BBC Commentator Goes After Software Licensing

An anonymous reader writes "Bill Thompson, a regular commentator on the BBC World Service programme Go Digital, criticizes current software licenses (including the GPL) for giving developers 'freedom from responsibility which would be considered wholly unacceptable in almost any other sphere of activity, public or private'." From the article: "A friend of mine is a children's writer. When she writes a non-fiction book she is typically asked to sign a contract that indemnifies the publisher against legal costs resulting from errors of fact in the book. If she was to suggest a school experiment that involved drinking sulphuric acid, because she'd confused it with acetic, then she'd be in big trouble. Yet I can't do anything when a company produces software that exposes my online banking details to any script kiddie with time to spare, because I've agreed a license that removes such liability. "

Comments

agreed

[BushCheney08]

I agree. I should be able to sue CmdrTaco for getting me fired.

Bad analogy

[pmike_bauer]

Publisher is to Author as
Software User is to Developer
...BZZZZZT!

Re:Bad analogy

[kfg]

Well, then it's a damned good thing he didn't use that analogy, isn't it.

In fact, he didn't use an analogy at all, since author is to author isn't an analogy. He merely brought up the indemnification of the publisher to illustrate that in fields other than software authors can be held accountable for what they write and publishers do not wish to be the "deep pockets" target of the accountability.

And software has publishers too.

KFG

Re:Bad analogy

[sedyn]

Stepping beyond that kind of bad analogy, there is another one:

"If Apple turned round to nano users and pointed to a shrinkwrap "licence" on the high-design packaging that exempted it from the provisions of consumer protection law it would never get away with such a blatant disregard for its customers' rights."

But, if I go to a pawn shop and buy refurbished goods, which are sold "as is" then I have accepted more responsibility at the expense of supplier/creator liability.

Likewise, with free software, you accept liability for it being free. If it harms your system, then you should have examined it yourself to be sure. If you don't think that's fair, and that users shouldn't have to (possibly because they can't), I'd like to point out that I can sign a difficult to read contract without prior knowledge of law (which is especially important in "common law" countries, where the law is not always as explicit as it should be).

The moral of the story, hire someone to proof-read the code you want to use, just like people hire lawyers to check contracts. I know that I would like to see an increase of demand for programmers.

Re:Bad analogy

[richdun]

The moral of the story, hire someone to proof-read the code you want to use, just like people hire lawyers to check contracts. I know that I would like to see an increase of demand for programmers.

So what about software that comes without source? I think the greater point the author is trying to bring up is that even for non-free software, like say IE, how are companies held liable for releasing software with security holes? Most EULAs make you accept the software as is and doesn't let you sue the company later if their software causes problems.

About time

[bruce_the_loon]

It's about time that someone got up and did something about this. It's time we realized the customer comes FIRST and our comfort and legal safety POST.

Re:About time

[xtracto]

Landing On the Subject, when do you Expect it will be Realized that the EULAS are taking out our basic statutory rights?

Re:About time

[Skye16]

I disagree. You don't like buying/using my software because I'm free from any responsibility if it runs amok and kills your family and makes love to your motorcycle? Don't use it. I'm not going to make you. If you don't feel comfortable dealing with those circumstances on your own if they happen, then I don't want you to use my software products (not that I actually have any, but still).

If you don't like it - write up a new license claiming responsibility for whatever it is your software may do. Write whatever software you want. Users will possibly flock to you just for the peace of mind they would get (or is it piece of mind? ;D).

Of course, so will the lawyers, but hey, it was your choice (as a developer) to release software under those conditions anyway.

Re:About time

['nother poster]

That's like saying, "If you don't like me driving on the sidewalk and running over little kids then don't leave your house." What the artical was alluding to was that liability laws won't allow many industries to simply license out liability. I can't build a car, and then have the sales contract say "we have no liability if this vehicle bursts into flame and kills the occupants if rear ended." When Pintos did that in the 70's, Ford got bitch slapped. You notice Ford didn't rear end anyone, but they were still held negligent for making a car that explodes when rear ended. Why can software companies do this just because they license their products to their users rather than selling them?

GPL

[Joehonkie]

I bet his wife gives away her books for free, too. On a more serious note, this is more expansion of the culture of victimization and the lack of responsibility that is taking over the Western world. Nothing is ever our fault, we muyst always find someone else to hold responsible for problems that we should be tough enough and capable enough to not get into or to solve ourselves.

Re:GPL

[s20451]

So you're saying that software companies (say, for example, Microsoft) are actually not responsible at all when they release buggy code, and buyer beware?

Re:GPL

[gosand]

On a more serious note, this is more expansion of the culture of victimization and the lack of responsibility that is taking over the Western world. Nothing is ever our fault, we muyst always find someone else to hold responsible for problems that we should be tough enough and capable enough to not get into or to solve ourselves.

Fear and greed, and a lack of compassion. That is what causes these things.

Let's say theoretically, someone goes to a restaurant, orders a cup of coffee, and the lid isn't put on properly. The person spills hot coffee all over themselves.

Which is more likely to happen:

the restaurant apologizes, helps the person clean up, and gives them their meal for free
OR

the restaurant denies any liability, and immediately asks the person to sign a form saying they aren't responsible. They refuse to even apologize, for fear it will indicate they are at fault. This angers the person, so they seek revenge. Lawyers get involved. The media gets involved. It turns into a ridiculous circus.

Companies are afraid to be sued, because people are greedy. Companies won't admit ANYTHING for fear it will demonstrate some sort of fault. People are greedy, and know they can sue pretty much anyone they want. There will always be a scumbag lawyer or two to help mix things up, because they always seem to win in situations like this.

Re:GPL

[kfg]

I bet his wife gives away her books for free, too.

Giving a book away for free does not indemnify the author of accountability for its content. Were I to claim you like whipped cream and underage barnyard animals in an unnatural manner that might well be actionalbe as libel (assuming the claim were false), depsite this post being distributed freely.

Nothing is ever our fault, we muyst always find someone else to hold responsible for problems that we should be tough enough and capable enough to not get into or to solve ourselves.

Yeah. Those goddam irresponsible Pinto drivers are really to blame. They should have know those cars were particularly libel to blow up.

BSOD's are not like coffee being hot or Jarts being pointy. Heat and pointyness are not flaws in their design and construction and injuries resulting from them are based on carelessness, events the user could have avoided while still taking full advantage of coffee and Jarts.

BSODs happen because someone else was careless, nor is there anything the user can do about them and they prevent the user from taking full advantage of the system.

"Yes, ladies and gentlmen of the jury, my client mugged Mr. Smith, but Mr. Smith was fully aware of the risks he was taking when he left his house. Mr.
Smith is only a "victim" because he was not tough enough to resist my client. He should take responsibility for his own actions."

That dog won't hunt.

KFG

Re:GPL

[Anonymous Coward]

Nothing is ever our fault, we muyst always find someone else to hold responsible for problems that we should be tough enough and capable enough to not get into or to solve ourselves.

Now, are you making a comment about the end-users who won't take responsibility:
I am suing this company because I was able to remove the safety from their tool, and after I then hotwired the circuitry to be able to run the tool without the safety, I was able to hurt myself with their tool.

Or the companies who won't take responsiblity:
Yes, on occasion the product will blow up like a hand grenade, however this is rare, and usually caused by the user. You can't expect us to get everything right, these things are complicated.

Or was that a general statement that applies to everybody these days?

Personally, I kind of believe the third option. I think software companies need to take more responsibility, because some major companies have championed a ship-first/fix-later strategy, such that it has become the industry standard. The first thing I have to do when I get new software is to look for a patch, because there probably is one already. I don't expect it to be perfect, nothing is, but the condition a lot of things are shipped in is terrible, and yet they get away with it.

Now, the capitalist view is that the market should fix itself. If people don't like bad software, then they will only buy from companies who ship good software. Sadly, either people aren't interested in good software, or they don't realize what it is (or that it can be had). I think it extends further, though, as evidenced by the Wal-Mart success. People only care about the price tag. The difference is that if they buy a cheap blender and it doesn't work, they take it back. If they buy cheap software that doesn't work, they figure they did something wrong because they don't understand computers and don't realize that they are supposed to work all the time like a blender. Also, you aren't allowed to take opened software back, and you have to pay extra just to call the publisher about your problem.

So, basically, my view is that when people understand software better, the companies won't get away with as much, because people will know when something was a bug or not, and they are going to hold the companies accountable more often. However, it's going to take a long time to change the momentum, because the publishers these days have a good thing going and they aren't going to let it change willingly.

Re:GPL

[Geoffreyerffoeg]

we must always find someone else to hold responsible for problems

Yes. Because the average BBC columnist has neither the time nor the experience to audit every single OSS application on his computer. OSS has an advantage that the source is there, but many OSS writers think that it means they don't have to guarantee their software - after all, they can see that it's safe. The user's rights include the right to use safe code, and free programs (in either sense) don't relieve the programmer of the responsibility to write safe code.

And that's not just the average BBC columnist. How many people who run Linux have read through the entire kernel? How many people who install a GNU system, or KDE, or Mozilla, or whatever, on top of it, also read through the source code of those? I'm guessing zero. For that matter, I doubt Bill Gates has read through Windows' source code, although he certainly is capable of reading it and he has access to the whole thing. It's just that nobody has the time to read large software.

I think the solution is a security auditing OSS group. A few respected members of the community - and a few regular volunteers - should get together and read through at least the important parts of important existing software (e.g., Firefox, not xeyes, and the SSL code, not the about dialog), and verify those. With enough approval, the group says that the code is safe. This takes advantage of the open nature, but makes the concept practical.

Re:GPL

[gosand]

Or, as in the infamous McDonalds hot coffee case to which you are perhaps alluding, the company may have known about the problem for years and refused to do anything about it.

Well, I was alluding to that, just because it is so well known. But I didn't want to use it as an example for that reason. But in general, lawsuits have dehumanized us.

Re:GPL

[azrider]

The whole thing about licensing (and disclaimers) started in the late '80s. A company sued Lotus regarding a bid they had entered. The premise of the suit was that the spreadsheet allowed them to make an incorrect calculation of their costs (since the software did not catch *their* math error, it must have been defective). Although Lotus won the suit, since then *ALL* software companies include a disclaimer to the effect that they are not responsible for , among other things, your mistakes. It is much, much easier to point at the disclaimer than to try to argue in most courts of law the fine points of cos(6) vs. sin(6) or log(5) vs. log10(5)

Keyword

[mysqlrocks]

The keyword is that people agree to these license. If you don't agree, don't use the software. Or, you could buy more expensive software that comes such a guarantee. I can't think of any specific examples, but I'm sure the software that runs pacemakers has some sort of guarantee. However, it's very expensive.

Re:Keyword

[paranode]

Not only that but his analogy ignores that an entirely separate entity actively and maliciously misused or exploited the software to gain access to his personal information. Suing the software company would be like suing the acid manufacturer for doing enough to make sure it wouldn't hurt children!

Re:Keyword

[M-G]

Not only that but his analogy ignores that an entirely separate entity actively and maliciously misused or exploited the software to gain access to his personal information. Suing the software company would be like suing the acid manufacturer for doing enough to make sure it wouldn't hurt children!

Sort of. I was thinking along the lines of what if the acid was mislabeled by the teacher? That's more akin to someone setting up software but not configuring proper security around it.

All she has to remember is...

[MrByte420]

Little Johnny was a boy. He isn't anymore. For what he thought was H20 Was H2S04

Re:All she has to remember is...

[Enigma_Man]

Here lies the body of Johnathan Blake. He stepped on the gas instead of the brake.

-Jesse

Re:All she has to remember is...

[BushCheney08]

You may as well just pull out all of the The Gashlycrumb Tinies.

Sure thing, we'll get right on that

[Rocko Bonaparte]

Sadly, legislation is probably the only way to make software developers--or rather, their companies--more liable. What, you expect the free market to take this one on? Who here honestly expects a company to decide it's competitive to be more liable?

you don't "license" use of a book

[Yonder Way]

The license is an agreement. If you don't like the terms, don't accept the license, and don't use the software.

There is a lot of crap out there about companies liking proprietary software because it gives them someone to sue when the software breaks catastrophically. That Microsoft has about a $40 billion dollar war chest, earned almost entirely through the sale of very broken software, pokes some big holes in that theory.

You're getting software for free. Don't bitch about indemnity in the license.

Re:you don't "license" use of a book

[cowscows]

Yeah, there are places that require much more stringent checks of their software. NASA doesn't just quickly throw together stuff and upload it onto the space shuttle, they test the hell out of it. And so they get high quality stuff written directly for their hardware. The downside to this is that development is slow, and it's expensive.

So basically, if you want software that's guaranteed, you're going to have to do a few things.
A) Pay someone a whole lot of money to write it.
B) Test the hell out of it before it gets put in place.
C) Realize that this is going to take a long time
D) Probably pick some very specific hardware for it to function with, and not have the option to easily upgrade in the future.
E) Make sure you get all the feature requests and whatnot right the first time, because patches and stuff are not going to be easy or cheap.

The market, for the most part, has opted for halfway broken software for a couple reasons. Upfront costs, freedom to grow/update/expand more easily, and because brokenass Windows was good enough for a lot of stuff. Hardware increases allowed significant boosts in productivity, and to a large degree, software was just sort of along for the ride. Now that commodity hardware offers so much power that the drive to upgrade is much less of a factor, it might make more sense to focus more on software quality.

Separate Coding and Liability

[Renegade Lisp]

To be held liable for every line of code that you write goes very much contrary to the free software / open source world, where developers often simply scratch their personal itch, or work out of a genuine interest in the matter. It is impossible for such individuals to get the financial backing (i.e. insurance) so that they can take this level of responsibility for their creations.

The solution, I think, is that the realms of coding and of liability need to be separated. Let the coders code and let service companies such as IBM work together with them to provide support and, if needed, liability for customers that need it. This is exactly what happens when IBM "sells" Linux to Wallstreet, for example. They sell the kind of responsibility for the software that individual developers could by no means provide.

Re:Separate Coding and Liability

[KillShill]

how about people who write FOSS and therefore give away their code not be liable but people who sell err excuse me, PROPOGANDA MODE ON, "LICENSE" software have to assume liability.

no other industry on the face of this earth (except politicians) can sell you stuff and not be liable for it causing harm.

if you are a merchant, you are liable. if you stand on a street corner (or virtual corner) and give it away then your liability is orders of magnitude less (read: zero).

Typical Big Government Response

[geomon]

I would hope that Mr. Thompson considered the alternative that people often hold others accountable for their own ignorant actions. Yes, a publisher is often held accountable for the stupid actions of a reader (who would be stupid enough to drink sulphuric acid?). But is that situation an indictment of the author, or the court system that allowed an ignorant person to use the courts to make whole an action that the claimant should be responsible for?

No, I do not believe that everyone should be left to fend for themselves without ANY regulation. If someone produces a medication and makes a claim that a patient considered reasonable, and they get more ill or die as a result, then the company should be held accountable. But to make every fucking business activity subject to error and omission insurance will wreak holy hell on our economy. E&O insurace requirements will guarantee that

1) software development will slow,
2) software for process control will halt due to liability questions,
3) make lawyers and insurance companies rich,

all without one single shred of evidence that any of these effects actually made software development any *better*.

When I install software, especially for the first time, I do NOT have it on my production machine. Why do people like Thompson like doing things like this? Why should a software publisher spend heavily to debug (and still not get EVERYTHING) in a manner that *assures* the E&O insurer that it will not delete Mr. Thompson's latest mp3?

Wow

[valeriyk]

And shouldn't the companies that implement the code be responsible for the insecurities, instead of passing the buck onto the developer? If a company incorporates a piece of software, and does nothing to lock down the program, doesn't change passwords, doesn't configure it properly, shouldn't the company be responsible? A developer is responsible to a degree, but so is the user. It takes two to tango, and going back to the quote, if a kid drinks sulphuric acid, how did he get it? The parents are responsible for the kid... Just like the system is the responsibility of the owner/operator...

And...

[Ooblek]

....every software developer is supposed to know that a customer doesn't have people smart enough on staff to install software using anything other than the default install? There would be nothing but a blame game because much of commercial software depends on other software libraries, including those provided by the OS. If our courts can't figure out that P2P lawsuits are basically meritless, I'd hate to see them figure out who is to blame because someone installed a default option on IIS that had an exploit, yet wasn't required to run IIS with a vendor's software.

Don't get me wrong...bugs suck, but suing someone over it is as equally bad as releasing buggy software.

"Ahh yes," counters the Industry,

[Shadow Wrought]

"But see, if we had to ensure that everything worked all the time, it would take too long and nothing would happen. There would be no software."
"Oh, I hadn't thought of that," says the commentator whose argument proceeds to disappear in a puff of reality.
Meanwhile, Industry, rather content with itself, goes on to prove that black is white and white is black and is sued into oblivion by the DMCA.

No guarantees

[winkydink]

In many cases, there is no option for a more expensive software that comes with a guarantee. Yes, some software like hospital life support and air traffic control come with a guarantee, but that is why you will see many 'normal' sw mfgs license mention these applications by name and say that you should not use their product in these environments.

Re:No guarantees

[Chyeld]

Actually in all cases there is that option. Just because no one is willing to pay $150,000 to a software development firm to create a knockoff version of Quicken and guarantee a certain level of reliablity doesn't mean it's not an option.

What this guy is complaining about is the fact that he expects consumer level software to come with the same quality of proffessional level software. It's a bit idealistic and unreasonable.

If you aren't willing to pony up the money for quality, you shouldn't complain about the quality of the what you get.

Re:No guarantees

[R2.0]

No, he expects consumer level software to come with the same quality of consumer level evrything else. If I buy a cheap toy for my child I have certain expectations that it will function like it is supposed to - a warrantee of merchantibility. Whay cannot software function as it is supposed to

Why is that idealistic and unreasonable?

In my fantasyland the Supreme Court decides that the more onerous restrictions of some EULA's are against public policy and cannot be enforced. Not the GPL - that's not onerous. I'm talking about waivers of damages, warrantee, etc.

Sure you can sue

[CKnight]

You can always sue a service provider (bank, etc.) for such things as making your personal information public. They in turn however, cannot sue the software company (necessarily) because they (the bank) had an opt in. You can sue bacause you had no say in what systems the banks use, so you cannot be held accountable. You didn't agree to waive your rights and to accept liability.

Put yourself in the bank's shoe however. When you install an OS or any application that comes with a EULA, you have the choice to not use it if you don't agree. It's not ideal, and it puts you at risk, but you have a choice. That will always be the deffence of the software companies.

The argument can be made however that you actually DON'T have a choice, only the illusion of one. If you need to provide a service (or rather, have a service provided to you) and every product out there has a self indemnifying EULA then what option does a user have?

- I didn't spel chek

EULAs do not provide any more protection

[LightStruk]

Yet I can't do anything when a company produces software that exposes my online banking details to any script kiddie with time to spare, because I've agreed a license that removes such liability.

That's exactly what you've done when you agree to a license from Microsoft.
From the Windows XP Home EULA, with caps removed to get past lameness filter:

To the maximum extent permitted by applicable law, in no event shall Microsoft or its suppliers be liable for any special, incidental, punitive, indirect, or consequential damages whatsoever (including, but not limited to, damages for loss of profits or confidential or other information, for business interruption, for personal injury, for loss of privacy, for failure ot meet any duty including of good faith or of reasonable care, for negligence ...

and so on and so on.

With this amount of legal protection, I feel completely safe using Microsoft products!

Yeah...

[Anonymous Coward]

Let's make all software developers totally legally responsible for their programs. That way, the only people who can afford to write software are huge companies, and even computer progamming for hobbyists ceases to exist because of the liability issues surrounding the creation of code. It'll be sort of like the doctors who have to buy really expensive malpractice insurance as protection against frivolous lawsuits, only the people who have to pay in this case won't be pulling down doctors' salaries.

"life critical"

[CarrionBird]

Medial equipment, avionics, there's plenty of stuff that is specifically made for situations where failure is not an option. Consumer software is not such a thing.

What I'd like to see...(or maybe not)

[soft_guy]

Can you imagine what the lawsuit would be like when some user says "Software X deleted some file" and the software company says "No, it didn't." How would you go about proving this either way? Or in the case where perhaps a virus or something performs an attack on your software like perhaps a buffer overrun attack and causes the file to be deleted? OMG this would be messy for both sides. I can't imagine trying to make a jury understand the issues involved! I think they would end up picking a winner rather arbitrarily based on the personality of the lawyers and witnesses.

malpractice caps do NOT decrease premiums

[Travoltus]

Just so you know, malpractice premiums do not decrease for doctors in states where malpractice awards are capped to $250,000. Most lawsuits are launched when doctors maim or kill patients due to negligence, not because of highly publicized frivolous reasons. Your analogy is flawed, to say the least.

Now let's get back on topic. It's wrong for people to make excuses for bugs in code which expose my personal information to hackers, stalkers and marketers. I'd just as soon see the industry grind to a halt until they find a way to nip these miscreants in the bud. And no, I can't opt out of this dangerous system unless I stop driving (so much for being able to get food), close my bank account (yeah, hide my money under my bed so a thief has a reason to physically rob me and then kill my whole family to get rid of witnesses), declare myself dead (to retire my SSN - whoops, that's illegal, welcome to Club Fed! - or at least, welcome to joblessness) and practically move out of the country (well, actually that's a good idea if Canada is my destination).

Thanks to stupid programmers there's absolutely no way anyone can protect themselves from identity thieves. The only reason why someone hasn't hijacked you is that they don't care to.

Now please, come back after you find yourself having to fight for years to fix your credit after a hacker stole your personal information off Lexis-Nexis and then tell me they shouldn't stop the digital train for some major overhauls. Until you're a victim of the gaping flaws in the digital fortress you really don't understand the sharpness of that sword of Damocles that is swinging back and forth over your head.

Re:malpractice caps do NOT decrease premiums

[MaxwellStreet]

I'd just as soon see the industry grind to a halt until they find a way to nip these miscreants in the bud.

And that's exactly what would happen. Anyone doing any sort of business electronically will cease to do so.

There is no way for software to be written so that it's absolutely safe from people who are determined to break it. Depending on your paranoia level, you can believe (or be reassured by the notion) that certain 3-letter gov't agencies can decrypt any secure transmission you might make over the wire.

And your identity can be easily stolen for reasons that have nothing to do with stupid programmers. Anywhere your information lives, it can be stolen by someone authorized to use it - regardless of how tightly the systems are locked down.

Any system of any complexity at all relies on assessment of risk and assumption of best practices. Any system - from the space shuttle to an operating system to an e-commerce application - cannot guarantee absolute safety.

We'd probably agree that any company who, through gross negligence, exposes sensitive data should face legal exposure. But if every business had to fear that every minute flaw found in whatever computer system they've got running could lead to a lawsuit, it would shut down e-commerce (in all forms) overnight; and would set business and the economy back in a major way as the cost benefits that information systems (used both internally and external to the organization) are turned off under an entirely different sword of damocles.

Re:malpractice caps do NOT decrease premiums

[Fulcrum of Evil]

It's wrong for people to make excuses for bugs in code which expose my personal information to hackers, stalkers and marketers.

Bite me. Programmers don't control the schedule. They also don't decide when to ship, or to delay bugfixes for browser exploits for months. That's all up to managers - they control the schedule and the priorities are.

Re:malpractice caps do NOT decrease premiums

[Chyeld]

Wow, you impress me sir. Do you think you could introduce me to General Lud someday? I've always wanted to meet that guy.

First of, the majorty of successful identity theft cases out there have been proven to be the result of social engineering. Meaning, there were no bugs and there were no clever hackers exploting the computer systems. Instead, there were con-men tricking people into giving them information, there were theives sifting through the trash of some careless individual that threw out personal information with out destorying it. It means the problem isn't the 'bad bad programers' it's the idiots out there who are too stupid to think about what they are doing before they do it.

And you are right, I think THOSE people should be held accountable. And I also think that if you develop software for a company that is in control of that sort of information, it's their responsibilty to ensure that your software works or to make you responsible for making sure it works. THEY put the software and information on the same system. It was their decision to do so. Unless they've secured a guareentee that your software is safe from you, then it's THEIR responsibility. And amazingly enough, that's the way the courts see it too.

But that has nothing to do with a standard EULA. People do not steal identities by hacking Quicken. And even if they did, it was YOUR choice to put that software on your computer and make that information avalaible to it. Especially AFTER they've made you agree to a license telling you they aren't responsible for any bugs in the program. If you don't like that EULA, then follow their advice and DON'T USE THE SOFTWARE.

Re:malpractice caps do NOT decrease premiums

[Belial6]

"I'd just as soon see the industry grind to a halt until they find a way to nip these miscreants in the bud."

Yeah, and lets do the same for other products like houses. Lets not allow the sale of houses until they are secure.

With every product, you take risk. The trick is figuring out where the risk/cost sweet spot is. Obviously, Medical/Financial data needs to have stiffer restrictions than say, an online recipie book. This kind of logic is what leads to things like banks being more secure than houses. Obviously information that is used to create financial data should be considered financial data in and of itself. e.g. SS numbers, stree address...

Re:malpractice caps do NOT decrease premiums

[bigpat]

Now let's get back on topic. It's wrong for people to make excuses for bugs in code which expose my personal information to hackers, stalkers and marketers. I'd just as soon see the industry grind to a halt until they find a way to nip these miscreants in the bud. And no, I can't opt out of this dangerous system unless I stop driving (so much for being able to get food), close my bank account (yeah, hide my money under my bed so a thief has a reason to physically rob me and then kill my whole family to get rid of witnesses), declare myself dead (to retire my SSN - whoops, that's illegal, welcome to Club Fed! - or at least, welcome to joblessness) and practically move out of the country (well, actually that's a good idea if Canada is my destination).


and again

I'd just as soon see the industry grind to a halt

So, you'd like to see everyone just stop until it is completely safe, but you can't see how it is you could live without the systems that are in place. By the industry grinding to a halt, you mean your just going to stay home and eat your scrambled eggs until the world is without risk. Until your fluffy little world is just right to you.

Well, the world ain't perfect and you do have choice. And people should be free to assume whatever level of responsibility they feel comfortable with as long as there is no fraud. Doctors should be able to make patients sign legally enforceable waivers of complete responsibility from even claims of malpractice. And so too should manufacturers of software and hardware. If that car manufacturer want to make you sign a contract that says that their cars may explode upon key insertion and they are not liable for damages beyond the cost of the car, then that should be the way it is. Then let some decide to indemnify and other not and see if the price difference is worth it to customers.

Perfection costs time and money and is most often illusory, so to mandate it is a fools errand.

Accept the risk

[Red Flayer]

FTA: "Programmers have built their business models on a freedom from responsibility which would be considered wholly unacceptable in almost any other sphere of activity, public or private. [1]

We all pay the cost in wasted time, lost files, hacked systems and reduced productivity [2]. Our children spend time in lessons waiting for interactive whiteboards to be repaired [3] while businesses around the world suffer from crashes and security breaches. [4] "

Hey, you know what, Bill? You don't like the fact that you accept the responsibility and risk when you use the software? Then don't use it.

I bank online, not because I need to, but because it is convenient. I accept that there is a slight risk involved. If I only banked brick-and-mortar, and my banking information was hacked, who is liable? The bank, because they CHOSE to use software that is insecure, KNOWING that it is potentially insecure, is who I hold liable.

I enjoy using the internet. Do I need to use it? No. But because I want to use it, I accept that there is risk, and do my best to protect myself.

[1] Not so. How many stunt shows always start with a disclaimer that no one should try the stunt at home? Fore-warned is fore-armed.

[2] We all also reap the rewards of the software. Do our kids ride bikes, Bill? When they fall and scrape their hands, do we send the medical bill to the bike distributor, manufacturer, or retailer? We accept a certain level of risk. If the bike design is faulty, that is a different issue -- but then again, we never signed a usage agreement that disclosed that there might be problems.

[3] Why doesn't that classroom have a dry-erase board or a chalkboard? Why is the teacher incapable of instruction without it?

[4] Businesses would suffer more if there were no innovation in software due to possible lawsuits. Businesses would be better off putting systems in place to prevent hackjobs, to make sensitive information secure even if their system is compromised, to prevent extreme loss of business due to system downtime.

I think it is ridiculous for every tomdickandharry to want someone else to be responsible for the risk that they voluntarily took on.

Software is not a necessity. It is a tool that we use to help us do things more efficiently. The tradeoff for that efficiency is risk.

Re:Analogy doesn't fit

[rfc1394]

This analogy would make sense except that you can void a warranty (and assumedly any liability) if you make any adjustments to the car that could negatively affect its braking system, etc.

Incorrect. In the U.S., anyway, the Magnuson Moss Warranty Act provides that if you offer a warranty, it is not voided by third-party equipment or non-authorized dealer repairs unless the device or repairs contributed to the failure. If you replace the ignition system with a new high-powered nitrous oxide feeder, and the car explodes because someone rear-ends you and the (untouched) gas tank explodes, the manufacturer is still liable. Also, the warranty on the ignition system would be voided because of the modifications, if not made by an authorized dealer. But if you replace the battery and the brakes fail due to defects in workmanship, the manufacturer is still liable.

The same is true with software vendors only amplified a thousand times. Software vendors have no way of telling ahead of time what kind of hardware faults, existing programs, etc, are already installed that could interfere with the operation and security of the program.

If a software package improperly feeds data to another part or fails in saving because of errors in the code, this is almost certainly not a hardware problem. Most software companies won't warrant their products because they have no way to know their people are even trained to do the job, while at the same time places that develop software are either outsourcing the work to cheaper countries and/or refusing to spend money to train people because they'll be more valuable and they don't want to have to pay them more to keep them from leaving. It is all about money, nothing more.

I have no problem with someone claiming "as-is" on software given away or sold for a small fee; it is completely unreasonable to expect someone who is not receiving any money or receiving very little money for a piece of software to be able to afford to offer warranty protection. However, I do have a bit of a problem with companies releasing buggy software at premimum rates, and then disclaiming any responsibility for their own misconduct or incompetence.

Hmm. I just thought of something. One way to solve the problem is require a company to include source code at no extra charge to their customers a software product which is sold if it is offered as is or if they fail to do so they cannot disclaim any warranty. If the customer who buys the product has the source they have (in theory) the capacity to fix the problem; if the customer is denied source then the manufacturer must wartant its performance. This would solve the problem rather nicely; companies like Microsoft could either give away the crown jewels and thus have to provide the means for anyone who bought the product to understand it, or they would have to provide technical support and warranty protection as part of the retail price of the product. Claims that they can't afford it are belied by the extreme price charged for new copies of the program or the excessively high charges for maintenance, often times for which they provide absolutely nothing. If software developers want to charge premium prices they should be providing at least minimum quality warranty protection or allow their customers to be able to fix problems that develop.

Fallacy

[hunterx11]

FOSS != non-commercial. I sure as hell hope an institution like a bank wouldn't use unsupported software be it open or proprietary. But the author apparently hasn't heard of such obscure companies as "Red Hat" and "Novell" and "IBM."

Parially, yes

[brunes69]

If you as a company, invest tens of millions into a rollout of a new software product ( be it a new version of Windows, or a new Linux Kernel), without

• Fully researching the present and past state of the company or individuals responsible for the software, and their abilities both demonstrated and implied.
• Fully looking into [resent and past security issues with the software
• Doing a full independant side-by-side comparison with competitors

.. then Yes, you are responsible for a large part, if that software catastrophically fails. Because it is likely something you would have came across in all this research, in one form or another.

Take windows for example. If you lose $500,000 in a day because some critical windows server crashed from a certain DDOS attack, should Microsoft be responsible? Or should you be responsible, because you should have known from years of examples that Windows is very vulnerabile to those kinds of attacks, and you should either have an external protection mechanism in place, or not use the software? I think the latter. Then again, I am not the person who thinks "sue" when I slip on icy stairs in the winter and break my neck either. I think "maybe I should have bought better gooddamned shoes for walking around in the winter". The other commentors are right, there is not enough responsibility in the world today. Grow a backbone and stop sueing everyone.

Re:Parially, yes

[Anonymous Coward]

If you lose $500,000 in a ... DDOS attack ... , should Microsoft be responsible? Or should you be responsible

The responsibility rests with the people who started the DDOS attack. Ob Duh.

Who did you blow to get a +5, Insightful on that?

Re:Parially, yes

[jglazer75]

Except for the fact that at every turn Microsoft is telling you it is secure. That it's software will stand up to a DDOS. The firewall operator exists for the same reason. Yet, when that DDOS occurs, there is no recourse because of the disclaimer of liability by both MS and the firewall. "Oh, well you agreed when you clicked 'I Agree' that you acknowledge that everything we said prior was mere 'puffery' and that it was blatantly obvious to anyone that our products don't ACTUALLY stop a DDOS." So, yeah. If I install Windows (as opposed to say, some IBM provided Linux derivative) because of the express assertions by MS (or the firewall software - whose express purpose is to deny said attacks) that such-and-such configure will withstand a DDOS, then yes, I expect MS (and the firewall vendor) to be liable when said DDOS causes me $15mil in damages due to downtime of those servers. In other words, as a purchaser, why should I assume that liability when the purpose of the software purchase was to prevent the occurrence in the first place! As far as Firefox and other open-source. If I use Firefox, I have an expectation that someone was reasonably competent in their duties to provide software that will not allow my system to be compromised. I understand that it is "hard" and "time consuming;" however, that doesn't make the expectations any different. If I provide pro bono legal services, or free medical services, or I offer a free education, I still have a duty to provide those services in a competent manner. If I fail to meet those expectations, a court doesn't just say "Well, his services were free! what did you expect?" A court finds me liable for malpractice and I owe someone a lot of money. (whether I have it or not)

Re:Guarantee is spelled "liability insurance"...

[winkydink]

The cost of liability insurance can be prohibitively high or not available at all. I work for a company in the wireless space. We frequently see requests to indemnify against RF "frying your brain". Insurance companies (even the really big boys like Lloyds) won't touch it.

Bullshit. There's always an option

[Sycraft-fu]

Pay more. Find a company willing to take a contract that includes gaurentees. However don't bitch when it's way more expensive and that it takes way longer. Don't expect something cheaply turned out on the latest hardware in a couple months. Expect that it's a verified system that takes years of testing, and is rigidly controlled.

There are companies that make solutions like this, IBM is one of them. You can get a mainframe setup to do database work that will never go down, ever. However it'll be expensive as hell, you will run the DB and ONLY the DB on it, it will be accessed only in rigidly controlled ways, etc.

Ya, more or less

[Sycraft-fu]

You choose to accept the risk, in trade for the benefits. Designing a system with no bugs is expensive and time consuming. You have to test things extensively at every level. That also means testing all the possible interactions. Not only how the OS interacts with the hardware, but how it interacts with the software, and how it interacts with each other. So when you design a system like that, the hardware neede to be known, as does all the software. You can't have it run on random comoddity hardware using random software beacuse then unforseen problems can result.

So by choosing to run software cheaply and quickly developed in random environments, you choose to accept teh fact bugs may occur.

To me, demanding that commoddity software on commoddity hardware run without bugs is like demanding that an automobile on the public streets never get in to an accident, even one caused by driver error, unforsseen conditions, or other drivers. Can't happen. If you want gaurentteed operation, you need controlled conditions.

Re:No Single Vendor is Responsible for Software

[FreshFunk510]

You're right in that no single vendor is responsible, but you're wrong in that it means that a company can't be liable.

Similar analogies can be made towards anything that is built. When Ford builds a car, they don't create every nut, bolt and beam in the car. They probably buy a lot of the parts from third-party manufacturers and assemble them together. This is true for many products out there.

An analogy closer to home, is the system my friend's company puts out. They treat cancer tumors using some custom hardware run with custom software. But this software runs on windows and some computer hardware they purchase. However, there is a standard configuration for windows and the hardware that's approved by some governing federal medical agency to prevent any foul ups.

Depending on the situation, the assembler is or isn't liable. In the case of my friend's company, they aren't liable since this computer setup has been approved by a large, governing, official body. What about the case where Ford Explorer's had tires from another manufacturer and those tires exploded? Is Ford liable or the tire manufacturers? This is what our court system is for.

Your question is legitimate, but naive.

[PMoonlite]

If you could buy a version of Windows without the disclaiming of all liability, but it cost $10K and was tied to a very specific set of hardware from ten years ago (forget about choosing an LCD monitor, or plugging in a USB card reader, gigahertz CPUs, playing games, etc), would you buy it? No, I don't think so. But that's basically the option you're looking at.

Anyone who wants to can develop software and market it without disclaiming liability. But they would be used as floor mops by companies that disclaim liability. The only places that write that kind of software are those that can afford to spend exorbitant amounts on mission-critical software development because the possibility of failure is even more exorbitantly expensive. Check out what it costs NASA to build software for their space shuttles, and the kind of hardware they run it on; I think it will be illuminating.

Government could write a law prohibiting liability disclaimers. This would kill most software for its jurisdiction. I'm sure the carmakers made the same argument, but here's the difference: software is cheap and easy to develop, virtually free to distribute, and exorbitantly expensive to prove fitness for a given purpose (especially given the possible variety of configurations typically expected of software). Perhaps most significantly, in most cases it's generally cheap to replace when it's proven unfit. In this environment, focusing on guaranteeing fitness brings very rapidly diminishing returns.

Publishing Licenses are Lazy

[robbway]

If you've ever read any commentary by Christopher Rice in his books, you'd see how much disdain he has for those "pass-the-buck-to-the-author" clauses. Not every writer agrees with that concept! It's a lazy concept, akin to publishing super-offensive ads in a magazine and claiming no responsibility for the ad. Let's face it, the publisher should be responsible for the content they distribute to a certain degree, like publishing errors causing serious misunderstandings.

I don't know about the rest of you, but if she tells me to drink poison in a book, I'm not going to do it.

S.W. is not a complete product

[Dare nMc]

I think the bad analogy in this article is between the products. In the case of a book, it is a complete product. When a book is released, it is unlikely to be used for other than the intended purposes, and when used with another product it is not expected to still stand on its own (you cant subst the 265th page for another authors page, and expect it to work, but that is expected of the dll's, windows 98 vs XP, etc.)
Most software is either released inside a complete product, and the product liabilty is left intact. Or it is software inteded to be used with other software, and with the original programmers usually not being the system integraters, going back to a single person to be responsible is no longer easy or practical.

Re:How is it proven???

[ultranova]

It's called a journaled file system. HFS+ and NTFS are mere examples of this and they're the most widely used at this moment. You would have *NO* problem proving it as long as you could show the activity that happened. That's the point behind a journaled file system, to see what has changed and go back to a previous state if something undesirable happens.

No, the point of a journaled file system is to maintain the consistency of a file system even if the system shuts down unexpectedly. This is done by writing all the changes to be made to the filesystem into a journal first, ensuring that the journal has been written to the disk, marking the journal entry as complete and then writing the changes into the disk. If that write gets interrupted, the system will simply replay all the writes in the journal the next time it boots up, resulting in a clean file system.

The point here is that the journal is a temprary place to keep modified disk sectors in, not a long-term activity log. And even if it was, could the court really trust a log that came from the machine of one of the parties of the trial ?

Bill Thomson == Muppet

[psychofox]

I read the bbc news pages a lot. Every time I see that Bill was involved, I just skip over. He'll write anything... as long as it is absolute garbage.

Hold service vendors responsible!

[kylef]

It's wrong for people to make excuses for bugs in code which expose my personal information to hackers, stalkers and marketers.

Let's say you put your money in a bank. The bank, in turn, puts your money in a safe. It just so happens that the safe has a subtle flaw in the door hinge that makes it vulnerable to robbers; neither the safe manufacturer nor the bank knows about this vulnerability. So when the bank is robbed, who is to blame for the loss of your money? The bank? The robber? The safe manufacturer?

Your automatic blame of software vendors is analogous to always blaming the safe manufacturer. But the only contract you had was with the bank, who had the responsibility to protect your money. Their failure to do so breaches your contract. Consumers can really only directly blame the service provider who failed to protect them.

The bank, on the other hand, has two recourse options to consider: the robber and the safe manufacturer. While the robber had specific malicious intent (stealing money), the safe manufacturer operated in good faith and indeed their purpose in business is to attempt to protect against such crimes. The only way the safe manufacturer could be legally responsible for the robbery is if 1) they knew the safe was vulnerable and yet did nothing, or 2) the safe's design was so poor as to be criminally negligent.

Given the huge amount of design consideration and effort that security receives in modern software development houses, proving criminal negligence would be a very difficult challenge indeed.

And finally, I despise the fact that lawsuits are everyone's first thought when they don't like a product. "Have a problem? A lawsuit can fix it!" It's a preposterous system stacked against those businesses who try to operate in good faith. The best idea I've heard in years is to force lawsuit losers to pay for court costs and legal fees. That would make people think twice before filing frivolous lawsuits. And don't tell me it doesn't happen. I've been sued twice for absolutely RIDICULOUS stuff. My insurance company settled each case for a nuisance fee, which was all opposing counsel was looking for. A distant cousin of mine is a personal injury attorney, and my skin crawls when I hear about some of the things he has done.

Instead, if you don't like the service you're getting, vote with your feet and encourage others to do the same!

Idealism and Reality

[ChaoticCoyote]

Implementing responsibility in software is desirable -- and unlikely.

At the bottom of the problem (surprise, surprise!) we find money. Software development requires expensive human labor and support; the software industry already limits its investment in quality assurance and support. To fully test every piece of software for 100% (or even 99%) reliability would drive software prices spiralling — you would see no free software movement, no open source, and be living with a very limited selection of corporate software at cocaine-like prices. Witness what has happend with liability lawsuits and medicine, driving costs to astronomical levels.

If anything, the success of the software industry could be attributed the its very lack of guarantees. It has few material costs; anyone with a $500 PC can start a software business. You don't need to guarantee your product, and society is conditioned to accept broken software after years of living with Microsoft's badly engineered products. Companies ship erroneous code to customers, knowing full-well that it can be patched later.

Do I think software should provide guarantees? Yes. Will it happen in my lifetime? Not unless society changes dramatically.

Chance of error, proper use

[phorm]

One thing one must consider is proper use, and chance of error.

Take condoms, for example. They can help protect against pregnancy and/or STD's. They can also break. In a reasonable situation you should be able to expect some safety in using them, if you use them properly. If you think that wearing a condom is going to make it OK for you to head on down to 3rd and Main every night to pick up a $10 date... well you don't sue Trojan when you get a little more than you bargained for, no do you?