Slashdot Mirror
Indemnity Protection for Linux?
spookymonster asks: "I'm a mainframe sysadmin for a Fortune 50 company. I'm also a Linux hobbyist. About 18 months ago, my request for a proof-of-concept z/Series testbed was granted, and the results have been encouraging. Despite this, senior management keeps saying that Linux isn't ready for prime time. Today, I was finally able to corner one of them and ask him what exactly his issue was with Linux. His answer: Indemnity. All our other software vendors provide protection against someone suing us for using their product. Who protects us if a third party sues us, claiming Linux infringes on their copyrights? Sadly, I was at a loss for words. I've done some digging on Google, but haven't really found anything on the subject. With the SCO/IBM lawsuit heavy in the headlines of late, I figured I'd turn to the Slashdot community for answers. How do I respond to questions about Linux and indemnification protection?"
It's really a good question, and I have no answer
/. is US-centric, but
for you, I'm sorry.
But I want to extend the question on BSD Unix, i.e.
OpenBSD, NetBSD and FreeBSD.
Also I want to remind you that
the world is more than USA. I'm, for example,
under European law.
My Karma isn't excellent, damn it! (And
These aren't good answers, but maybe it start you thinking "outside of the box."
1) Will MSFT really provide this indemnity protection? Do they say they will? If so, has that provision ever been tested? If they don't, or won't, then of course it's not fair to compare apples to oranges.
2) OTOH, you might try 'speciality' insurance companies. I have no idea what the rates would be like, but you can certainly buy insurance to cover any eventuality you can imagine--another poster here once talked about purchasing insurance against the loss of moon rock that they were testing. Which is just to say--just because "Linux insurance" isn't on a regular schedule doesn't mean that some actuarian won't give you a price. If you need to make calls, I would start with "Lloyd's of London", known for providing insurance for unusual events.
Finally, I think your concern is a real one--what's to stop me from using code that I developed elsewhere and contribute it back into the Linux source?
--
$tar -xvf
Tell that to users of MS SQL Server users who are liable to pay royalties to a third party.
What's the practical difference buying from, say, Redhat over buying from MS or Oracle?
"Your OS is writing checks your company can't cash."
Buy it from a vendor.
Perhaps none of them will offer the level of indemnity that you require, but if you ask enough of them, it may convince one of them that this might be a viable business model, and start offering it in the future. Essentially you'll be paying for insurance rather than software, so this would be an interesting new way for making money from open source.
Just look at the the MSSQL ruling posted to slashdot not to long ago. MS left some of their customers out to dry to pay royalty fees to a third party because MS's license didn't allow customers to use it.
Stupid things kids do.
Of coursse, this is at the start of litigation, and no-one knows how it will turn out. But isn't this exactly what your executive is worrying about happening with Open Source software? And this is from the Godzilla of them all, Microsoft.
No-one can make you perfectly safe from such claims - valid or invalid. But with open source, it shoudl be a lot easier to establish the truth of such allegations, because the source is available, and trackable, a long way back. If closed-source supplier A alleges that closed source supplier B has pirated code, you are into heavy calibre lawyers before source gets disclosed under court order. With open source, you go to the CVS tree, check earliest versions, check dates.... False claims should be seen off pretty quicly. And someone filing proprietary code as OS would be pretty visible (and spurned) within the community.
And if it turns out that you have been using some stolen code, with OS you at least have the option of throwing out only the stolen bits and rewriting them, whereas with closed source you are dependant upon your supplier doing that for you - if the lawsuit hasn't destroyed them, which it would do for a small company (and then where is your indemnity? At then end of the trail of unsecured creditors, I should think).
To summarise: such situations are much less likely to occur with Open rather than Closed source. If they do occur, that indemnity has a good chance of being waste paper. Meanwhile, you have paid out *a lot* in licence fees for a very threadbare security blanket.
Consciousness is an illusion caused by an excess of self consciousness.
All our other software vendors provide protection against someone suing us for using their product.
You mean someone can sue you because you are using a program that infringed a law, but you weren't aware of? Or would you be aware, ie: The software producer would inform you that his product infringes a law?
I didn't get. Is this possible? I am not from USA (if you are), so things might be different there.
But wouldn't this be like RIAA suing listeners of a radio that plays "pirated" music? Or BSA suing players of a LAN house over "pirated" Half-Life copies?
Just want some clarification of why, and how, this is possible...
Buy a Nintendo DS Lite
Sounds like he was just looking for a pretext.
All our other software vendors provide protection against someone suing us for using their product.
If anybody indemnifies anybody, it's usually the other way around. At least all the Microsoft EULAs I have seen say something like
(this one is taken from here).In general, I think anybody who offers a Fortune 50 company protection from lawsuits is a fool or speculating that they'd go bankrupt anyway if that should ever come to court (and you would still get sued).
I also doubt this kind of indemnity would be useful for Linux even if someone offered it. I mean, how often has this come up over the last decade? These kinds of lawsuits seem like such a rare occurrence when it comes to open source software that it just doesn't seem worth worrying about.
It would be interesting to see how RedHat is going to provide security to me. The original poster was talking about enterprise level Z/OS machines, not a farm of x86 boxen. The world doesn't revolve around the hordes of college geeks and the ubber fast 'leete machines they run. Your bank can't afford to be caught with their pants down, and that is why they go with the IBM flavor of Linux, which is bastardization of SUSE. But, for all who care, IBM offers the exact protection the original poster is requesting. I know, cause there is a Z/OS mainframe box on this floor that we run linux on it. While this one isn't in a development role, the shrink wrap wouldn't have made it into the building without our in-house legal department's approval first.
OK, your management isn't hot on linux because they can't sue anybody if it doesn't work. I'm not familiar with VM/ESA's licensing agreements, but I can't name a single vendor that produces a product that their licensing claims is useful for anything, or that will indemnify if the software is a complete piece of crap. Nothing else in the US can be sold with the same disclaimers against liability as software because of the Consumer Protection Act. You can sue the vendor if you buy a lamp that has a defect that causes your house to burn down. You can't sue your vendor if their software loses data, infringes on someone else's patents and you get pulled into a liability suit, or their OS can't stay up for more than a week without hard-crashing.
Now, I'm going to go out on a limb here and guess that you're in a shop that already has at least one z390 available, or that your company has a lot of cash to burn. The reason I am inclined to this opinion is that a nice, shiny new z390 costs about $50K USD. Having a partition added to an existing z390 costs more than my car and my wife's car put together. In either case, there is still a real cost per cycle of computing on that platform that even a PHB can see. Find out what IBM is providing license wise under VM/ESA that they don't provide under their licensing agreement with RedHat. Then study the costs of the migration to linux. since any mainframe OS has monthly licensing costs (last I checked, which I will concede was more than a couple of years ago), long-term migration to OSS on the OS side will eventually come out on top dollar for dollar. It also can't hurt to point out that IBM seems to have concluded that linux is the direction for all of their server-class and mainframe machines in the long term.
As an aside, for those of you reminding this guy about the MS SQL 7/2k licensing issues, this case has been in court for about 3 years, and everybody who is about to get hosed on patent licensing was told by MS's PR dept. that they didn't have a thing to worry about. Part of what the customers are getting nailed to the wall on is the > 2 1/2 years that patent licensing has been a known issue where they didn't talk to the patent owners and acquire the appropriate licensing for their copy of MSSQL. In any case, the indemnification argument could work incredibly well as an argument to move away from MS on the smaller servers, but you are going to have to do some homework to get anything done about the mainframes.
Few people, even business directors, have the legal knowledge to understand licensing issues. It sounds like this guy is just trying to throw out legal jargon so that you cannot argue the points technically. It is an avoidance technique.