BBC Commentator Goes After Software Licensing

An anonymous reader writes "Bill Thompson, a regular commentator on the BBC World Service programme Go Digital, criticizes current software licenses (including the GPL) for giving developers 'freedom from responsibility which would be considered wholly unacceptable in almost any other sphere of activity, public or private'." From the article: "A friend of mine is a children's writer. When she writes a non-fiction book she is typically asked to sign a contract that indemnifies the publisher against legal costs resulting from errors of fact in the book. If she was to suggest a school experiment that involved drinking sulphuric acid, because she'd confused it with acetic, then she'd be in big trouble. Yet I can't do anything when a company produces software that exposes my online banking details to any script kiddie with time to spare, because I've agreed a license that removes such liability. "

Comments

agreed

[BushCheney08]

I agree. I should be able to sue CmdrTaco for getting me fired.

GPL

[Joehonkie]

I bet his wife gives away her books for free, too. On a more serious note, this is more expansion of the culture of victimization and the lack of responsibility that is taking over the Western world. Nothing is ever our fault, we muyst always find someone else to hold responsible for problems that we should be tough enough and capable enough to not get into or to solve ourselves.

Re:GPL

[kfg]

I bet his wife gives away her books for free, too.

Giving a book away for free does not indemnify the author of accountability for its content. Were I to claim you like whipped cream and underage barnyard animals in an unnatural manner that might well be actionalbe as libel (assuming the claim were false), depsite this post being distributed freely.

Nothing is ever our fault, we muyst always find someone else to hold responsible for problems that we should be tough enough and capable enough to not get into or to solve ourselves.

Yeah. Those goddam irresponsible Pinto drivers are really to blame. They should have know those cars were particularly libel to blow up.

BSOD's are not like coffee being hot or Jarts being pointy. Heat and pointyness are not flaws in their design and construction and injuries resulting from them are based on carelessness, events the user could have avoided while still taking full advantage of coffee and Jarts.

BSODs happen because someone else was careless, nor is there anything the user can do about them and they prevent the user from taking full advantage of the system.

"Yes, ladies and gentlmen of the jury, my client mugged Mr. Smith, but Mr. Smith was fully aware of the risks he was taking when he left his house. Mr.
Smith is only a "victim" because he was not tough enough to resist my client. He should take responsibility for his own actions."

That dog won't hunt.

KFG

Keyword

[mysqlrocks]

The keyword is that people agree to these license. If you don't agree, don't use the software. Or, you could buy more expensive software that comes such a guarantee. I can't think of any specific examples, but I'm sure the software that runs pacemakers has some sort of guarantee. However, it's very expensive.

All she has to remember is...

[MrByte420]

Little Johnny was a boy. He isn't anymore. For what he thought was H20 Was H2S04

Re:All she has to remember is...

[Enigma_Man]

Here lies the body of Johnathan Blake. He stepped on the gas instead of the brake.

-Jesse

you don't "license" use of a book

[Yonder Way]

The license is an agreement. If you don't like the terms, don't accept the license, and don't use the software.

There is a lot of crap out there about companies liking proprietary software because it gives them someone to sue when the software breaks catastrophically. That Microsoft has about a $40 billion dollar war chest, earned almost entirely through the sale of very broken software, pokes some big holes in that theory.

You're getting software for free. Don't bitch about indemnity in the license.

Re:you don't "license" use of a book

[cowscows]

Yeah, there are places that require much more stringent checks of their software. NASA doesn't just quickly throw together stuff and upload it onto the space shuttle, they test the hell out of it. And so they get high quality stuff written directly for their hardware. The downside to this is that development is slow, and it's expensive.

So basically, if you want software that's guaranteed, you're going to have to do a few things.
A) Pay someone a whole lot of money to write it.
B) Test the hell out of it before it gets put in place.
C) Realize that this is going to take a long time
D) Probably pick some very specific hardware for it to function with, and not have the option to easily upgrade in the future.
E) Make sure you get all the feature requests and whatnot right the first time, because patches and stuff are not going to be easy or cheap.

The market, for the most part, has opted for halfway broken software for a couple reasons. Upfront costs, freedom to grow/update/expand more easily, and because brokenass Windows was good enough for a lot of stuff. Hardware increases allowed significant boosts in productivity, and to a large degree, software was just sort of along for the ride. Now that commodity hardware offers so much power that the drive to upgrade is much less of a factor, it might make more sense to focus more on software quality.

Separate Coding and Liability

[Renegade Lisp]

To be held liable for every line of code that you write goes very much contrary to the free software / open source world, where developers often simply scratch their personal itch, or work out of a genuine interest in the matter. It is impossible for such individuals to get the financial backing (i.e. insurance) so that they can take this level of responsibility for their creations.

The solution, I think, is that the realms of coding and of liability need to be separated. Let the coders code and let service companies such as IBM work together with them to provide support and, if needed, liability for customers that need it. This is exactly what happens when IBM "sells" Linux to Wallstreet, for example. They sell the kind of responsibility for the software that individual developers could by no means provide.

Typical Big Government Response

[geomon]

I would hope that Mr. Thompson considered the alternative that people often hold others accountable for their own ignorant actions. Yes, a publisher is often held accountable for the stupid actions of a reader (who would be stupid enough to drink sulphuric acid?). But is that situation an indictment of the author, or the court system that allowed an ignorant person to use the courts to make whole an action that the claimant should be responsible for?

No, I do not believe that everyone should be left to fend for themselves without ANY regulation. If someone produces a medication and makes a claim that a patient considered reasonable, and they get more ill or die as a result, then the company should be held accountable. But to make every fucking business activity subject to error and omission insurance will wreak holy hell on our economy. E&O insurace requirements will guarantee that

1) software development will slow,
2) software for process control will halt due to liability questions,
3) make lawyers and insurance companies rich,

all without one single shred of evidence that any of these effects actually made software development any *better*.

When I install software, especially for the first time, I do NOT have it on my production machine. Why do people like Thompson like doing things like this? Why should a software publisher spend heavily to debug (and still not get EVERYTHING) in a manner that *assures* the E&O insurer that it will not delete Mr. Thompson's latest mp3?

"Ahh yes," counters the Industry,

[Shadow Wrought]

"But see, if we had to ensure that everything worked all the time, it would take too long and nothing would happen. There would be no software."
"Oh, I hadn't thought of that," says the commentator whose argument proceeds to disappear in a puff of reality.
Meanwhile, Industry, rather content with itself, goes on to prove that black is white and white is black and is sued into oblivion by the DMCA.

No guarantees

[winkydink]

In many cases, there is no option for a more expensive software that comes with a guarantee. Yes, some software like hospital life support and air traffic control come with a guarantee, but that is why you will see many 'normal' sw mfgs license mention these applications by name and say that you should not use their product in these environments.

Re:No guarantees

[Chyeld]

Actually in all cases there is that option. Just because no one is willing to pay $150,000 to a software development firm to create a knockoff version of Quicken and guarantee a certain level of reliablity doesn't mean it's not an option.

What this guy is complaining about is the fact that he expects consumer level software to come with the same quality of proffessional level software. It's a bit idealistic and unreasonable.

If you aren't willing to pony up the money for quality, you shouldn't complain about the quality of the what you get.

EULAs do not provide any more protection

[LightStruk]

Yet I can't do anything when a company produces software that exposes my online banking details to any script kiddie with time to spare, because I've agreed a license that removes such liability.

That's exactly what you've done when you agree to a license from Microsoft.
From the Windows XP Home EULA, with caps removed to get past lameness filter:

To the maximum extent permitted by applicable law, in no event shall Microsoft or its suppliers be liable for any special, incidental, punitive, indirect, or consequential damages whatsoever (including, but not limited to, damages for loss of profits or confidential or other information, for business interruption, for personal injury, for loss of privacy, for failure ot meet any duty including of good faith or of reasonable care, for negligence ...

and so on and so on.

With this amount of legal protection, I feel completely safe using Microsoft products!

Yeah...

[Anonymous Coward]

Let's make all software developers totally legally responsible for their programs. That way, the only people who can afford to write software are huge companies, and even computer progamming for hobbyists ceases to exist because of the liability issues surrounding the creation of code. It'll be sort of like the doctors who have to buy really expensive malpractice insurance as protection against frivolous lawsuits, only the people who have to pay in this case won't be pulling down doctors' salaries.

"life critical"

[CarrionBird]

Medial equipment, avionics, there's plenty of stuff that is specifically made for situations where failure is not an option. Consumer software is not such a thing.

Re:About time

[Skye16]

I disagree. You don't like buying/using my software because I'm free from any responsibility if it runs amok and kills your family and makes love to your motorcycle? Don't use it. I'm not going to make you. If you don't feel comfortable dealing with those circumstances on your own if they happen, then I don't want you to use my software products (not that I actually have any, but still).

If you don't like it - write up a new license claiming responsibility for whatever it is your software may do. Write whatever software you want. Users will possibly flock to you just for the peace of mind they would get (or is it piece of mind? ;D).

Of course, so will the lawyers, but hey, it was your choice (as a developer) to release software under those conditions anyway.

Re:Bad analogy

[kfg]

Well, then it's a damned good thing he didn't use that analogy, isn't it.

In fact, he didn't use an analogy at all, since author is to author isn't an analogy. He merely brought up the indemnification of the publisher to illustrate that in fields other than software authors can be held accountable for what they write and publishers do not wish to be the "deep pockets" target of the accountability.

And software has publishers too.

KFG

malpractice caps do NOT decrease premiums

[Travoltus]

Just so you know, malpractice premiums do not decrease for doctors in states where malpractice awards are capped to $250,000. Most lawsuits are launched when doctors maim or kill patients due to negligence, not because of highly publicized frivolous reasons. Your analogy is flawed, to say the least.

Now let's get back on topic. It's wrong for people to make excuses for bugs in code which expose my personal information to hackers, stalkers and marketers. I'd just as soon see the industry grind to a halt until they find a way to nip these miscreants in the bud. And no, I can't opt out of this dangerous system unless I stop driving (so much for being able to get food), close my bank account (yeah, hide my money under my bed so a thief has a reason to physically rob me and then kill my whole family to get rid of witnesses), declare myself dead (to retire my SSN - whoops, that's illegal, welcome to Club Fed! - or at least, welcome to joblessness) and practically move out of the country (well, actually that's a good idea if Canada is my destination).

Thanks to stupid programmers there's absolutely no way anyone can protect themselves from identity thieves. The only reason why someone hasn't hijacked you is that they don't care to.

Now please, come back after you find yourself having to fight for years to fix your credit after a hacker stole your personal information off Lexis-Nexis and then tell me they shouldn't stop the digital train for some major overhauls. Until you're a victim of the gaping flaws in the digital fortress you really don't understand the sharpness of that sword of Damocles that is swinging back and forth over your head.

Re:malpractice caps do NOT decrease premiums

[MaxwellStreet]

I'd just as soon see the industry grind to a halt until they find a way to nip these miscreants in the bud.

And that's exactly what would happen. Anyone doing any sort of business electronically will cease to do so.

There is no way for software to be written so that it's absolutely safe from people who are determined to break it. Depending on your paranoia level, you can believe (or be reassured by the notion) that certain 3-letter gov't agencies can decrypt any secure transmission you might make over the wire.

And your identity can be easily stolen for reasons that have nothing to do with stupid programmers. Anywhere your information lives, it can be stolen by someone authorized to use it - regardless of how tightly the systems are locked down.

Any system of any complexity at all relies on assessment of risk and assumption of best practices. Any system - from the space shuttle to an operating system to an e-commerce application - cannot guarantee absolute safety.

We'd probably agree that any company who, through gross negligence, exposes sensitive data should face legal exposure. But if every business had to fear that every minute flaw found in whatever computer system they've got running could lead to a lawsuit, it would shut down e-commerce (in all forms) overnight; and would set business and the economy back in a major way as the cost benefits that information systems (used both internally and external to the organization) are turned off under an entirely different sword of damocles.

Re:malpractice caps do NOT decrease premiums

[bigpat]

Now let's get back on topic. It's wrong for people to make excuses for bugs in code which expose my personal information to hackers, stalkers and marketers. I'd just as soon see the industry grind to a halt until they find a way to nip these miscreants in the bud. And no, I can't opt out of this dangerous system unless I stop driving (so much for being able to get food), close my bank account (yeah, hide my money under my bed so a thief has a reason to physically rob me and then kill my whole family to get rid of witnesses), declare myself dead (to retire my SSN - whoops, that's illegal, welcome to Club Fed! - or at least, welcome to joblessness) and practically move out of the country (well, actually that's a good idea if Canada is my destination).


and again

I'd just as soon see the industry grind to a halt

So, you'd like to see everyone just stop until it is completely safe, but you can't see how it is you could live without the systems that are in place. By the industry grinding to a halt, you mean your just going to stay home and eat your scrambled eggs until the world is without risk. Until your fluffy little world is just right to you.

Well, the world ain't perfect and you do have choice. And people should be free to assume whatever level of responsibility they feel comfortable with as long as there is no fraud. Doctors should be able to make patients sign legally enforceable waivers of complete responsibility from even claims of malpractice. And so too should manufacturers of software and hardware. If that car manufacturer want to make you sign a contract that says that their cars may explode upon key insertion and they are not liable for damages beyond the cost of the car, then that should be the way it is. Then let some decide to indemnify and other not and see if the price difference is worth it to customers.

Perfection costs time and money and is most often illusory, so to mandate it is a fools errand.

Re:Bad analogy

[sedyn]

Stepping beyond that kind of bad analogy, there is another one:

"If Apple turned round to nano users and pointed to a shrinkwrap "licence" on the high-design packaging that exempted it from the provisions of consumer protection law it would never get away with such a blatant disregard for its customers' rights."

But, if I go to a pawn shop and buy refurbished goods, which are sold "as is" then I have accepted more responsibility at the expense of supplier/creator liability.

Likewise, with free software, you accept liability for it being free. If it harms your system, then you should have examined it yourself to be sure. If you don't think that's fair, and that users shouldn't have to (possibly because they can't), I'd like to point out that I can sign a difficult to read contract without prior knowledge of law (which is especially important in "common law" countries, where the law is not always as explicit as it should be).

The moral of the story, hire someone to proof-read the code you want to use, just like people hire lawyers to check contracts. I know that I would like to see an increase of demand for programmers.

Parially, yes

[brunes69]

If you as a company, invest tens of millions into a rollout of a new software product ( be it a new version of Windows, or a new Linux Kernel), without

• Fully researching the present and past state of the company or individuals responsible for the software, and their abilities both demonstrated and implied.
• Fully looking into [resent and past security issues with the software
• Doing a full independant side-by-side comparison with competitors

.. then Yes, you are responsible for a large part, if that software catastrophically fails. Because it is likely something you would have came across in all this research, in one form or another.

Take windows for example. If you lose $500,000 in a day because some critical windows server crashed from a certain DDOS attack, should Microsoft be responsible? Or should you be responsible, because you should have known from years of examples that Windows is very vulnerabile to those kinds of attacks, and you should either have an external protection mechanism in place, or not use the software? I think the latter. Then again, I am not the person who thinks "sue" when I slip on icy stairs in the winter and break my neck either. I think "maybe I should have bought better gooddamned shoes for walking around in the winter". The other commentors are right, there is not enough responsibility in the world today. Grow a backbone and stop sueing everyone.

Re:Parially, yes

[jglazer75]

Except for the fact that at every turn Microsoft is telling you it is secure. That it's software will stand up to a DDOS. The firewall operator exists for the same reason. Yet, when that DDOS occurs, there is no recourse because of the disclaimer of liability by both MS and the firewall. "Oh, well you agreed when you clicked 'I Agree' that you acknowledge that everything we said prior was mere 'puffery' and that it was blatantly obvious to anyone that our products don't ACTUALLY stop a DDOS." So, yeah. If I install Windows (as opposed to say, some IBM provided Linux derivative) because of the express assertions by MS (or the firewall software - whose express purpose is to deny said attacks) that such-and-such configure will withstand a DDOS, then yes, I expect MS (and the firewall vendor) to be liable when said DDOS causes me $15mil in damages due to downtime of those servers. In other words, as a purchaser, why should I assume that liability when the purpose of the software purchase was to prevent the occurrence in the first place! As far as Firefox and other open-source. If I use Firefox, I have an expectation that someone was reasonably competent in their duties to provide software that will not allow my system to be compromised. I understand that it is "hard" and "time consuming;" however, that doesn't make the expectations any different. If I provide pro bono legal services, or free medical services, or I offer a free education, I still have a duty to provide those services in a competent manner. If I fail to meet those expectations, a court doesn't just say "Well, his services were free! what did you expect?" A court finds me liable for malpractice and I owe someone a lot of money. (whether I have it or not)

Bullshit. There's always an option

[Sycraft-fu]

Pay more. Find a company willing to take a contract that includes gaurentees. However don't bitch when it's way more expensive and that it takes way longer. Don't expect something cheaply turned out on the latest hardware in a couple months. Expect that it's a verified system that takes years of testing, and is rigidly controlled.

There are companies that make solutions like this, IBM is one of them. You can get a mainframe setup to do database work that will never go down, ever. However it'll be expensive as hell, you will run the DB and ONLY the DB on it, it will be accessed only in rigidly controlled ways, etc.

Ya, more or less

[Sycraft-fu]

You choose to accept the risk, in trade for the benefits. Designing a system with no bugs is expensive and time consuming. You have to test things extensively at every level. That also means testing all the possible interactions. Not only how the OS interacts with the hardware, but how it interacts with the software, and how it interacts with each other. So when you design a system like that, the hardware neede to be known, as does all the software. You can't have it run on random comoddity hardware using random software beacuse then unforseen problems can result.

So by choosing to run software cheaply and quickly developed in random environments, you choose to accept teh fact bugs may occur.

To me, demanding that commoddity software on commoddity hardware run without bugs is like demanding that an automobile on the public streets never get in to an accident, even one caused by driver error, unforsseen conditions, or other drivers. Can't happen. If you want gaurentteed operation, you need controlled conditions.

S.W. is not a complete product

[Dare nMc]

I think the bad analogy in this article is between the products. In the case of a book, it is a complete product. When a book is released, it is unlikely to be used for other than the intended purposes, and when used with another product it is not expected to still stand on its own (you cant subst the 265th page for another authors page, and expect it to work, but that is expected of the dll's, windows 98 vs XP, etc.)
Most software is either released inside a complete product, and the product liabilty is left intact. Or it is software inteded to be used with other software, and with the original programmers usually not being the system integraters, going back to a single person to be responsible is no longer easy or practical.