Slashdot Mirror
Open-Source Insurance
* * Beatles-Beatles writes to tell us that several insurance agencies have formed a partnership to offer open-source compliance insurance. From the article: " The insurance will cover up to $10 million in damages, including profit losses related to noncompliance with an open-source software license. The policy could, in some cases, cover the cost of repairing code that was found to infringe on open-source licenses such as the General Public License, which is used with the Linux operating system."
So, just like other policies, how much will it cost? $100? $1 million? It's kind of point less to talk about the $10 million coverage when you don't know how much it will cost...
Much better to take on an insurance against SCO than this FUD disguised as "insurance".
Is the GPL (or other open source licenses) that complicated that you just can't hire (or task) someone to review your development practices to be in accordance?
Well, it's Lloyd's of London subdivision offering this (the same people who insure body parts), so it's probably more publicity than anything.
Intermediate: Insurance company knows that no open source developer has the money to sue, even if they would be able to discover that their code had been stolen.
Now: Big company tajes insurance and starts stealing open source code, because they feel there is no legal risk anymore.
In the end: Open source developers get screwed once again and the only people getting rich over it are the lawyers. Nothing new here.
Any person in any corporation buying this should be subjet to instant dismissal. If you are a shareholder in a company that buys this, then you should sell your shares immediately, as it is clear proof that the management is corrupt or incompetent.
The Institute of Chartered Accountants should be expected to recognise it as a symptom of malpractice, and if auditors fail to recognise it as such, then the auditors are also guilty of malpractice.
Sent from my ASR33 using ASCII
Insurance is about tranferrance of risk. You pay the insurance company to assume the risk for you.
Now that that's covered, tomorrow, we'll learn "how to tie your shoes" and "eating with a spoon."
Yeah you can...
There are only a limited number of ways of solving certain problems, so if entire functions look pretty much the same, it wouldn't be too surprising (unless comments are the same too... then it's fishy)
If you never filed a claim under the camel system, you still didn't get your money back if *someone else* filed the claim. Now extend the camel system to cover 400,000 camels for a small insurance firm. And furthermore, one unlucky camel every year doesn't just get lost, he gets ordered by a judge into the custody of a third party along with 99 camels that that trader doesn't own, with the lawyer getting fourty of them on contingency fee, because the camel stamped on some idiot's foot after the idiot tried to fit him through the eye of a needle in a fit of curiosity.
Help poke pirates in the eyepatch, arr.
I seem to remember interning for (ironically enough) an insurance company's IT department a few summers ago and hearing about how they took out liability insurance on pretty much all of the open-source tools they used. This even included things like Perl, where the chances of being sued are fairly small, just to be absolutely sure. Furthermore, it sounded like they'd been doing this for a while.
I suppose that their policies might not have covered the costs to get it into compliance and other such expenses. Still, I'm sure that huge companies like IBM have been careful to insure against such possibilites for years. It would be foolish for them not to.
What businesses REALLY need is insurance against Microsoft (and other BSA member companies) licence violations.
SERIOUSLY
Because for any reasonable-sized organisation it is very expensive to do a license audit, and almost impossible to be sure that you're completely in compliance. Many businesses have found that it's easier and cheaper to just buy a completely new set of licenses than try and figure out if the ones they already have cover everything they're running.
And because if you're not in compliance, even by just a little bit, you _will_ get hit with substantial fines which cost a LOT of money to fight that in court.
455fe10422ca29c4933f95052b792ab2
Really, you pay the insurance company to assume a small portion of risk, the rest of your payment goes to other larger insurance companies to re-insure the company you pay to, and anything left over goes towards litigation of claims and lawyers.
This isn't exactly new. If we keep it up with the OP, reinsurance would be bunch of camel trading groups getting together, so if one group got hit by horrible weather and many in their group died, they'd claim against the whole co-op. It has to work this way. Imagine being a south-asian insurance company without reinsurance when the tsunami hit, they'd have to file for bankrupcy immidiately and hardly anyone would get their claim. The rest? "Well you camel was old and weak" "You didn't treat that wound properly, it's your fault it got infected". There's alwsys trouble like that, and perhaps even insurance fraud (making sure it dies on a well-insured trip).
Around here there's no law against non-profit insurance companies, but all the major ones are commercial. I mostly prefer it that way, because they have the right incentive to make sure every claim is legitimate and that people pay according to the risk they contribute (every customer should be "profitable", on average). There are some bad with the good, but overall I think a non-profit company would be relying too much on honesty and solidarity to deal with people abusing the system.
Live today, because you never know what tomorrow brings
There is indeed such a thing as "accidentally" infringing on open-source code licenses. You see, while the individual developer who copies the code is usually aware of its legal incumberances, it would be quite easy for the corporation's management, board of directors, and shareholders to be unaware of the legal deathtrap the lowly developer employee is leading the company into. And lest we remember, it is the CORPORATION that would be found to have infringed the copyright, not the employee. The corporation would face responsibility for what its employee did. From this perspective, having insurance against such things might not be such a bad idea.
And by the way, I would wager to bet that a non-trivial percentage of employed developers are unfamiliar with the specifics (or fundamentals) of the GPL and other common licenses. Also, there are many scenarios in which miscommunication between employees and management could lead to unintentional use of open-source code. Who knows, maybe an employee is even deliberately trying to get the company into hot water.
Someone else here mentioned that this kind of insurance would make it easier for bigger companies to violate open-source licenses, since they'd be shielded from any legal damages. In response to that, allow me to introduce you to the phrase "Insurance fraud." Don't think for a second that these insurance companies won't be carefully pouring over company documents, correspondences, etc, to make sure the infringement was indeed "accidental" in whatever sense the word becomes defined as.
As someone else said, probably the only question is whether these companies can speculate the open-source-infringement-lawsuits world accurately enough to stay profitable. It seems to me that's easier said than done, but I do think the idea makes sense in theory at least.
Defending copyright infringement of any source code is ridiculous. You can't accidently copy a line from someone else's program to yours. Infringement is only deliberate.
That issue is not quite simple. Like the another poster pointed out you can end up with code that looks alot like an OSS implementation quite by chance simply because there is a very limited number of ways to solve a certain problem. Another way you could end up in trouble because of OSS could happen is if one of your developers decided to cut corners on a project and rips code from and Open Source project without telling you or if you merge with another company and find out that they have built Open Souce code into the application code that you acquired in the merger. If these developers strip off the comments and hide their tracks well it might not be obvious at all to you or your code reviewers that the code came form an OSS project. One other way you could get into troube over Opens Source software is if you produce a commercial application that links to Open Source libaries. From what I know it is not at all legally clear in some countries whether this quaifies your commercial application as a derivetive work. If somebody takes you to court over this and the judge rules an app that links to Open Source code is a derivative work you would be in trouble. In all of these cases (except perhaps the last one since it is still a legal gray area) it would be hard to accuse you of 100% evil and deliberate IP theft or infringement and I can see how an insurance that protects you during a resultant law suit and the subsequent repair work to get rid of the infringing code might come in handy if it isn't to expensive, especially for a startup company.
Only to idiots, are orders laws.
-- Henning von Tresckow
It wasn't too long ago that some source code for Windows was stolen/leaked, and all the major OSS players recommended to their devs that they AVOID IT AT ALL COSTS.
Not because they were worried that the devs would intentionally steal the code, but because they were worried that they'd read something clever, store it in the back of their minds, and then use something similar UNINTENTIONALLY to solve some OSS problem.
Why should the other way be any different?
Shit happens. That's why people buy insurance.