Slashdot Mirror
Software Customer Bill of Rights
Cem Kaner of Badsoftware.com has written up a Software Customer Bill of Rights. Very appropriate considering our recent stories about Microsoft viruses, Dell's BIOS-clickwrap licensing agreement, etc.
← Back to Stories (view on slashdot.org)
But this is America. Consumer rights are secondary to business rights...
"Today a local man was arrested for screaming at employees of a local 'Best Buy' store after they refused to sign a contract he had printed out. Bystanders claimed that he refused to buy any of their products unless they signed said document, and that NOT signing would be a grave injustice. Our sources have told us that he is currently being held in Bellview Psychiatric Hospital, and is undergoing observation."
I am a filthy pirate.
But then IE crashed.
Just kidding! I'd never use IE.
When has any product ever "lived" up to the marketing claims? If I expected everything I bought to live up to their claims, I'd be dissapointed with every bar of soap, every beer, and every Big Mac.
If I could have manufacturer's adopt one part of the consumers bill of rights, it would be to advertise with honesty. Do not sell me a software product which does not live up the advertising.
The one part I disagree with is the reverse engineering. Companies have a right to sell software and to ban people from reverse engineering it.
Rosco: "If brains were gunpowder, Enos couldn't blow his nose."
"1. Let the customer see the contract before the sale. It should be easy for customers of mass-market software products and computer information contracts to compare the contract terms for a product..." It would be interesting to see how the court opinions which make this right one of the few listed which are already enforcable would serve as precident in relation to the new agreements imposed by microsoft as one installs mission-critical updates. Would drastic changes to EULA's made by Microsoft in software updates which are all but absolutly essential for the wellbeing of your data, etc, be court enforcable? Probably not...
Nice piece. Very nice, and very never going to happen. At least as long as opponents are large corps with armies of slick lawyers and proponents the EFF, RMS and a few computer-educated consumers.
...
...
Remember, most computer users still think software crashes and glitches are part of life with a computer, that viruses and worms are the work of evil pirates and that Microsoft is the victim, not the cause, etc
In short: it'll never happen. Move along
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
You must not have seen the herbal essence commercials then.
some strong feelings to hold companies fully accountable for losses caused by their products' defects
I can see where this view is coming from, but seriously; the litigious culture that is developing in the USA (and therefore no doubt on this side of the pond before long) could have a grave impact on your economy.
You have to take a certain degree of responsibility for your own action. Otherwise, everybody will just be too scared to do anything, and every American will just stay in bed all day.
You NEED suppliers to be a viable business yourself; and in return those suppliers deserve a leniency from you as far as accountability goes.
In return you get leniency from your customers as far as your own liability goes.
As the owner of a small software business, I feel comfortable with the fact that whilst I cannot sue Microsoft's ass if something goes terribly wrong; neither can my customers sue my ass.
Swings and roundabout; 6 of one...
Oh, you mean that one that was patched a whole month before? Or are you talking about that e-mail attachment virus, the one for which you apparently expect Bill Gates to show up at people's houses telling them not to run the attachment?
How is it Microsoft's fault if users run the attachment? Is it Linus Torvalds' fault when there's a sendmail hole? Is that suddenly a "Linux hole?"
Just curious.
"Sufferin' succotash."
IMHO, there's one the omitted from the list:
11. The user shall have the right to view the source code on demand.
If I am running your software on my computer, I have the right to see what exactly it is doing. In 99% of the cases, I would not exercise this right, if I believe that the software is doing what it is supposed to do and I have no suspicions that it is doing something funny. I have a Red Hat Linux system but don't have most of the source code RPMs installed, or the full Linux kernel source installed. It's good enough for me to know that I can acquire it on demand.
And before I get flamed for sound like a clone of RMS, realize that seeing the source code is not necessarily the same as modifying and redistributing it. All Free Software is Open Source, but not all Open Source is Free Software. I would, however, object to having to sign NDAs to see source. You can tell me not to redistribute your source and I will abide by that, as that is simply following existing copyright law, but I would not accept a blanket gag order to not discuss the source at all.
Of course, this will probably never happen, but its a nice thought, anyway.
Karma: Frotzed (mostly due to the Frobozz Magic Karma Company)
This is beautiful. Make it clearer, though, that we're talking about use licenses/single purchase licenses, not source code copy licenses such as the GPL. You need to very clearly define what kinds of purchases this bill of rights applies to, or software manufacturers will wierdly try to define their products so they fall outside the bill of rights' scope.
I wonder what would happen if 40,000 slashdotters mailed a copy of this to their respective congressferrets?
The only thing I would add is to see if there's any reasonable way something can be done about the fact the BSA has made it a criminal act to own lots of software and have less than perfect archiving of license paperwork.. I don't think there's any way that could be done in a reasonable manner within this "bill of rights" though...
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
What you need is some sort of consumers' organization -- some sort of Ralph Nader type thing. There is a limit as to what one screwball can do, but a whole organization full of screwballs, all making noise ... even Microsoft would have to pay attention.
Is there such a thing as a Software Consumers' Association? I couldn't find anything like that using a quick Google search.
Toronto-area transit rider? Rate your ride.
As long as software publishers can get an ear from congressmen and senators that I can't get... and can deliver cash for elections that I can't... they'll get benefits that I can't.
Just for reference, for those who don't have time to R the FA, here are the ten items listed in the Bill of Rights, without the explanation.
(Note, this does not excuse you from reading the FA, there will be a test.)
Software Customer Bill of Rights
1. Let the customer see the contract before the sale.
2. Disclose known defects.
3. The product (or information service) must live up to the manufacturer's and seller's claims.
4. User has right to see and approve all transfers of information from her computer.
5. A software vendor may not block customer from accessing his own data without court approval.
6. A software vendor may not prematurely terminate a license without court approval.
7. Mass-market customers may criticize products, publish benchmark study results, and make fair use of a product.
8. The user may reverse engineer the software.
9. Mass-market software should be transferrable.
10. When software is embedded in a product, the law governing the product should govern the software.
Bonus points if you can figure out which of the above *didn't* have a detailed explanation in the original!
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
The software and service licensing has become ridiculous over the last few years. They create these huge legalese documents, and imply agreement to them by opening a package or using a service. And, try returning a piece of software if you don't agree to the license, good luck.
While these agreements become more complex and onerous, the people creating them have taken on no responsibilities to clarify the licenses, explain the reqstrictions, etc.
If the companies are allowed to use these licenses, they should be required to have an independent citizens rights group translate/rate the license to compare it to accepted norms of how restrictive the licenses are. Rather than expecting each person to read the complete license, or have their lawyer interpret it for them; it should be analyzed by a professional and summarized in simple language. It should also carry ratings on a few key points, like how much it tries to limit product usage, resale, reverse engineering.. and, related areas like privacy protection by the company.
I went to read this article thinking I would probably end up posting and saying that the US is too litigous, that it's dumb to have agreement upon agreement, even on the side of good, and that it was probably just a bunch of whiny rights.
What I found, though, was a simple, precise set of terms that are wholly agreeable. Nothing in that document is the least bit complicated or overbroad.
Let us see the contracts before we have to agree to them. Don't take away rights we already have, like criticism and reverse engineering, and first sale. If you know about serious bugs, tell us. Don't lie about what the product does.
That's pretty straightforward, and should not be the least bit damaging to anyone selling decent software.
Y'know, I was just thinking this exact same thing on Friday - that the software industry is having a serious identity crisis at present. They can't figure out what products they're selling, and how they're doing it. They're mostly driven by the profit motive: How can we generate more profit? Which is great if the answer is, "build a better product" - but crap if the answer is compulsory upgrades, limited-time licenses, or license audits.
But there's a big one missing, particularly important in light of Symantec's foolhardy announcement:
The software can be installed on multiple machines.
I own a notebook and a desktop home server. I use both of them basically as a unit - sometimes literally, via Terminal Services or Synergy. They achieve different purposes - the server provides infrastructure (holding data, managing requests from other users [e.g., web pages], network security, MP3s), while I run actual applications on my notebook.
With this setup, it only makes sense to have a roughly identical set of software on each. I don't want my word processing solely on my notebook, and I don't want all of my security apps solely on my server.
So it's exactly that reason why this product-activation crap is odious. If I want two functionally-identical machines, I have to buy two operating systems, two word-processing packages, two versions of TurboTax and Symantec. similarly, with DRM, I'll have to buy two licenses for every piece of media I want to play. Others will follow down this path to the seedy underworld of profit-driven software.
It only seems fair that I expect to pay only once per software package. After all, I'm one guy; I'm never typing on both machines at the same time. Now, I understand why software companies are reluctant to release software that can be installed a trillion times, because it tends to get purchased, like, eight times, and then widely distributed on IRC. But at the same time, they're smacking down guys like me.
So with that in mind, I propose: Let software be installed on multiple machines. That number can be limited, and it can be small. Ten is fine - if I install software on more than ten machines, I should probably be purchasing a site license. But one is insufficient, in this day of frequent multiple-computer ownership.
- David Stein
Computer over. Virus = very yes.
I sometimes long for the 80s. Sure I might wait years for a software release, but with a few exceptions, it always worked. And it usually worked as advertised. I miss products like WordPerfect 5, it worked right out of the box. And if I had a problem I could call someone and actually get help, as opposed to a prepared statement.
So I feel it needs another article:
11. A software vendor will provide real support for the products they sell. Or A software vendor will outline in detail what; if any, support they provide and what guidelines they use.
How about the right of customers to copy distribute and modify freely. The other problems will take care of themselves.
I suggest that he add:
Source code and documentation will be placed and maintained [updated] in bonded escrow.
If the software product or hardware product reaches end of life and the current company does not develop a follow-on product with corresponding upgrade offer to registered customers, then the source code [software and firmware and documentation in digital format] will be sent to registered software and hardware customers, and, the source code will declared open source and offered to all via internet. If the initial development company is sold, source code will be offered and sent, if requested, to registered software and hardware owners. If the initial development company ceases to exist, source code will be sent to registered software and hardware owners, and, the source code will be declared open source and offered to all via internet. If an operating system integer upgrade [v1.X -> v2.X] requires the user to purchase new operating system software or hardware, then the source code will be offered to registered customers.
Failure to make source code available when a product reaches end of life or other conditions listed above will result in the top five officers of the initial development company (and the top five of the purchasing company, if a company purchase is involved) [CEO, COO, CIO, CFO, etc] being fined no less than $1,000,000 each, not payable by insurance company or current company; and will result in their forfeiture of all of the monies the executives received from their respective companies; and, will result in their receiving three years in prison without possibility of parole.
A bill of software rights may or may not make headway. However, it would seem to me that a consumer protection label could work, since the model has been applied successfully in other industries. What I envision is some kind of up-front, package labelling like the following:
Caution! By agreeing to use this software, the vendor may access your private files at any time.
Caution! This software is unprotected and may expose you to foriegn programs (virus and worms) that may corrupt your documents.
The benefit to consumers, of course, is that no software manufacture would want to have these labels applied to their software.
Any attempt to form a "Software Consumer's Organization" will have a BSA bullseye painted on it in a heartbeat. It would be far more exciting to see the Alliance Against Fraud in Telemarketing and Electronic Commerce (AAFTEC) decide that current software licensing practices are deceptive, fraudulent and unfair to consumers.
There is no Software Consumers' Association, but I have worked with lawyers from Ralph Nader's Consumer Project on Technology and from Consumers Union on software contract law.
When public anger with an industry rises, legislators get tempted to create laws to regulate the industry. Software publishing is particularly vulnerable because so many publishers have engaged in business practices that would be considered outrageous (and unlawful) in traditional markets AND because this is no longer a wildly expanding industry / employer in the United States.
We can lay out some principles to advise those legislators, or we can lay back, and later complain that they got it all wrong.
Cem Kaner, Professor of Software Engineering, Florida Institute of Technology
Let me clarify some of the issues that I see raised in the comments:
1) My proposals are primarily in support of disclosure. For readers who prefer free market accountability to litigation, that's what disclosure rules support. To make rational decisions in an open market, the customer needs information to base the decisions on. The information rules that I advocate are not far from laws that currently govern traditional sales:
- The customer can see the contract before the sale and use that knowledge as a factor when comparison shopping (and the press can help customers comparison shop by publishing information about the contracts, such as warranty policies, support policies, etc.)
- The company is accountable for its claims. I'm not talking about claims like "our burgers are yummy." I'm talking about "statements of fact" (specific statements that can be proved true or false). Laws governing warranties, fraud, and deceptive trade practices make these claims enforceable in the traditional markets. If you can't hold the company to its claims, you can't know what you're buying.
- The company can't prevent mass-market customers (and reporters covering mass-market products) from publishing comparison studies and product criticisms.
- The company can't prevent mass-market customers from using reverse engineering to discover bugs and security holes, false claims, etc. (NOTE: Patent law protects the original ideas in a product, whether you reverse engineer them or not. Additionally, my proposal doesn't invalidate a restriction against using reverse engineering to help create a competiting product. It invalidates restrictions that bar people from doing non-competing things, like discovering problems, making this product interoperable with others, fixing bugs in products that a company no longer supports, etc.
- The company has to disclose its KNOWN defects. Note that failure to disclose significant defects in traditional goods can be prosecuted under the deceptive trade practices or unfair competition laws.
The next main theme is privacy/security related. These are ground rules, not litigation magnets. Don't transfer data from someone else's computer without permission, don't block their access to their own data (a trick that some companies use to force customers to renew licenses or agree to unfavorable new license terms) and don't cut off their rights to use software they've paid for without a court order.
This isn't about bugs. It's about misconduct.
Do we need to polish the language to make that distinction clear in the legislation? Of course. This is a set of principles, not legislation. The goal here is to present the ideas simply (while giving enough footnote-links to provide context for legally knowledgeable readers). Legislative precision comes after appropriate people accept the principles.
SO WHY BOTHER? WHAT'S THE POINT?
The software industry is increasingly vulnerable to regulation. Software publishers aren't creating masses of new jobs in the United States. They've made a lot of people angry, partially because they've been doing business in ways that would never be tolerated under traditional American sales law. The most visible representative of the industry is a monopoly that seems to be so greedy as to be willing to try to wipe out even the research / scientific / free-public-benefit community in order to preserve or trivially increase its market share.
When companies look like they're more about greed than about providing benefits to the country, they become vulnerable to regulatory proposals. If their business practices seem dishonest and their products cause widespread, well publicized social disruption, some legislators will introduce bills to regulate the industry. Every crisis is another opportunity for legislation.
Not necessarily good or wise legislation. If we want THAT, it's up to us to advise legislators. Otherwise, they'll do what they do and we'll complain about it later.
Cem Kaner, Professor of Software Engineering, Florida Institute of Technology
The Free/Libre/Open-Source Software (FLOSS) movement seems to understand this, but many mass-market proprietary software developers are still able to flout this rule. Unfortunately, most computer users have become accustomed to being subservient to their software.
My own experience with most FLOSS has been much like my experience with high-speed Internet service: I can never go back. I think once people get a good taste of what using well-behaved software is like, things will quickly change. The only things that can get in the way of this change are: