing" the document. This way people that sign a stupid EULA are gonna look the same as that stupid woman at the used car lot saying, "I signed the paper without reading it, and they took my house away, I didn't know it was written in the contract."
A caveman dreams of being us, the incalculable power and riches. We dream of being Q, then what?
to design you a house,
then when he was almost done, said that the walls must be made from foam.
....except the one on thats in the swamp....
....and now that you've disigned one house, it shoudln't take you long to do a few more...
..and did i say there has to be a high speed rail link between them...It must travel faster than the speed of sound, but never hit any animals that happen to wander on to the track.
..and can you make that house bomb proof....
whys that house got walls made out of foam?
thank God the internet isn't a human right.
Obviously, preventing people from coding would be a Bad Thing[tm], but something that says "if you sell something, you are liable for what you sell" is not necessarily bad. It would mean that Red Hat would be liable towards whoever they sell their distro to, but J. Random Hacker would not be liable towards RH for whatever code he has written that is in RHs distro. Unless, of course, RH was paying J. Random Hacker.
So, what RH would be selling, is something valuable; they will be selling a warranty. Of course, prizes for the distro would go up, but I wouldn't say that is a Bad Thing[tm] By Default. Moreover, suits will eventually understand what kind of product they're buying, and they will realize there is actually quite a lot of money in Free Software. Which isn't a Bad Thing[tm] By Default either. It may mean that distro-sellers can put an even greater effort in making things secure, which means better software for all of us.
Besides, we all know that Free Software is usually more solid than locked-up software, don't we? So, M$ will have something big coming their way, and that may be sufficient to open up the marketplace for Free Software, so that we can gain the foothold we need. If our software is better, M$ has a lot more to fear than we do. I mean, I'd love to sue them for the many megs of bandwidth Klez has robbed me of.
In conclusion, I don't think software liability is necessarily bad as long is it follows the money.
Employee of Inrupt, Project Release Manager and Community Manager for Solid
Let me make a suggestion: If you produce a closed source product where you release only the executables then you should be held liable for any damage the product causes. If, on the other hand, you release the complete source code for your product then caveat emptor. In the later case the user/purchaser has all the information necessary to (a) evaluate the safety and security of the product and (b) make any modifications necessary to bring the product up to their standards. If they don't have the wit or the will to do so then they're on their own.
When buggy commercial software is rushed to market, and it's failure costs it's users money, the manufacturers of the software, like any other product, should be held liable. Companies like Microsoft and Oracle would whine and complain, but consider if cars failed as often as Microsoft's products. Having car buyers accept a licence agreement wouldn't exempt the big 3 from liability.
The Uncoveror: It's the real news.
. If the printer driver tanks the system, who do you hold liable?
The nitwits that designed the OS so a driver could tank it. Not to mention that incompatibility with drivers (which are not written by MS even when they are on the Windows installation disk) isn't the only problem. There are plenty of incompatibilities between Windows products!
A good OS should isolate different programs so one piece of runaway code is only going to tske down the functions it controls. Most versions of Unix do that pretty well. DOS didn't but it wasn't intended to be a good OS. It was a simple single-tasking single-user OS, and if something tanked you didn't lose too much by rebooting. Win 95/98/ME inherited some of DOS's weaknesses by design (to maintain compatibility), and due to the added complexity on a shaky foundation they were even more likely to tank - but they weren't intended for servers or heavy duty applications either. NT was supposed to be the server/heavy duty reliable OS - but it wasn't, and although it got better at each revision, even at rev 6.0 (XP) it still isn't really server grade.
The liability shouldn't be for writing crappy software, but for selling crappy software as if it were good software. False advertising...
I hold responsible the designer of an operating system so unstable that a printer driver can take it down. Is this the best excuse they can come up with? Because that sort of computing isn't "trustworthy" in my book.
Though it leaves a bad taste in my mouth, I kind of have to agree with Mundie on this. You have to keep in mind that an OS is just a software platform for running apps; it provides interfaces and file handling and hardware control so the wheel does not have to be reinvented repeatedly. Saying an OS should be crash-proof vs bum 3rd party drivers is like saying the C programming language shouldn't let you kick over the stack with an out-of-bounds array assignment. If you want to operate in a totally padded-cell environment, switch to Pascal (where doing anything efficiently is impossible). Admittedly, the notion of a printer driver nuking your kernel is a bit disgusting, but all it really takes is one really badly fnorded pointer. Such bugs would be taken care of in an open-source situation rather quickly, but it really is too much to ask for an Truly Unbreakable Consumer OS.
If a job's not worth doing, it's not worth doing right.
While this doesn't translate directly to the Free software world, the idea that the damages are limited to the amount paid in the first place is useful (and obviously workable, or this wouldn't be a standard feature of so many contracts). The issue over functionality is trickier - in the Free Software world, often people add features just because they think they're neat - and often they turn out to be. Where liability exists you need to worry about the extra liability you are taking on as a result of adding all these extra features, though.
Companies could supply software for (nearly) free without worrying too much about liability. Once the income from software sales becomes a signficant part of your turnover though, you start needing to ensure that the software is properly designed and adequately tested (of course thorough testing is no substitute for good design).
I'm unsure about how well this kind of measure would survive a transplant from a contract to a license agreement (since I'm not a lawyer).
Not at all, because they sold me the software under promises that it would work.
Not everything in life is a market. If I just write something for fun and hand it to someone else for free, then no contract or liability is implied.
Cheers,
Ian
The printer driver wouldn't have such an impact if the operating system had been designed properly.
Instead it's designed to expect everything to work perfictly all the time so a minnor defect in an idle printer driver could crash compleatly unrelated programs like security software ripping massive holes in the system.
Windows was designed to be a multitasker for Dos programs. Reliability wasn't a big deal as compeating multitaskers would usually crash simply becouse the dos application wasn't coperating. Users expected this.
But with Windows no longer running "I want total control dam it" Dos applications it continues to have the same design.
Operating systems that are made to be operating systems don't tank when a printer driver screws up.
When a video driver crashes you lose video.. that sucks... but everything else works...
Keyboard driver crashes... shut down with the mouse.
When I had video, keyboard and mouse drver problems I ran a TV 100 on my box.. at worst the computer continues to work.
Yes Microsoft can't be called to blame when a printer driver tanks.. they can when that causes a BSOD.
The damage should be limited to the printer driver....
On anything else it would be...
I don't actually exist.
Plumbers aren't liable if someone comes around after they have installed central heating and heats up the joints (or drills a hole, etc) to create a leak, so why should software engineers or companies be liable when someone tries to break the code?
I beg to differ. A more fair analogy is if you hired a security firm to install a security system, and then you later found out that the cameras couldn't see criminals wearing green. Suddenly, once this is figured out, people in kermit the frog costumes start breaking in and stealing your stuff, and the cameras never saw a thing.
Far-fetched and silly example, yes. But it underscores the difference between your analogy and the real situation. If IIS or Internet Explorer has a hole that allows a remote root attack on your system, comparing it to a plumber's job is a very bad analogy.
Now, if you compared it to a plumber that decided to run all the pipes along the outside of the building to save money, instead of running them underground and in the walls, and then a "criminal" came along, tapped into the outside line, and fed poison into your drinking supply, then that plumber should be liable. As long as "reasonable" measures were taken to prevent that, then there's no liability (i.e. internal plumbing, and a criminal got hired as a janitor, and got access to the plumbing in the basement, then tapped into the system, then that's not the plumber's problem...)
I think that the original poster's point was that a printer driver should never be in position to crash the OS. The driver doesn't need to be in whatever passes for "kernel space" in Windows. Unix systems can communicate with printers, yet those aren't kernel-level drivers.
Just as it does the auto industry. Only the largest corporations can afford to absorb risks and mitigate them.
Yep. People bitch about large corporations running over the little guy. Well, laws like this proposed one are the reason. The smaller companies can't afford the teams of lawyers they need to help them navigate the legal minefields.
It's not possible to legislate quality anyway. Talk about your counterproductive laws.
I think he was trying to bring in the idea that the software world changes far far faster than any other engineering profession (save perhaps electrical engineering) and that, say, something designed 30 years ago in the software world is like a civil engineer trying to work with buildings built a thousand years ago. It's a fairly flawed analogy, and besides that it doesn't make much sense.
5. 'Software is a FAR more complex art than any other form of engineering.' --- this is just sad, and shows your complete ignorance of anything outside of software development. You really need to look beyond yourself, and see that there is more to the world than your invisible cathedrals of code, man.
Actually I've heard of this before, occasionally from engineering professors with experience in many disciplines. I wouldn't go so far as the original poster and say it was "FAR more complex," and it's obvious the original poster underestimates what is required from other disciplines.
I buy a tire for my car and it blows out in thirty days- I get my money back. Why is software so different?
Because then you start getting copyright protection arguements. I used to see a few places that would rent out PC games like 7th Guest when they first came out, but you don't see that anymore, because of the piracy worries. Once you open the package, it's bonded to you for life. :P You can exchange it.. but only for the same package, since it's assumed that if the package is opened, then you still have the software installed on your computer. That's why you can't return software if you don't like it. That covers bugs and non-bug concerns.
Interesting.
Well, to be consiistent I suppose the answer must be 'no - there is no implied liability'. That actually works to open source's advantage, as it removes the usual support argument.
Cheers,
Ian