Slashdot Mirror


Examining Software Liability In the Open Source Community

snydeq writes "Guidelines from the American Law Institute that seek to hold vendors liable for 'knowingly' shipping buggy software could have dramatic impact on the open source community, as vague language around a 'free software' exemption could put open source developers at litigation risk. Meant to protect open source developers, the 'free software' exemption does not take into account the myriad ways in which vendors receive revenue from software products, according to a joint letter drafted by Microsoft and the Linux Foundation. As such, the guidelines — which, although not binding, are likely to prove influential on future lawsuits, according to attorneys on both sides of the issue — call into question the notion of liability in the open source community, where any number of coders may be responsible for any given defect."

241 comments

  1. Sure by Anonymous Coward · · Score: 0

    Only if they know who you are =)
    Otherwise they can send their complaints to your gmail.com account.

    1. Re:Sure by tuxgeek · · Score: 1

      Everyone knows who Mike-Row-Soft is.
      That windoz stuff is pretty darn buggy
      Does this mean I can now sue them for all that crap software I have bought over the years?
      How about time invested in a project, attempting a save .. BSOD .. a total loss, including all that work?

      --
      "Suppose you were an idiot...and suppose you were a member of Congress...but I repeat myself." Mark Twain
  2. Use something else... by Anonymous Coward · · Score: 0

    If you don't like the open source software the the license that goes with it already.

    1. Re:Use something else... by Anonymous Coward · · Score: 0

      Ah, yet another lackey of Microsoft, the Most Likely Instigator of those so-called "guidelines".

    2. Re:Use something else... by s73v3r · · Score: 1

      Microsoft is just as against these guidelines as the Linux community. Imagine if Microsoft was held accountable for every bug present in their software?

  3. microsoft and the linux foundation agree ? by godrik · · Score: 3, Funny

    I am sure hell is frozen now.

    1. Re:microsoft and the linux foundation agree ? by Tekfactory · · Score: 4, Funny

      Google would have joined them, but Beta software doesn't count.

      That and the Universe asploding

    2. Re:microsoft and the linux foundation agree ? by shutdown+-p+now · · Score: 1

      On a serious side, the reason why there's an agreement there is that exclusion from liability in the document is for free-of-charge software, and both Microsoft and various Linux players (such as RedHat) sell software, so it concerns them directly.

      In practice, I think it's something that pretty much every software development company would sign under, regardless of their relationship with FLOSS.

  4. I believe almost every free software I use has.... by Seakip18 · · Score: 4, Informative

    "NO WARRANTY OR GUARANTEE IS IMPLIED. USE THIS SOFTWARE AT YOUR OWN RISK" or some combination of that. Even my home server says that every time I SSH into it.

    So.....you're going to sue a developer for a defect, intentional or not, even though they said it was not warrantied and use at your own risk?

    --
    import system.cool.Sig;
  5. Bug free software would be insanely expensive! by onionman · · Score: 5, Insightful

    Bug free software is possible, it's just very very expensive to produce!

    I've worked on DoD projects that required bug free software. It is possible, it just requires $150 Million to produce 100,000 lines of code.

    Do you really want to force Microsoft or Apple to produce bug free operating systems? Who could afford them?

    1. Re:Bug free software would be insanely expensive! by sys.stdout.write · · Score: 5, Informative

      Of course not. The article was terrible.

      If you read the report from a better news source you'll learn that this only applies to fraudulent concealment of bugs, not simply their existence.

    2. Re:Bug free software would be insanely expensive! by SirGarlon · · Score: 1

      Bug free software is possible, it's just very very expensive to produce!

      Or very, very small.

      --
      [Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
    3. Re:Bug free software would be insanely expensive! by digitig · · Score: 1

      I'd be interested to know how, because I work in the field (including having done formal analysis of military systems) and although I know of methods to get exceptionally low bug rates, I'm not aware of any techniques that offer bug free for any but the most trivial program. And I've seen software houses make claims of bug-free software that have been accepted by safety regulators but that have subsequently been found to be wrong as bugs have been found.

      Of course, it's possible the DoD knows how but is keeping quiet about the techniques...

      --
      Quidnam Latine loqui modo coepi?
    4. Re:Bug free software would be insanely expensive! by maxwell+demon · · Score: 2, Interesting

      Simple: Add to your specification: "The program is not intended to be run." If anyone runs it, then he's operating it outside of its specifications. Anything unforeseen therefore isn't a bug :-)

      --
      The Tao of math: The numbers you can count are not the real numbers.
    5. Re:Bug free software would be insanely expensive! by nomadic · · Score: 1

      Do you really want to force Microsoft or Apple to produce bug free operating systems? Who could afford them?

      I believe they're arguing that vendors shouldn't KNOWINGLY ship buggy software. If you found it before shipping, fix it. I suspect this will just cause software developers to just cut down on QA...

    6. Re:Bug free software would be insanely expensive! by mcgrew · · Score: 1

      How many copies of XP were sold? If Microsoft has sold 300 million copies, than at $150m development cost they could sell the OS for $2 and make a $150m profit.

    7. Re:Bug free software would be insanely expensive! by john.r.strohm · · Score: 1

      Are you familiar with the Gypsy Verification Environment and the Message Flow Modulator work, done by Don Good's group at The University of Texas at Austin in the late 1970s and early 1980s?

      The Message Flow Modulator was a small (ca. 1000 lines of code, 1500 lines of type declarations and specifications) program, but it was by no means trivial. When it saw the acceptance test suite for the FIRST time, at the acceptance test at PAX River, in front of the customer, it passed. On the first time. No deviations, no waivers, no "yeah, but"s, no nothing, it passed.

      The biggest issue, according to Don, was that it was expensive: at a time when 10 lines/man/day of allegedly-debugged, final, delivered code, with a known nonzero defect density, was considered typical, and acceptable, they were getting 1 line/man/day of absolutely-zero-defects delivered code. This is expensive, but one can readily conceive of environments where any measurable nonzero defect density is too high. (Like disk drives: if your bit error rate is high enough to measure, it's too high.)

      My personal opinion is that the biggest issue they were going to encounter is that they didn't use C. Recall the resistance in this country to Ada, compared to the acceptance of Ada in Europe. (Recall also that Bell Labs, when asked to submit a DoD1 candidate based on C, politely declined, saying that C was not then and would never be robust enough to be a basis for highly reliable software.)

    8. Re:Bug free software would be insanely expensive! by Jaysyn · · Score: 1

      Would a Microsoft backdoor / killswitch be considered a fraudulently concealed bug?

      --
      There is a war going on for your mind.
    9. Re:Bug free software would be insanely expensive! by Anonymous Coward · · Score: 0

      I get all my news from FOX News! I know everything I need to know and nothing more!

      And keep your government health care away from my Medicare, you whipper-snapper!

    10. Re:Bug free software would be insanely expensive! by lena_10326 · · Score: 1

      What about a "that bug is a feature" type of bug? What if we can't agree on categorizing its severity level? What if the bug affects 0.01% of the population and not worth fixing? What if the bug only appears occasionally when executing on runtime library 1.0, but never on 2.0? What if it works on a clean install but not when driver Y is installed? What if the bug is due to the user not keeping their OS up to date? What if the issue stems from data corruption? What if your code is script run inside of a 3rd party engine which you know might have a bug?

      Not all bugs are solvable.

      --
      Camping on quad since 1996.
    11. Re:Bug free software would be insanely expensive! by Anonymous+Brave+Guy · · Score: 1

      Bug free software is possible, it's just very very expensive to produce!

      It may be possible, but no-one has ever worked out how to do it.

      Even the Cleanroom guys have non-zero bug rates. They're very impressive, maybe an order of magnitude or two better than typical consumer products, but there are still bugs.

      And to pick everyone's other favourite example, while TeX may now be as close to bug-free as any consumer software ever gets, there are plenty of people with framed cheques from Don Knuth to show that it wasn't always that way.

      --
      If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
    12. Re:Bug free software would be insanely expensive! by Zalbik · · Score: 1

      How many copies of XP were sold? If Microsoft has sold 300 million copies, than at $150m development cost they could sell the OS for $2 and make a $150m profit.

      Yes, but the quote was $150million for 100,000 lines of code.

      XP had over 40 million lines of code, so assuming the costs scale linearly (which is optimistic IMHO), it would cost $60 billion dollars to develop a "bug free" version of XP.

      For reference, Red Hat 7.1 contains approx 30 million lines of code

    13. Re:Bug free software would be insanely expensive! by jd · · Score: 2, Insightful

      Frankly, forcing Microsoft to produce a bug-free OS sounds a great idea. (They'd go bankrupt trying. How much better do you want??)

      As for the fraudulent concealment of bugs, I don't think it should matter who produced the software, how, or why. If the bug was fraudulently concealed, that should be what matters. This would likely impact security notices (ie: we'd get them sooner, rather than later) and that sounds a great idea to me too.

      I'd consider ANY fraudulent concealment to be a problem, though, not just by developers. Thus, a bank or online store that fraudulently concealed the fact that it had a bug which exposed credit card information should likewise be a crime.

      (This might result in better upgrade policies, but it would certainly result in a better-informed public. And since panicked buyers don't buy, it might also result in a better-educated public on how to understand risk. Again, something that is long-overdue and filled with potential benefit.)

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    14. Re:Bug free software would be insanely expensive! by Stupendoussteve · · Score: 1

      Exactly. Let us remember, you cannot use your copy of iTunes in the development, design, manufacture or production of nuclear, missiles, or chemical or biological weapons.

    15. Re:Bug free software would be insanely expensive! by FredFredrickson · · Score: 1

      Not everything can be controlled by you, but certainly every exception can at least be handled gracefully. Otherwise we call it a bug.

      --
      Belief? Hope? Preference?The Existential Vortex
    16. Re:Bug free software would be insanely expensive! by Burz · · Score: 1

      Would a Microsoft backdoor / killswitch be considered a fraudulently concealed bug?

      Very interesting question. Its not inconceivable that a closed-source vendor like MS would 'harvest' undisclosed bugs as they found them, for use as backdoors (with a kill switch being a specific kind of backdoor) at some later time. Then in an emergency a special client like the US Government could "stumble" upon the vulnerability and exploit it.

    17. Re:Bug free software would be insanely expensive! by FredFredrickson · · Score: 1

      if they sold it for $2.. wouldn't that be $450m profit?

      --
      Belief? Hope? Preference?The Existential Vortex
    18. Re:Bug free software would be insanely expensive! by jd · · Score: 1

      It is possible to produce defect-free non-trivial software. Generally, though, it is better and more cost-effective to produce defect-tolerant software.

      Defect-tolerant software is any software that probably contains bugs but where the bugs simply don't matter. It's a simple extension of the method used to produce a secure general-purpose OS - you have a security kernel that is guaranteed to be defect-free AND guarantee all arcs must go through that security kernel such that no potential vector in any other component can ever be exploited.

      It's also an extension of fault-tolerant software, where no failure is ever fatal and any potential bug can be recovered from in some manner.

      Once you combine these two ideas - proven kernels for specific functions, and proven recoverability in all functions outside of those kernels - you have software that has no user-visible or system-visible bugs. The bugs will always be contained and the resultant problems will always be dropped.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    19. Re:Bug free software would be insanely expensive! by Anonymous Coward · · Score: 0

      notice that 150 mil was for 100k loc. modern operating systems are significantly bigger than that, especially in MS's case, as the general public considers there to be no differentiator between the kernel and all associated programs that ship. I'd guess in the 100 million loc for the whole thing. assuming you could do 100k loc for 150 mil dollars, 100 mil loc would take 150 BILLION $, meaning that each of those 300 million copies would have to sell for $500 to even cover costs. If you sold less, you lost money.

      This is of course assuming that you can assume the 100k loc was actually bug free for 150 mil, and that you can scale that example, which i doubt you can, at least not 1000 times.

      This is a retarded argument anyways, market forces may or may not force developers to fix bugs. If customers are not willing to foot the cost of building better software, they get what they get. If they start voting with thier dollars, software will be better.

    20. Re:Bug free software would be insanely expensive! by jd · · Score: 1

      Oh, I'll add in how to write non-trivial bug-free programs: eliminate ALL programming AND non-programming elements that cannot be proven correct in advance. The programs are just a part of a system and if the system is flawed, the program is flawed.

      Occam was an attempt at just this. The processor and the programming language were developed in tandem (which meant you had a provable platform), dynamic structures were verboten, everything was strongly-typed and even the syntax for coding was tightly-defined to reduce errors introduced by sloppy coding practices.

      (An unproven platform may introduce bugs into a program when the program itself is bug-free. The only way to make a truly bug-free program is for each element - the CPU, the compiler, the language, the system libraries AND the program - to all be demonstrably correct.)

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    21. Re:Bug free software would be insanely expensive! by jd · · Score: 1

      Medical hardware is already at the point where accidents can be lethal. (Can you imagine what a rogue 9.2 T MRI scanner would do? Or a berserk gamma knife?) It doesn't require absolutely defect-free software, because they balance the cost of lawsuits against the cost of development.

      However, it's possible to imagine medical hardware that is sufficiently dangerous that the cost of ANY lawsuit would be prohibitive.

      It is also possible to imagine, given the extreme cost of - say - a manned mission to Mars, situations where life-support or medically-related hardware must be defect-free because the cost of replacing the mission would be too great. When you've only got one shot and your only constraint is to make that shot count (no other factors matter), provably-correct software becomes the cheapest alternative.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    22. Re:Bug free software would be insanely expensive! by Anonymous Coward · · Score: 0

      Did they mathematically prove it was bug free?

    23. Re:Bug free software would be insanely expensive! by digitig · · Score: 1

      It is possible to produce defect-free non-trivial software.

      How?

      you have a security kernel that is guaranteed to be defect-free

      How? You are just repeating the assertion that it is possible to produce defect-free software without saying how. I know of no technique to guarantee that, and all of the software that I've encountered that was supposedly bug-free has subsequently been found to have bugs. What is this process that produces software "guaranteed to be defect-free"? I agree that defect-tolerant is the way to go (as well as trying to get the software to be at least low in defects), not (solely) on cost grounds but because as far as I am aware you're never going to get rid of all defects -- or at least, never know that you have.

      --
      Quidnam Latine loqui modo coepi?
    24. Re:Bug free software would be insanely expensive! by Imagix · · Score: 1

      Remember: - Every program can be reduced by 1 line of code - Every program has at least 1 bug in it. Thus, by induction, every program can be reduced to 1 line of code that doesn't work.

    25. Re:Bug free software would be insanely expensive! by sconeu · · Score: 1

      Medical hardware is already at the point where accidents can be lethal.

      Please google for Therac-25.

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    26. Re:Bug free software would be insanely expensive! by mdwh2 · · Score: 1

      Frankly, forcing Microsoft to produce a bug-free OS sounds a great idea. (They'd go bankrupt trying. How much better do you want??)

      Let's imagine how it might work out, if companies were required to produce bug free software:

      * Microsoft would focus on fixing bugs rather than features. At first that might sound great, but not if it means paying hundreds of pounds for each version of Windows, when there's little in the way of new features, and you're just getting bug fixes that used to be free in service packs.

      * You won't be able to buy XP. Not anywhere. Unless you're lucky and find a copy on Ebay.

      * If this applied to freeware too, then it would kill open source, indie and hobby programming and so on overnight. If not, then perhaps that might sound great for Linux, since it can ship without being subject to the same constraints? Except this would limit them to non-commercial distribution - so no Linux being sold on shops, let alone being shipped on netbooks, PCs etc. Linux would never have any chance of being anything more than a fringe geek OS.

    27. Re:Bug free software would be insanely expensive! by Follis · · Score: 1

      Formal proofs, with corresponding formal specifications. See Dijkstra.

    28. Re:Bug free software would be insanely expensive! by onionman · · Score: 1

      It is possible to produce defect-free non-trivial software.

      How?

      Writing defect free code isn't magic. It's slow, painful, formal, and very very tedious. It requires that you have multiple teams evaluating, simulating, testing, and attacking the system. Because of that, it's very very very expensive.

      The code I was involved with was one of these "secure kernels". We did use formal methods for portions of it, but once you leave the formal model section there are other portions that requires months of tedious work. And, when I say tedious, I mean stuff like hand verifying every byte of output from the compilers (because you can't trust the compiler), and using in-circuit emulators to step through every machine instruction and verify every possible case.

      These systems are absurdly simple. A single good coder could sling out "good enough" commercial code that does the same thing in a couple months. But, it would probably have some bugs. There are, however, systems in this world that must be bug free.

      Systems like these also can't trust the hardware. So "bug free" means that you have multiple versions running on multiple pieces of hardware with N-way comparisons. This is the type of over-kill design that is so astronomically expensive that it's only done for things that absolutely must be bug free (e.g. nuclear weapons).

      Anyway, the point of my initial post is that you can produce bug free code, but it's almost never worth the cost. Likewise, most software (commercial and open source) ships with bugs that the programmers know about. So, trying to determine "fraud" based upon "shipping known bugs" in order to force a liability issue is nuts.

      If you want guaranteed bug free code, you have to pay for it.

    29. Re:Bug free software would be insanely expensive! by Anonymous Coward · · Score: 0

      Not to discount you, but Windows is a lot more than 100,000 lines of code.

    30. Re:Bug free software would be insanely expensive! by bill_mcgonigle · · Score: 1

      If you read the report from a better news source [yahoo.com] you'll learn that this only applies to fraudulent concealment of bugs, not simply their existence.

      How can one fraudulently conceal bugs in open source? In closed software, it's a trust thing.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    31. Re:Bug free software would be insanely expensive! by Hymer · · Score: 1

      Like Bill Gates statement from Win95 development: "If you can't make it work then make it look nice" ?

    32. Re:Bug free software would be insanely expensive! by gnud · · Score: 1

      Well, in this case I would think that most free software projects (with their open bug trackers) would be in the clear?

    33. Re:Bug free software would be insanely expensive! by gnupun · · Score: 1

      It is possible to produce defect-free non-trivial software. Generally, though, it is better and more cost-effective to produce defect-tolerant software.

      That's not practical at all. Today's black-box/white-box testing takes almost as much code and time as the original code itself. For defect-free software, you would have to employ formal verification which very few developers are capable of doing. And even if they did, it to would take 100 to 100,000 more man-hours to prove a non-trivial software completely correct. If you think $300 is too expensive for Win XP, get ready to pay $30,000 for a defect-free XP edition. On the plus side, the $30,000 software would never crash.

    34. Re:Bug free software would be insanely expensive! by gnasher719 · · Score: 1

      If you think $300 is too expensive for Win XP, get ready to pay $30,000 for a defect-free XP edition. On the plus side, the $30,000 software would never crash.

      It wouldn't be that bad, because out of the $300, most is not spent on software development. You pay for sales, marketing, EU fines, support, and so on.

      A problem with GUI software and bugs is: Would you consider "usability" to be something that can have bugs? If a user misunderstands a user interface, would that be a bug? If in XP the bubble "You have new applications" in the start menu covers the "Logoff" button completely, is that a bug?

    35. Re:Bug free software would be insanely expensive! by digitig · · Score: 1

      Been there, done that, got the T-shirt. I've written and used formal specs in Z and VDM, I've used SPADE and MALPAS to do the formal analysis. On the training course for SPADE our instructors led us through a trivial PASCAL program from formal spec to code to proof, and presented it as an example of what could be achieved. I promptly gave it an input set that caused it to give a wrong answer (it's my flair for that which led me into software safety in the first place). Sorry, but although I'm strongly in favour of formal methods for critical software, with current techniques they do not guarantee that the software will be bug free and anybody who claims zero defects on the grounds of formal methods shouldn't be let anywhere near safety critical systems.

      --
      Quidnam Latine loqui modo coepi?
    36. Re:Bug free software would be insanely expensive! by digitig · · Score: 1

      The code I was involved with was one of these "secure kernels". We did use formal methods for portions of it, but once you leave the formal model section there are other portions that requires months of tedious work. And, when I say tedious, I mean stuff like hand verifying every byte of output from the compilers (because you can't trust the compiler)

      What is the error rate for hand verification of compiler output?

      and using in-circuit emulators to step through every machine instruction and verify every possible case.

      These systems are absurdly simple.

      So simple that it's possible to test every possible state transition? That was what I meant by "trivial" above. Although actually it still doesn't guarantee bug free, because errors can occur in the testing process, too; all it can do is give assurance that the defect rate is acceptably low for the application in question.

      --
      Quidnam Latine loqui modo coepi?
    37. Re:Bug free software would be insanely expensive! by sys.stdout.write · · Score: 1

      Say I use Linux and say I don't care to know how every part of the kernel works. Canonical tells me that there are no security bugs of which they are aware, and when one surfaces they fix it in a timely fashion.

      Okay, now let's say that (hypothetically, of course) that they knew of an exploit that was being used in the wild but when they allowed me to download their ISO they kept quiet about this because they didn't want to hurt their reputation as a secure platform and figured they could just fix it quietly in the next release.

      In this situation I could generally recover any damages stemming from the exploit because its existence was fraudulently concealed from me. Just like if a car is known to blow up in certain conditions it is the manufacturer's duty to inform their consumers, if software has potentially dangerous flaws in it.

    38. Re:Bug free software would be insanely expensive! by sys.stdout.write · · Score: 1

      Grammar fail on the last sentence. But you know what I mean.

    39. Re:Bug free software would be insanely expensive! by glop · · Score: 1

      The wording quoted in the article is not about fraudulent concealment (which only appears in a quote of a lawyer defending the project). It's about shipping with known bugs. This is normal. There is always a KNOWN ISSUES section in the readme of any piece of software and it's a good thing. I don't want to wait for the software to be bug free, I want to use it now and if there are known issues, I just want to be warned.
      Now, if the company keeps the bug hidden, does not fix it, does not issue warnings or at least update its public bug tracking, that's another matter but the quote in the article is not sufficient to say that it's about it. Disclosing all bugs would be costly for non-free software and almost free for FLOSS (bugzilla+mailing lists+rss feed for important news). But it could be done with some work and generating appropriate reports for customers from the bug tracking.
      Anyway, I think that EULAs should be enforceable regarding use restrictions (i.e. don't use the software in life-critical situations, don't use it to handle money, obligation to check the results) and liability restrictions (e.g. if you lose money because of a bug you can get a refund, or no more that X amount of money).

      Anyway the yahoo article does not really address the issue... I guess we would need to read the text of the ALI to know but maybe they charge for their rewriting of the Law...

    40. Re:Bug free software would be insanely expensive! by fuzzyfuzzyfungus · · Score: 1

      It'd go deeper than that. BIOSes, microcode, and the various firmware blobs that live in modern hardware would be subject as well, and those sure as hell aren't bug free right now.

    41. Re:Bug free software would be insanely expensive! by Anonymous Coward · · Score: 0

      Which is exactly why the old good Unix principle rocks! The one that states that programs should do one thing, and do it well.

    42. Re:Bug free software would be insanely expensive! by jd · · Score: 1

      I did not say defect-free, I said defect-tolerant (ie: it will have defects but it will handle them in a manner that is safe, controlled and ultimately corrects the problem).

      Defect-free is bloody hard, defect-tolerant is actually quite easy.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
  6. Re:I believe almost every free software I use has. by sqlrob · · Score: 2, Insightful

    And so does every bit of commercial software. How do you differentiate?

  7. God damn you, lawyers. by synthesizerpatel · · Score: 5, Insightful

    Another stupid babysitter law to protect idiots.

    At a previous job I asked my boss why we used Oracle and he said that if anything ever went terribly wrong, the company would have someone to sue. Of course, suing someone doesn't restore customer confidence, data, or revenue. No verifiable technical reason, just that OUR lawyers got warm and fuzzy with contractual language that would never, ever get exercised and if it ever did try to sue anyone we'd have run out of money before they dipped into their free soda fund.

    Anything that executes code is buggy. Applications, frameworks, libraries, protocol stacks, drivers, bios', FPGAs and microchips. Grow up and deal with it.

    1. Re:God damn you, lawyers. by TheRaven64 · · Score: 4, Insightful

      At a previous job I asked my boss why we used Oracle and he said that if anything ever went terribly wrong, the company would have someone to sue

      Next time you encounter this attitude, you should find the relevant clause in the EULA, which disclaims all responsibility for the software containing bugs. If a company like Oracle provides your software then, generally, the only response you have to bugs losing your data is to not buy from them in future (unless, of course, you've just built a large in-house application that depends on Oracle...)

      --
      I am TheRaven on Soylent News
    2. Re:God damn you, lawyers. by jdgeorge · · Score: 4, Informative

      Another stupid babysitter law to protect idiots.

      At a previous job I asked my boss why we used Oracle and he said that if anything ever went terribly wrong, the company would have someone to sue. Of course, suing someone doesn't restore customer confidence, data, or revenue. No verifiable technical reason, just that OUR lawyers got warm and fuzzy with contractual language that would never, ever get exercised and if it ever did try to sue anyone we'd have run out of money before they dipped into their free soda fund.

      Anything that executes code is buggy. Applications, frameworks, libraries, protocol stacks, drivers, bios', FPGAs and microchips. Grow up and deal with it.

      First of all, this is not "another stupid babysitter law". It is NOT a law at all.

      Second of all, the guidelines are intended to prevent product vendors from selling products they know are defective. Just as it would be unacceptable if an auto company sold a car whose brakes wouldn't work whenever the car was going 72 miles per hour, it would be bad if a software company sold a system that it knew had a defect that could cause data corruption.

    3. Re:God damn you, lawyers. by onto_dry_land · · Score: 0

      Better yet, choose your software so that if the developers or support misbehaves and introduce bugs you can turn to anybody else, on a free market, without having to change to some different software. If Oracle misbehaves, not only can you not sue them in practice, but there is a good chance that you will still be stuck with them since changing to something else is too expensive. If you choose an open source solution you can always turn to someone else. The worst that can happen is that they will have to fork the code, but even that might not be needed.

    4. Re:God damn you, lawyers. by nomadic · · Score: 1

      Of course, suing someone doesn't restore...revenue.

      Uhhh, yes it does. That's the whole point of suing.

    5. Re:God damn you, lawyers. by 140Mandak262Jamuna · · Score: 1

      Of course, suing someone doesn't restore...revenue. Uhhh, yes it does. That's the whole point of suing.

      Nah, Winning a suit restores revenue, (if the defendant had not already gone bankrupt). Suing only costs money to both.

      --
      sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    6. Re:God damn you, lawyers. by Jaysyn · · Score: 1

      I would have been escorted from his office laughing, right after he got "sue Oracle" out of his mouth.

      --
      There is a war going on for your mind.
    7. Re:God damn you, lawyers. by synthesizerpatel · · Score: 1

      I bet you subscribe to CIO magazine.

    8. Re:God damn you, lawyers. by ahabswhale · · Score: 1

      I hate to tell you this but software is released with known bugs ALL THE TIME. Every version of Windows, for example, ships with thousands of known bugs and some of these can render your system inoperable. They release it anyway because they believe the risk is low to the typical user. If software were never released because it could make your system inoperable or cause corruption, then no software would ever be produced (except for the space shuttle where the cost per line of code is ~$1000).

      --
      Are agnostics skeptical of unicorns too?
    9. Re:God damn you, lawyers. by cetialphav · · Score: 1

      For most software the disclaimers in the EULA doesn't amount to much. Just saying that you cannot be sued does not make it so. There is an implied warranty of merchantability with almost all transactions. This says that the Oracle software should be usable for the intended purpose. I.e., you should be able to run a large database on it. If it turns out that it is not possible to use it for that purpose because it loses your data, you absolutely can sue. You can sue for the purchase price of the software and have a good chance of winning. What you cannot do easily is sue for the damage done by the failure of that software (loss of customer confidence, time to repair the situation, etc). To sue and recover that kind of damage, you would have to show gross negligence by Oracle and that would be extremely difficult.

      The real fallacy behind wanting someone to sue is that you cannot possibly recover enough from a lawsuit to cover the damage. Oracle bugs have the potential to create damage that far exceeds the purchase price of the software.

    10. Re:God damn you, lawyers. by selven · · Score: 1

      If a car was intended to go 40 mph, then I don't see a problem with the brakes failing at 72. Windows is not intended for mission-critical applications, so people that use it there are abusing the tool and are themselves solely responsible for the harm they cause.

  8. bollocks by shentino · · Score: 4, Interesting

    I'd say that ye olde standards of gross negligence and recklessness should cover any profoundly careless bugs.

    The trick is to get them to apply to corporations like MS.

    1. Re:bollocks by megamerican · · Score: 1

      That would mean having a government which does what it was originally designed to do in the free market; enforce contracts and little else.

      --
      If you have something that you dont want anyone to know, maybe you shouldnt be doing it in the first place -Eric Schmidt
  9. Sue who for what now? by spun · · Score: 4, Interesting

    First point, if someone working for hire at Red Hat, Novell, or IBM knowingly (how's that defined?) ships buggy open source software, why shouldn't the company be held liable, if they would be held liable for shipping buggy closed source? Second point, who is going to sue some no-name contributor who doesn't have any money anyway, especially if you have to prove that that particular developer knew there were bugs? I love open source, but I feel that if we as a community want to be taken seriously, we should be held to the same standards as closed source software.

    --
    - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    1. Re:Sue who for what now? by fuzzyfuzzyfungus · · Score: 1

      The "same standards" should allow shipping plenty of horrors...

      More generally, while concealing bugs is a super sleazy behavior, there are loads of situations where buggy software is preferable to no software. Virtually any software product of any complexity ships complete with a "known issues" section, which is nothing more or less than a list of bugs and omissions. Somehow, we all muddle through. I don't see FOSS vs. proprietary as differing markedly in that respect.

    2. Re:Sue who for what now? by maxwell+demon · · Score: 1

      Have you ever read an EULA of proprietary software? Typically all they guarantee is that the CD you got is readable for about a month.

      --
      The Tao of math: The numbers you can count are not the real numbers.
    3. Re:Sue who for what now? by spun · · Score: 1

      So, are you suggesting that these American Law Institute guidelines will simply be null and void if the end user agrees to a EULA? Problem solved! We EULA them too, and we're off scot-free.

      Somehow, I don't think it works like that.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    4. Re:Sue who for what now? by spun · · Score: 1

      What constitutes 'knowingly distributing?' What do their guidelines call a bug? If the bug is disclosed, can the lawyers still sue?

      Could someone please answer these questions in the form of a car analogy for me? This is Slashdot and I'll be damned if I'm going to read the article.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    5. Re:Sue who for what now? by cyphercell · · Score: 1

      Fight Club: "If the cost of a recall is more than the average cost of an out of court settlement ... we don't do one."

      --
      Under the influence of Post-Cyberpunk Gonzo Journalism
    6. Re:Sue who for what now? by countertrolling · · Score: 1

      ...to be taken seriously...

      Is way overrated. Who cares if we're "taken seriously"?

      --
      For justice, we must go to Don Corleone
    7. Re:Sue who for what now? by spun · · Score: 1

      People who want to make money off of open source. People who want to use open source contributions on their resume. Pointy haired bosses who get to decide if we use open source in our workplace.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    8. Re:Sue who for what now? by jd · · Score: 4, Funny

      If the car explodes when you turn the ignition key, it's a bug.

      If the car explodes but the driver can escape and sue, it's a disaster.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    9. Re:Sue who for what now? by spun · · Score: 1

      Ah, now it all becomes clear. You, sir, are a gentleman and a scholar.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    10. Re:Sue who for what now? by countertrolling · · Score: 1

      Sounds to me like the problem is the pointy haired boss. We gotta convince people they are the fools. Instead of us worrying about being taken seriously, let's ridicule them and laugh them off the face of the earth. Show people how they are the ones who work so hard to make life as miserable as they can.

      Saw this in somebody's post:
      Against the assault of laughter nothing can stand - Mark Twain

      Let's us have the last laugh.

      --
      For justice, we must go to Don Corleone
    11. Re:Sue who for what now? by Anonymous Coward · · Score: 0

      No 'we' shouldn't.

      There are a number of cases where the software is clearly at the 'hobbyist' level, or being used as a 'leading edge' test case. Some projects are re-inventing the wheel so that the people on the project can learn how to do something.

      The Open Source movement DEPENDS on people being able to send buggy and incomplete code back and forth in order to work.

      The truth is, that Open Source software allows for a transfer of responsibility. If the software a person will be using could create a big enough problem to sue over, then the user should pay an expert to review the code. This sets up a clear aspect of professional liability on the user's part, and definitely should defray the programmer's liability. Closed source software does not allow for such review, and it therefore leaves more liability in the hands of the manufacturer.

      I think one element of this is that the trail for the lawsuit will be tough. In some cases, the original software authors are deceased and in others they may be very anonymous.

    12. Re:Sue who for what now? by spun · · Score: 1

      I feel you, buddy. However, in my experience when one laughs at the boss, the boss gets the last laugh. You know they are ridiculous. I know they are ridiculous, hell, they know, in their dark little hearts, that they are ridiculous. Which is why they are so vindictive.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
  10. Bad idea by ShadowRangerRIT · · Score: 3, Insightful

    Vendor liability for software is a good idea only in *very* limited fields, with *very* strict parameters. If the problem domain allows for exhaustive testing (every possible input, every possible code path), then this sort of liability is reasonable. Embedded control software for vehicles is a good candidate. But to apply the law to general purpose computers like we would for mechanical devices is absurd. They aren't a monoculture; they can run anything, which means anything can break them. Every general purpose OS out there suffers from the occasional crash (Windows, OSX and *NIX included), and the very nature of the machine means that you can't always determine the cause. If one kernel level process writes into the memory space of another, overwriting pointers and code, the eventual crash will appear to be the fault of the innocent process (after all, it tried to dereference null). The forensics required to assign blame unquestionably would cost more than the lawyers would.

    Much like patent law, this is one field where hardware can go that software should not.

    --
    $_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
    1. Re:Bad idea by jd · · Score: 1

      TFA only talks of known bugs that are specifically and maliciously not revealed. Thus:

      • If the product has known bugs but the vendor supplies a list that documents it, it's not a problem.
      • If the product has unknown bugs, it's not a problem.
      • If users report bugs onto a public bugtracker, it's documented and therefore not a problem.
      • If bugs are detected and not publicized for a few days so that a patch can be rolled out, it's not a problem - particularly for security defects.

      The ONLY case where it would be a problem would be if you had a flaw that was likely to be damaging to others, known about for a significant period of time, not fixed and not revealed - particularly if not revealed for reasons of PR or market share.

      Frankly, if a vendor is more concerned about PR than a good product, they're bastards that deserve everything they get.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
  11. Why should general liability even exist? by fuzzyfuzzyfungus · · Score: 5, Insightful

    Other than the fact that people hate software bugs, which is fair; but insufficient reason, why should a general liability be presumed to exist?

    For software purchased as a custom/customized enterprise type setup, with guys in suits, and contract negotiations, and spec documents and whatnot, surely the parties involved can settle any questions of bugs, liability for bugs, responsibility for timely fixes, etc. as a matter of contract between themselves. Perhaps it would be convenient for a de-facto standard set of terms to exist; but I don't see why any legally binding assumption needs to be made, beyond what was specified in the contract.

    For the consumer/shrinkwrap/non-custom stuff, I'd be strongly in favor of a right to return for refund if defective(though deciding exactly what level of buginnes qualifies as "defective" could well be tricky, and settling the issue of whether or not "being able to run on joe sixpack's box-o'-spyware-and-rootkits or timmy the tweaker's bleeding-edge-super-nlite-professional-l33t-3dition-h4x0red-windows-box" is actually a reasonable expectation could be a nuisance); but liability beyond that, unless actual damages can be demonstrated, seems unreasonable.

    Already, if software is being used as a component of a system(medical, aviation, whatever) where bugs matter, it is subject to those standards, establishing a set of liabilities for software generally just seems like a good way to encourage ever more onorous disclaimer contracts and quash free/OSS/cheap software.

    1. Re:Why should general liability even exist? by n30na · · Score: 1

      "being able to run on joe sixpack's box-o'-spyware-and-rootkits or timmy the tweaker's bleeding-edge-super-nlite-professional-l33t-3dition-h4x0red-windows-box"

      I giggled.

    2. Re:Why should general liability even exist? by jd · · Score: 1

      You'd be right in the absolute general case. However, I would argue that certain bounds are within reason.

      For example, it is certainly possible for a computer - through software - to destroy a hard drive (bounce the read-heads off the buffers enough times and they'll misalign or fall off) or a monitor (with the right timings, you can even set some monitors on fire).

      The Sony rootkit was an actual piece of software that really DID cause actual damage to hardware AND where knowledge was maliciously withheld.

      The self-bricking Seagate drive firmware was also an actual piece of sofrware that really DID cause actual damage, but it would be exempt because the company did NOT withhold information but made a damn good best-effort try at releasing unbricking firmware.

      Thus, here we have two examples of actual damage, but only one would fall foul of the proposal - the one we all complained should damn-well have been illegal.

      Those objecting to this proposal should consider that the Sony rootkit was not illegal and is not illegal, but under the DMCA it IS illegal to take any precautions to safeguard your system against it. I say that this is a damn-fool way for the law to be. You should NEVER be liable for taking reasonable steps, companies should ALWAYS be liable when they DO NOT take reasonable steps.

      And that, I believe, is the key to this debate - whether or not a reasonable step has been taken or deliberately avoided. I don't think anyone is arguing UNreasonable steps should be taken. But when something is entirely reasonable, practical and sensible, it should be possible to hold avoiders to account.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    3. Re:Why should general liability even exist? by Anonymous Coward · · Score: 0

      I agree that general purpose liability is insanity, but there's a *lot* of cases where something akin to this could be useful. I'm working at a startup, building a product using FPGAs. After pretty damn careful review, we chose an FPGA package from one of the two largest FPGA vendors. 4 months into using it, we discovered a major bug in their memory controller- which you could not talk to DDR2 memory without running into. Liability? hah. Bugfix in timely manner? Not a chance. We had to recode the memory controller ourselves- and luckily we're not up against the capacity wall in the chip, so we've got room to do it. All in all, it was about 3 engineering weeks to correct this issue. It could have been a lot worse if we were out of room on the chip- it could have sent us back to restart with a different FPGA. The FPGA programmers say this sort of issue crops up all the time- nearly every generation of the products have these sorts of issues, and nobody ever gets anything out of the FPGA companies for it. Should there be liability attached?

    4. Re:Why should general liability even exist? by fuzzyfuzzyfungus · · Score: 1

      In the Sony case, I'd say that product defect liability isn't really the right area of law to apply. Compromising tens of thousands of computer systems by stealth and planting rootkits is a felony. The fact that a defective product, rather than some other means, was used is, by comparison, a trivial matter. Sure, because Sony is a major multinational, not a scary hacker, they suffered some token financial penalties, rather than felony charges and prison time; but that was hardly a just outcome.

    5. Re:Why should general liability even exist? by Anonymous Coward · · Score: 0

      That sounds like a case where there is insufficient information in the marketplace. It sounds like you were caught by surprise by this bug. Does information about it exist on the internet? If not, why haven't you written a post about it? The information needs to be out there for the buyer to be making a well-informed decision and to publicly shame the companies into producing higher quality products (for less profit in the short-term, presumably).

      More reasonably, a requirement for all known bugs to be published might be reasonable on the basis that not doing so is willingly and fraudulently misrepresenting your product (with nothing more than a date and severity level for exploitable security issues). Most open source projects meet that requirement simply by having an open bug tracker. Well, legal requirement might be a bit strict. The article is about recommended guidelines.

    6. Re:Why should general liability even exist? by jd · · Score: 1

      It is precisely because Sony escaped with barely a rapped knuckle to its name that it is evident the laws do not provide any kind of deterrent to deliberate and willful sabotage of a software product by a corporation.

      In light of the "special circumstances" provisions in other laws (eg: violence that is also a hate crime, theft with terroristic intent, etc), the deliberate addition and concealment of defects for the purpose of causing harm (even if the harm actually caused is not the harm intended) should be a special case which results in severe penalties AND jail time for each and every person who was involved in producing that defect or an accessory to the fact through the willful concealment of it.

      In short, I don't give a damn if this ends up being product defect liability, some other area of liability, or a law only the man in the moon could have thought up, I want the legal system to indemnify utterly those who discover such logic bombs regardless of DMCA provisions, and I want the legal system to treat the planters and co-conspirators in logic bomb attacks to be treated no different from the planters of car bombs. The action is that of a terrorist and should be treated as such.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
  12. 'knowingly' by oldhack · · Score: 2, Insightful

    That's the weasel word to generate extra lawyer business. Scumbags.

    --
    Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
    1. Re:'knowingly' by nomadic · · Score: 1

      So...you're saying there should be strict liability? If you ship software with a single bug that it would have been almost impossible for you to find, you should be held liable?

    2. Re:'knowingly' by Inf0phreak · · Score: 1

      ALL non-trivial (non-TeX :D) software is either shipped with known bugs, or it costs 1000+$ per line of code (aviation, DoD, NSA - that kind of stuff).

      --
      ________
      Entranced by anime since late summer 2001 and loving it ^_^
    3. Re:'knowingly' by oldhack · · Score: 1

      Strict liability with limited scope is better than "knowingly" clause which simply encourages lawsuits.

      --
      Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
    4. Re:'knowingly' by oldhack · · Score: 1

      It's not a bug if it's documented. :-)
      Besides, it could be a feature. :-)
      See, another problem is what constitutes a "bug".

      --
      Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
  13. Why should there be an exemption for FOSS? by Assmasher · · Score: 2, Interesting

    I'm not anti-FOSS in any way, I'm just wondering why it would be exempted...

    --
    Loading...
    1. Re:Why should there be an exemption for FOSS? by Anonymous Coward · · Score: 0

      For the same reason you should not be liable for defects in items you may donate to a charity?

    2. Re:Why should there be an exemption for FOSS? by johannesg · · Score: 3, Interesting

      I'm not anti-FOSS in any way, I'm just wondering why it would be exempted...

      Would you spend years of your life making something useful, then give it away freely, and subsequently be sued to the point of losing your house, just for fun? At least commercial businesses are actively trading risk for gain; the open source developer only gets the risk part of the equation here.

      I can see an entire industry spring up around finding bugs and sueing the maker of the software (much like the patent-sharks of today). You don't even have to read the source, just download a copy of whatever you want to hit and look in its Bugzilla tracker...

    3. Re:Why should there be an exemption for FOSS? by Tired+and+Emotional · · Score: 1
      Because its free, so no contract is formed between the user and the supplier.

      In any case, for a lot of open source software, the bug database is also open, so making sure any bug you find is reported in a timely manner should be a good defense. Putting it in the database discloses it while making sure it is timely means you cannot be accused of keeping it secret.

      It does create an incentive for projects to keep open bug databases.

      --
      Squirrel!
    4. Re:Why should there be an exemption for FOSS? by Assmasher · · Score: 1

      First, that's a very inaccurate description of what FOSS is. There are FOSS developers who make a living just doing FOSS, for example, charging for support, training, prioritization of bug fixes/feature requests, et cetera. Second, and most importantly, what has that got to do with basic fairness?

      Whether you charge for software or do not charge for software should not affect your liability in the legal system for issues with that software.

      --
      Loading...
    5. Re:Why should there be an exemption for FOSS? by Assmasher · · Score: 1

      Contract? Nobody is talking breach of contract, this is a push for legislative bindings that would punish people who 'ship' software with bugs knowingly. Whether you charge for your code or not should be immaterial to whether you can be sued for knowing publishing buggy software for people to use. Why should FOSS be exempted? Many major FOSS projects are only 'sort of free' in any case, charging for support for example (again, there's nothing wrong with that.)

      Personally, I think that issues like this should be left to the contract involved (thereby automatically exempting most FOSS) and the traditional method for handling things like this. New legislation and/or legal guidelines in this area is simply opening a large can of worms.

      --
      Loading...
    6. Re:Why should there be an exemption for FOSS? by Assmasher · · Score: 1

      It's not a good analogy at all. You did not create the goods in question that you donated to charity, but if you DID create the goods (like a bicycle for example) and you knowingly donated it knowing it had seroius flaws and someone was hurt - how does it matter that you gave it away for free?

      --
      Loading...
    7. Re:Why should there be an exemption for FOSS? by Chirs · · Score: 1

      Suppose I write some software and put it up online without charging for it or even claiming that it's any good.

      If someone else downloads that software and uses it, it's up to them to decide whether or not it's good enough for their purposes.

      On the other hand, if I buy a piece of software from a commercial vendor and it crashes my system and destroys my data then I think they should be held responsible to a certain extent--at least enough to cover the time and costs of recovering from backup and replacing any bricked hardware.

      The problem with leaving it to the contract involved is that most consumer software doesn't have one--the vendors all try to avoid any responsibility for providing a product that actually works.

    8. Re:Why should there be an exemption for FOSS? by Assmasher · · Score: 1

      IF you are agreeing that this legislation should happen, and IF you put software out there for people to use, and you did so "knowing" that it was buggy, and someone used it and was 'hurt' (in some fashion) due to these bugs why shouldn't you be as liable as a company that does the same thing but charges for it?

      What on earth does money have to do with responsibility outside of a contract?

      As for most consumer software not having a contract, you take your chances, just like you would with free software with no contract.

      There's quite a bit of FOSS that I like, and I contribute to it occasionally (I don't code much outside of work anymore sadly), but I don't think it deserves any special protection under the law because it is free. It should be treated in exactly the same manner, legally, as software that people purchase. BTW, I don't think either type of code should be bound to some indirect contractual guidelines, it doesn't make sense.

      --
      Loading...
    9. Re:Why should there be an exemption for FOSS? by greenbird · · Score: 1

      I'm not anti-FOSS in any way, I'm just wondering why it would be exempted...

      Because the user has the same access to source and thus the same opportunity to find and/or fix bugs before they use the software. With closed source software they are at the mercy of the vendor with regards to bugs. The contract says there are bugs so if you need the software to be bug free you need to take on the fiscal burden to make it so.

      --
      Who is John Galt?
    10. Re:Why should there be an exemption for FOSS? by johannesg · · Score: 1

      First, that's a very inaccurate description of what FOSS is. There are FOSS developers who make a living just doing FOSS, for example, charging for support, training, prioritization of bug fixes/feature requests, et cetera.

      There is a handful of people who do that, yes. And then there are tens of thousands not making a dime, who have dayjobs that pay their bills, and do programming for fun at night. Should their hobby suddenly make them liable for large damages? Should they be excluded from doing what they love just because of legal fears?

      And before you answer that, keep in mind that we are talking in the context of production of free software here.

      Second, and most importantly, what has that got to do with basic fairness?

      Whether you charge for software or do not charge for software should not affect your liability in the legal system for issues with that software.

      It damn well should. If you are not in any kind of relationship with the person using the software, i.e. if he should not have any expectation of service from you, that should also limit his ability to sue you for not meeting his expectations.

      The fairness comes from the developer having zero benefit, and (with the proposed law) significant risk. This is different from a commercial company, which takes a risk (investing money, taking on legal liability) in return for a chance at significant benefit.

    11. Re:Why should there be an exemption for FOSS? by spiffmastercow · · Score: 1

      Good point. Grandparent should have said:
      For the same reason you should not be held liable for defects in items you leave at the end of your driveway with a "free stuff" sign next to it.

  14. Re:I believe almost every free software I use has. by fuzzyfuzzyfungus · · Score: 1

    There are things that can't be warrantied away like that(and in some cases, this is a good thing; but; I just don't think that software is one of them). "Delicious candy may contain succulent lead, eat at own risk, non-toxicity not warrantied" would not make selling tainted food any less problematic.

  15. New guidelines by SirGarlon · · Score: 2, Insightful

    How about these for new liability guidelines: if the vendor knowingly ships buggy software, the customer is entitled to a 100% refund on the license cost.

    --
    [Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
    1. Re:New guidelines by i.r.id10t · · Score: 1

      Or how about entitled to the source so they can fix it or pay to have it fixed by a contractor?

      --
      Don't blame me, I voted for Kodos
    2. Re:New guidelines by Soukyan · · Score: 1

      This becomes a hard guarantee to make. As a poster above stated, it can take millions to produce a relatively small amount of bug-free code. Not that it is impossible. It is costly and time-consuming, but certainly possible. Doing an analysis between the costs of bug fixes and shipping a bug-free product might provide more insight, but then again, there's the issue of what caused the bug. Was it a platform issue? Was an interaction with other software? Was it an untested configuration? We might begin to see shorter lists of supported platforms, and hear more responses stating that software is not supported on that configuration, so there is no guarantee. I do not think someone should knowingly ship flawed software, but I do think that some bugs will always be found after the software has been "in the wild".

    3. Re:New guidelines by cenc · · Score: 1

      I think you are on to something as a legal argument here:

      The open source license and the source code is the warranty. Essentially it is full disclosure and the responsibility of the user to evaluate the suitability of its use in a given situation. It is the 'if I screwed up making this software, here is the code for you to find, fix, or improve' warranty 'but I did not build it for any particular user and thus we are not in some sort of implied contract'.

      For example, if you buy a car and get in a car accident, the end user has very little to stand on legally if he did not know how to drive a car.

      Now, a company say like Red Hat that provides the service of installing and maintaining that software on the behalf of some other user might have some sort of liability depending on their contract for not fully evaluating or keeping up with whatever.

    4. Re:New guidelines by dedmorris · · Score: 1

      How about these for new liability guidelines: if the vendor knowingly ships buggy software, the customer is entitled to a 100% refund on the license cost.

      Forget 100%. As a competitive advantage, FOSS projects could offer triple the license cost as a refund.

    5. Re:New guidelines by Chirs · · Score: 1

      I think bugs should be allowed as long as they are documented and the documentation is available to the customer.

      I also don't think that a license refund is sufficient. They should also be entitled to additional funds to cover the cost of removing the software and repairing the damage.

    6. Re:New guidelines by sjames · · Score: 1

      That's exactly why software should be exempt to the usual laws surrounding other products. Even fairly simple computer systems have more potential interactions between components than the most complicated auto. So much so that they are at the bleeding edge of the level of complexity that we know how to deal with. A car does one thing. A computer does many and various things, often at the same time.

  16. Interesting by BigGar' · · Score: 1

    IANAL - NDIPOOT (Nor Do I Play One On Tv) From the Article: A key passage -- Section 3.05 (b), if you want to look it up -- says that user agreements contain an implied warranty that purchased software "contains no material hidden defects of which the transferor [the seller] was aware at the time of the transfer." What's more, no matter what language the vendor places in the user agreement, the warranty still stands. Wouldn't this make it tough to ship a product at all? The code base would have to have no known defects (bugs) regardless or scope or scale of the bug/defect. I'm assuming a material defect would just be a defect or some part of the code that doesn't do what it's supposed to do. I suppose you could just publish a list of known "usability enhancements",but even that at it still seems like a huge burden to place on the developer. What about when issues come up once a product ships? The products that ship after the discovery but before the notices can be updated would be in breach of this "recommendation".

    --


    Shop smart, Shop S-Mart.
    1. Re:Interesting by Anonymous Coward · · Score: 1, Funny

      ADSTIYHTEWTM - Acronyms don't save time if you have to explain what they mean

    2. Re:Interesting by piojo · · Score: 1

      The code base would have to have no known defects (bugs) regardless or scope or scale of the bug/defect.

      I imagine you can get around this by publishing the URL of your bug tracker in the contract.

      Of course, this URL would probably go to a server that was configured to display no bugs past $DATE and to only display the initial bug report or title, not the ensuing discussion (at least for secretive companies).

      Bigger companies (those that sell shrink-wrapped software) might have to just keep a public bug tracker. That would be really nice, because I could look up whether a piece of software had any issues on my hardware before I bought it. (This might be useful for enterprise Linux distros.)

      --
      A cat can't teach a dog to bark.
    3. Re:Interesting by jd · · Score: 1

      This is one of the theoretical purposes of Common Law, which at its most abstract basically says that nobody shall be liable for the unreasonable or the unforeseeable, and anyone may be liable for failures they are responsible for that are both reasonably avoidable and foreseeable.

      This is why it deals with things like "acts of God/Nature", the "reasonable man", and so on.

      IMHO, the problem is not with the concept of liability where liability is reasonable, but rather the problem is that reasonableness has left the country and is currently on a skiing holiday at the north pole. If there is no legal framework which sanity-checks the inputs, no law can ever be a good law. If the sanity-checks are in place, even a defective law cannot be used for defective purposes.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    4. Re:Interesting by Krizdo4 · · Score: 1

      If you want people to learn your new acronym, you have to explain it at some point. It might not save time now but if after a while legions of slashdot users adopt it, it won't need to to be explained anymore and it will start to save time.

      Even if it is a waste of space anyways.

    5. Re:Interesting by Anonymous Coward · · Score: 0

      IANAL - NDIPOOT (Nor Do I Play One On Tv)

      Thanks for the clarification. I just thought you had really loud gas before you could finish your acronym.

  17. bugs are features by kronosopher · · Score: 1

    No but seriously, considering the amount of money and effort being shelled out to patch software this really doesn't seem plausible. So long as development is beholden to short-term corporate profits, bugs will never go away.

  18. License by pete-classic · · Score: 1

    Could this be worked around with some language in the license along the lines that 1. We disclaim liability. 2. If such a disclaimer is not valid in your jurisdiction, we do not extend you license to use this software?

    -Peter

    1. Re:License by selven · · Score: 1

      Aside from establishing Linux and OSX footholds in a whole bunch of jurisdictions and quadrupling the incentive for commercial software makers to release Linux versions that would be extremely effective.

  19. Can a "level" of liability be set fairly? by Soukyan · · Score: 1

    While a number of coders could be responsible for a software defect, it would be the responsibility of a given software project to correct that defect in a timely and effective manner. The reliance on an open source application can be guaranteed in part through support contracts, but simple ethics would dictate that the developers should hold themselves accountable for the final product. I wrote an essay (Liability, Reliability, and Safety) that briefly touches on this topic back in 2007.

    One point that I argue is "[c]ompanies must constantly look at their level of liability and manage the reliability and safety of their systems. Spinello discusses some issues of reliability such as software 'bugs' which are an inherent problem with any piece of software and are to be expected, within reason. However, the programmers of the software are expected to assume the responsibility for providing fixes for the bugs and improving upon the existing code."

    The problem lies in defining what "knowingly" means. After all, "software vendors know that the nature of software guarantees a certain amount of bugs thereby raises the risk to the vendor. However, it is not unreasonable to expect that any crippling system bugs would be removed from the final release product. Asking software vendors to assume some liability would help to drive the quality of the software upward."

    Ironically enough, I ask the question at the close of my arguments: "From a legal perspective, the United States has some way to go to resolve the problem of liability, especially in the software industry. Software products and systems are not only used to process secure transactions and enable consumers to manipulate data, but they are also used in environments where human lives are at stake and sensitive private data is handled by many different people at all hours of the day. Negative feedback has been proven to work less effectively than positive feedback when dealing with the human psyche, but should software vendors be offered incentives to provide better offerings and assume more liability, or should they be forced to accept a minimum level of responsibility by law and an increasing amount of accountability based upon the industry and the application of the product?"

    So, in the case of open source software, should an application targeted at the medical industry be more liable than an application that serves personal media on the Internet? While I would like to see more open source software used in more organizations, I believe that as things stand now, service level agreements and quality of support on standard platforms play a large role in determining whether or not to use an open source application.

    As for the risk of litigation,where does the onus of responsibility fall when there is no corporate entity? Does the owner of the individual project become the liable one?

  20. Re:I believe almost every free software I use has. by piojo · · Score: 3, Interesting

    I suspect that in commercial software, there is an implication of warranty (because the customer paid for it), and that warranty can't always be signed away by a contract (because of things like consumer protection laws).

    I would think that if a piece of software is free as in beer, it would be easy to explain to a judge that the project authors had no business relationship with the user, and thus could not be held liable.

    It's sort of like the "I am not your lawyer, this is not legal advice" disclaimer--the person giving advice is less likely to lose a malpractice suit if he/she says "I have no business relationship with you, so don't take this with the same gravity that you might take my real legal advice."

    --
    A cat can't teach a dog to bark.
  21. Re:I believe almost every free software I use has. by piojo · · Score: 2, Funny

    Oh, and I'm not a lawyer. And if I were, I probably wouldn't be you lawyer. In which case this would not be legal advice...

    --
    A cat can't teach a dog to bark.
  22. Option by sanosuke001 · · Score: 2, Interesting

    Just add a stipulation for software that has source code available as exempt.

    Or add an exemption to any company that gives a list of known bugs at release. If they blatantly say they know something is buggy, then that would be fair to me.

    --
    -SaNo
  23. There goes the Video Game Industry by Tekfactory · · Score: 1

    Well hell there goes the Video game industry.

    No more just ship it and we'll patch it later mentality. Because at that point you "knowingly" shipped product with defects.

    Either that or Quality Control esting will drop to Zero and bug databases will get wiped right before shipping.

    1. Re:There goes the Video Game Industry by Tekfactory · · Score: 1

      Either that or Quality Control esting will drop to Zero and bug databases will get wiped right before shipping.

      Oh the ironies

      Quality Control Testing

  24. Does this mean.. by Tomun · · Score: 1

    Does this mean that if someone informs a vendor of a bug in their software they immediately have to prevent all downloads and inform retailer to remove the product from their shelves until the bug is fixed and replacement software can be shipped ?

    Does anyone have a link to the full text of these guidelines ?

  25. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  26. Re:I believe almost every free software I use has. by AndrewNeo · · Score: 1

    You should really change your MOTD to something more interesting.

  27. Problem is knowing. So close your eyes. by 140Mandak262Jamuna · · Score: 1
    So you could be liable if you knowingly ship defective software. The correct solution is then not to look at bug reports and other feedback. Then you could not be accused of knowingly shipping defective software. That is why Microsoft refuses to acknowledge the existence of security holes widely reported and widely being exploited. By saying "We are still investigating the alleged security violations" and making these "inspectors" not communicate with developers and mangers charged with shipping the products, Microsoft evades responsibility. It takes money and bigger infrastructure to pull of this trick. Now that Red Hat has also finally grown up and joined the big boys (now it is part of S&P 500) it can afford to pull the same trick. And so it is scaring the hobbyist. Once the hobbyist and enthusiasts stop contributing code the big commercial guys can divvie up the market between themselves. That seems to be the strategy here.

    Send bug reports directly by email to managers in Microsfot and Red Hat. Make them "know" the defect. That will level the playing field.

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
  28. Not like it matters... by dmsuperman · · Score: 1

    Most software ships explicitly without any warranty and says that it has no responsibility for lost data or corruption and such, wouldn't this negate any liability?

    --
    :(){ :|:& };: Go!
  29. what nonsense by i_ate_god · · Score: 1

    Every company I've worked for has knowingly released software despite KNOWING there are bugs. That's just the nature of the business. Get every single major bug fixed, bring low priority bugs down to a minimum and release. Open source or not, this is how it works. Sometimes the new features of a new version is more important than making sure a particular button in the UI is properly translated in the different languages you support. It's still a bug, and it was KNOWINGLY SHIPPED with that bug, but it wasn't worth the effort.

    Sue happy lawyers will one day know what it's like when I litigate my foot up their ass.

    --
    I'm god, but it's a bit of a drag really...
  30. Microsoft by gillbates · · Score: 0, Redundant

    Second point, who is going to sue some no-name contributor who doesn't have any money anyway, especially if you have to prove that that particular developer knew there were bugs?

    Microsoft. That's who.

    If it is possible to sue OSS for bugs, any vendor who feels they've lost business to OSS will be prone to suing OSS maintainers, if for no other reason than to cast FUD on free software, i.e. "Didn't they (the OSS developers) get sued for writing buggy software?"

    Without the proposed legislation, such lawsuits are much more likely to be dismissed.

    --
    The society for a thought-free internet welcomes you.
    1. Re:Microsoft by spun · · Score: 1

      In general, maintainers are not distributors. They may work for distributors, but they aren't the ones who package it up and sell it. If anyone could sue anyone who ever worked on a project that had bugs in it, that would be bad. Nobody would sign such an asini... well, maybe they would, but I doubt it.

      If Microsoft really stands to benefit from suing open source maintainers, why are they against this as is clearly stated in the summary.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
  31. Re:I believe almost every free software I use has. by reebmmm · · Score: 2, Interesting

    This comes up every time warranty issues are raised. The problem is that for that warranty to be effective, the parties had to agree. Hence, those that say open source software is not an agreement (or that one does not have to accept the terms of the GPL etc.) have a problem. I've said it before, certain of the terms of the GPL are not merely license language. The community cannot have it both ways.

    Either this clause in unenforceable because their is no agreement (one party did not agree to it), or the GPL requires every user to accept the terms of it.

  32. Re:LOL by mcgrew · · Score: 2, Funny

    Put the chair down, Steve.

  33. The solution is simple... by Zantac69 · · Score: 1

    Developers will now refer to "known bugs" as "software features that require coding improvement that will be patched at a later date" while "unknown bugs" will remain "undocumented software features"

    --
    1331461 is only semiprime *sigh* Alas - I am just short of 1337.
  34. Re:I believe almost every free software I use has. by 140Mandak262Jamuna · · Score: 2, Insightful
    There are things that can't be warrantied away like that(and in some cases, this is a good thing; but; I just don't think that software is one of them). "Delicious candy may contain succulent lead, eat at own risk, non-toxicity not warrantied" would not make selling tainted food any less problematic.

    But if I just give away my leftovers from my restaurant to some soup kitchen free, would I still be liable? May be. If I give away left overs from my home to a passing vagrant would I be held liable? What if I brown bag my lunch and in the work place they order pizza for some reason and I give my brown bag to the homeless guy on the way to the trolley stop without even opening to check if the sandwich has spoiled, would I still be liable?

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
  35. Re:I believe almost every free software I use has. by PolygamousRanchKid+ · · Score: 4, Insightful

    So.....you're going to sue a developer for a defect, intentional or not, even though they said it was not warrantied and use at your own risk?

    No lawyer will sue individuals developers . . . they have no money. They will try to sue a big company, um, like what SCO tried with IBM. Lawyers go after the money.

    Some big companies even forbid their programmers from working on Open Source projects on their own time . . . unless they are approved by their employer, of course. Because the lawyer suing will try to twist it so that the employer is responsible . . . because only a big company has enough cash to make it worth their effort.

    --
    Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
  36. Re:I believe almost every free software I use has. by Anonymous Coward · · Score: 0

    And no warranty or guarantee *SHOULD* be implied. Almost all software is buggy under the right circumstances, as even the best programmers can't interpret, test, and correct every possible scenario. To make things even more complicated, it seems that all but the most expert of users blame the wrong component for their problems, whether it be the OS, the OEM, or Republicans.

    Very high end software intended for business with high priced monthly or annual service contracts? Yes, hold the company liable for software problems that cause a serious loss. But holding OSS to the same standards? They're out of their minds!!

  37. Re:I believe almost every free software I use has. by moredots · · Score: 1

    I'm logged in, so IDK why that was posted anonymously. -_-

  38. Re:I believe almost every free software I use has. by Wrath0fb0b · · Score: 4, Interesting

    "NO WARRANTY OR GUARANTEE IS IMPLIED. USE THIS SOFTWARE AT YOUR OWN RISK" or some combination of that. Even my home server says that every time I SSH into it.

    There is no reason that a legislature cannot pass a law saying that this disclaimer is contrary to public policy and won't be respected in the courts.

    For instance, in my State, contracts to purchase a car that are "AS-IS" are not legal. You can write those terms into the contract and the buyer can sign it, but if she turns around and sues you the Court won't give effect to that part of the contract.

    Another example, I cannot rent an apartment or house "AS-IS", I am required by law that my rentals conform to a general standard of habitability. It doesn't matter how many times in the rental contract I disclaim any warranty of habitability, I still have to provide a habitable dwelling.

    Consumer protection statutes are full of these sorts of provisions that forbid the use of certain kinds of terms and conditions. You can't sell food without a warranty of non-contamination or edibility, you can't sell children's playground equipment without a warranty of safety, .....

    TL;DR version: the law does not have to respect your right to contract under whatever terms you see fit (I'll leave the normative argument of whether it should for another time & place).

  39. Agency regulation? by johannesg · · Score: 1

    If you read to the end of the article, they are suggesting that instead of a law, what is needed might be agency regulation. I'm not really sure which of the two is more frightening, or more stifling for the industry...

  40. Re:I believe almost every free software I use has. by jargon82 · · Score: 1

    I believe you would. I once worked in retail, and we couldn't give away food that was still in date and in good condition to food banks (but which for some reason or another we had to get rid of), because of liability concerns.

  41. "like the body or the subject!"- sry by paxcoder · · Score: 1

    BTW Why are you quoting free software?

  42. And in other breaking news... by atlien247 · · Score: 1

    ...technological process comes to a halt. Potentially, one could be faced with a perpetual software development project--deadline after deadline missed because of a 'known' bug. Of course, one could always forego QA testing so that bugs can get by 'unknowingly'. Granted, these are extremes, but still... get a clue ALI!

  43. Re:Solution by CastrTroy · · Score: 1

    Good point, although I would changed it to "knowingly selling software with known bugs which are undisclosed". All the unknown bugs are obviously undisclosed, and you wouldn't want a software company fined because they didn't disclose bugs that they didn't even know about.

    --

    Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
  44. Re:I believe almost every free software I use has. by Red+Flayer · · Score: 1

    State law in the US often directly mandates certain warranty conditions for sold products. There are certain warranties that cannot be signed away, disclaimer or no.

    The question is what happens when an open source product is used in a sold product. Is the seller of the end-product solely liable, or is the producer of the open-source (and free) component also liable?

    Everyone likes to pass the buck. If I successfully sue Sony because their battery melted my thigh, is the company they contracted to manufacture said battery also liable? Can Sony recoup their fines from the battery manufacturer, if the battery was not delivered to spec? For non-open-source software, they can. But say that Sony used a software controller for the battery that caused the meltdown, and that controller was open-source. Can Sony sue to recoup their costs from the authors of that piece of software, which was provided free-of-charge under an OS license, and was probably not developed specifically for Sony's specifications?

    *The reason I use the Sony example is because when they had their battery problems, contributory liability was a subject of discussion here on Slashdot. I don't think the OSS liability issue was raised at all, it's just the best example that popped into my head.

    --
    "Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
  45. Re:I believe almost every free software I use has. by Anonymous+Brave+Guy · · Score: 1

    But why should the clause be necessary at all if the software was free-as-in-beer? If there is no consideration, there should be no obligation either; this is basic contract law.

    Attempting to make people who give things away entirely for free liable for the consequences is a very dangerous path to tread.

    --
    If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
  46. Re:I believe almost every free software I use has. by sumdumass · · Score: 1

    Not all Open source software is free and in beer. The free as in beer model isn't even required for free software especially the GPL or BSD or similar licenses.

  47. But that's retarded, all software has LOTS of bugs by Anonymous Coward · · Score: 1, Interesting

    Every moderately complex piece of software has hundreds or (more typically) thousands of KNOWN bugs in it when it ships. The developers know this, because they try to fix all the *bad* ones before shipping it. Every large project I've worked on, had tens of thousands of bug reports in the bug tracking system. For example: our current codebase is a few million lines, and our bug tracker has 35,000 bug reports in it, of which maybe 1 to 2 thousand will be *known bugs* (but minor ones) that are fixed before we ship. This is entirely normal throughout the entire software industry, and useful software would simply NEVER GET SHIPPED if we didn't work like this. /shrug.

    A few years ago I was on a team of 4 people that were part of a larger (approx. 200 people) product team at one of those big corporations everyone dislikes. Our component (with 4 people and a few hundred thousand lines of code) had maybe 300 or 400 known open bugs in it, when the product shipped. Which tells you very little about the overall quality of the project--most of those were very minor nits. We did fix around two thousand bugs (ranging from annoying to showstopper) in the months leading up to ship.

  48. Re:I believe almost every free software I use has. by elgaard · · Score: 1

    It is not an agreement. The GPL licence says:

    ==
    9. Acceptance Not Required for Having Copies.

    You are not required to accept this License in order to receive or run a copy of the Program.
    ==

  49. Re:I believe almost every free software I use has. by nurb432 · · Score: 1

    Sure sounds like it, but i think the true intent here is to create a new market for 'software programming insurance' ( and government certifications and bonds that go with it ), which will be priced out of reach of the small hobby coder contributing to OSS or a small code shop trying to make a living in their tiny niche market..

    And besides, what software doesn't have at least ONE bug in it?

    --
    ---- Booth was a patriot ----
  50. Re:I believe almost every free software I use has. by sumdumass · · Score: 1

    Not everything is given away free.

    What about a project who used the GPL but charges for the product like Redhat enterprise server or something.

  51. Programmers Developers , Engineers by Anonymous Coward · · Score: 0

    Programmers and Developers are generally safe from any lawsuits, as long as they follow CYA principles [ Cover Your Arse].

    Engineers are other LICENSED PROFESSIONALS who USE said software above, are liable THEMSELVES.

    Simple as that.

    Any good engineer knows that software calculations MUST BE CHECKED, and they are liable for any defects THEY [not the software] cause.

  52. OSS authors just as liable as commercial ... by SineNomen · · Score: 1

    I suspect that in commercial software, there is an implication of warranty (because the customer paid for it), and that warranty can't always be signed away by a contract (because of things like consumer protection laws).

    I would think that if a piece of software is free as in beer, it would be easy to explain to a judge that the project authors had no business relationship with the user, and thus could not be held liable.

    A business relationship does not require money to change hands. I suspect that like contracts all that is required is that both parties receive some sort of "consideration", http://en.wikipedia.org/wiki/Consideration. Consideration is obvious for the user(s), they get the software, but consideration for the author(s) could be quite varied. Passing along the author's work (as the GPL requires), reporting bugs back to the author, mere use of the software enhancing the author's standing in a community (or maybe just stroking the ego), ... I'm sure a real lawyer could get quite creative, as they have successfully done with consideration under contract law. Unless of course the legislation gives OSS authors a special status which they currently do not have.

    1. Re:OSS authors just as liable as commercial ... by SETIGuy · · Score: 2, Insightful

      A business relationship does not require money to change hands. I suspect that like contracts all that is required is that both parties receive some sort of "consideration", http://en.wikipedia.org/wiki/Consideration [wikipedia.org]. Consideration is obvious for the user(s), they get the software, but consideration for the author(s) could be quite varied. Passing along the author's work (as the GPL requires), reporting bugs back to the author, mere use of the software enhancing the author's standing in a community (or maybe just stroking the ego), ... I'm sure a real lawyer could get quite creative, as they have successfully done with consideration under contract law. Unless of course the legislation gives OSS authors a special status which they currently do not have.

      These is no contract involved in using software provided under the GPL. The GPL only covers distribution, not use. If no consideration was provided to the author from the end user, no business relationship exists. A distributor of GPL based software has a contract with the author, but that contract only involves distribution, not use of the software. Since that contract states pretty clearly that the software is provided for distribution only if the distributor disclaims that it is fit for any specific purpose the author is pretty much covered against legal action. The distributor, on the other hand, if they don't disclaim warranty they can be held accountable by both the user of the software, and by the author for failure to follow the licensing terms. IANAL, so this ain't legal advice.

  53. Re:I believe almost every free software I use has. by Anonymous+Brave+Guy · · Score: 1

    That's why I said free-as-in-beer.

    If you want to take money from someone, there is an expectation that what you're offering in return is of a reasonable standard. In software, expecting totally bug-free consumer software is not reasonable, but expecting that it doesn't (for example) silently install malware, trash all the other data on your hard drive, or contain known serious security flaws is fair enough. Whether the source for the software happens to be open is, IMHO, irrelevant to this, and Red Hat et al should be held to the same standard when they charge for software as Microsoft, Oracle or $OTHER_BIG_COMMERCIAL_ENTITY.

    --
    If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
  54. Re:I believe almost every free software I use has. by Anonymous Coward · · Score: 0

    IDK, my BFF Rose?

  55. Re:I believe almost every free software I use has. by Seakip18 · · Score: 3, Insightful

    I can see it now....rogue programmers, up late at night working in secret groups on some highly illegal, highly explosive software. Their code may not be perfect but it's the illegal cool factor that makes it worthwhile.

    --
    import system.cool.Sig;
  56. Re:I believe almost every free software I use has. by BuckaBooBob · · Score: 1

    But thats the thing.. they are trying to get software developers accountable for bad software..

    But its likely as with most attempts to make big business accountable.. This is nothing more than a PR campaign to give voters a warm fuzzy that the government is actually doing something for the people that voted for them.. The laws will be riddled with loopholes and ways for vendors to get out of being liable(Despite the fact it would be very hard to come up with something that would get "commercial" vendors to be more responsible with software releases.)

    In the long run... its total waste of time with the excepting of giving the false impression that government cares about teh common person and not the big businesses that fund their campings to put the in power and line their pockets in some way.

    --
    Who needs WiFi when we can have Packet Over Sheep! http://datacomm.org/PoS-InternetDraft.txt
  57. Re:I believe almost every free software I use has. by russotto · · Score: 1

    The problem is that for that warranty to be effective, the parties had to agree. Hence, those that say open source software is not an agreement (or that one does not have to accept the terms of the GPL etc.) have a problem. I've said it before, certain of the terms of the GPL are not merely license language. The community cannot have it both ways.

    If there's no agreement, there's no warranty. If you accept the terms, there's no warranty. There's no attempt to have it both ways. The "NO WARRANTY" notice is just that, a notice, not an agreement. It may or may not have any effect; some implied warranties cannot be disclaimed. But for software which is free as in beer, there probably isn't any implied warranty.

  58. Re:I believe almost every free software I use has. by FredFredrickson · · Score: 1

    I have written the bug free code:

    print("hello world!");

    it works, even on my toaster.

    Queue comments pointing out special places where even this would break.

    --
    Belief? Hope? Preference?The Existential Vortex
  59. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  60. Here's one for the lawyers by russotto · · Score: 1

    Unlimited liability for lawyers who make arguments which don't hold up in court.

  61. Re:I believe almost every free software I use has. by piojo · · Score: 1

    You're right, I didn't really mean open source software. I'm talking about software that doesn't cost anything--freeware, essentially.

    --
    A cat can't teach a dog to bark.
  62. Re:August 6th, 1945 A Day That Will Live in Infamy by Anonymous Coward · · Score: 0

    It's Hero- It's a city named for the chancellor, much like Leningrad/Stalingrad (st pete's). Hirohito, whose first name was Steve by the way, still lives there to this day. He's like those crazy men you see on the streets, who still thinks it's 1945.

  63. Re:I believe almost every free software I use has. by Anonymous Coward · · Score: 0

    IANAL, but for a contract to be binding, there has to be "Consideration", which is something of value exchanged by each of the parties. In the case of open source, I don't think this applies, so you can't say there's a contract. There's only a license, and that license has terms. I guess it might get murky if someone took your code, improved it, and contributed it back to you directly (signing a joint copyright assignment form or something) because then you'd get back something of value. But that's stretching it.

    There are other requirements, like "a meeting of the minds". You would have to prove that both parties agreed on a fundamental level to the essentials of the arrangement. There also has to be an "agreement", which is typically a signed contract, though an "oral" contract is supposedly just as good (I doubt it).

    There's an interesting parallel in property law. If an intruder breaks into your home and your dog bites him, he can sue you. It doesn't matter if you put a sign up saying "beware of dog" or saying that you disclaim all warranty of safety. The only way around it would be to prove that you had taken reasonable measures to stop someone from getting hurt by your dog (why locking your door doesn't count, I'm not sure). Similarly, you can't "set traps" around your property to purposely injure a trespasser. As a property owner, you're expected to realize it's likely for there to be trespassers and you're expected to take reasonable precautions to protect them.

    I'm not sure how that works in the software world. "Here's some code, you can play with it if you want, but I'm not responsible for anything that happens" seems like it should save you, but if you maliciously inserted a trojan horse ("set a trap") that makes the software self destruct the computer, then I'd assume someone could sue you. The question becomes what's "reasonable" protection for the consumer? Since the public expects that there will be some bugs, you can probably get away with a bug that causes the program to blue screen and they lost their last two hours of work, but if you have a bug that deletes the last year of work, and then goes and deletes the backups... well, I wouldn't be surprised if they were able to win a lawsuit, even if it was free software.

  64. Building Reliable Software by omb · · Score: 1

    Building Reliable Software is possible, see TeX by Knuth.

    1. Re:Building Reliable Software by Anonymous Coward · · Score: 0

      Yes, lets build all our software as we build human culture, over generations. Somehow this idea is kind of attractive for the good for mankind but an awful idea for an investor wanting to be rich right now. Perhaps software should not be considered as an object separated from the culture creating it but as a piece of human culture valuable over generations of constant refinement in a way of Kaizen. Now, this idea somehow feels familiar..Oh, wait!

    2. Re:Building Reliable Software by SETIGuy · · Score: 1

      I tried to play my mp3's with TeX, and it didn't work! That's a bug and I'm going to sue!

    3. Re:Building Reliable Software by cmarkn · · Score: 1

      That was silly. Everybody knows TeX is not for mp3s. You use Emacs to play your music.

      --
      People should not fear their government. Governments should fear their people.
  65. Use of OSS can be a liability by SineNomen · · Score: 1

    At a previous job I asked my boss why we used Oracle and he said that if anything ever went terribly wrong, the company would have someone to sue. Of course, suing someone doesn't restore customer confidence, data, or revenue. No verifiable technical reason, ...

    That's not true. If a company service fails its clients due to a database problem, and it becomes public knowledge that the database was OSS, there could be a downside for going OSS over Oracle. Fair or not, accurate or not, well informed or not ... the public at large trusts large commercial outfits like Oracle and are largely ignorant of OSS. Hostile lawyers or competitors could claim the company used "inferior" tech in their infrastructure, it could negatively impact sales. In the 60's and 70's there were various mainframe and minicomputer vendors, what was the popular saying: "No one ever got fired for buying IBM"? Its the same CYA behavior and it is not necessarily delusional.

    Look at it another way, don't some vendor receive good karma when they tell a technically savvy audience they are using high reliability low cost OSS? The dark flip side is that some vendors receive good karma when they tell a technically unsophisticated audience that they are using the "brand name" high cost solution. So whether your company is being silly or not depends on the nature of its customers, the technical merits of OSS vs Oracle may not be a relevant factor. If customers are willing to pay for brand name warn fuzzy felling the company is probably doing the right thing.

    1. Re:Use of OSS can be a liability by synthesizerpatel · · Score: 1

      Feel free to cite any example where using OSS legitimately (not violating the GPL or some legal technicality) got a board overturned or someone fired (when they had support of their managers).. Odds are it hasn't happened.

      I've never heard of a stockholder meeting where people complained about a company paying less for software.

      "No one ever got fired for buying IBM" could just as easily be "Nobody ever got fired for using Apache" these days.

      And I'd be flabbergasted if any company successfully used the 'But they use unreliable OSS!' argument. Microsoft's been trying that for years only to see Linux steadily gaining on it's server and embedded market. The average consumer probably has no idea what free software is and the technical consumer knows better than to accept any single source of information without scrutiny.

    2. Re:Use of OSS can be a liability by SineNomen · · Score: 1

      I'd be flabbergasted if any company successfully used the 'But they use unreliable OSS!' argument. Microsoft's been trying that for years only to see Linux steadily gaining on it's server and embedded market.

      Servers are not the strong example you suggest, things are a bit more complicated. Linux largely replaced commercial unix and prevented Microsoft from moving from SOHO to traditional unix environments. Similar story for embedded. In short, you can argue Linux prevented Microsoft's expansion into some new markets but you can't really argue Linux displaced Microsoft to a large degree. In the web server segment Apache was more a story of picking up more newcomers to what had been a tradition unix solution than conversion of existing IIS customers. In any case this is a tangent and back to the real point ...

      In reality what an OSS using company could face if its customers are largely technically unsophisticated would not be the crude MS FUD you refer to. It would probably be something close to a competitor's salesperson telling a potential client that the OSS using company has an infrastructure based on software written in part by hobbyists and other volunteers with no accountability, while the competitors solution is based upon the industry leader Oracle. Is that a fair characterization? No. But it is the sort of card that is successfully played every day. As you have admitted, the average customer probably has no idea what free software is. A competitor's sales person can turn that into a liability. At best you are placed on the defensive and have to rebut their characterization, spending time justifying OSS rather than selling your products/services. Worse the potential customer probably realizes that his/her boss knows even less about OSS than they do and fears having to defend their decision when the inevitable technical problem occurs. If we're talking IIS vs Apache then there is enough of a security and reliability difference that nearly anyone can defend the selection of OSS. When we get to something like MySQL vs Oracle the differences are not so great, and many will just go with Oracle knowing that choice offers little room for second guessing and/or gamesmanship.

      Again, if your customers are technically unsophisticated then the perception of security/stability offered by a brand name industry leader can legitimately outweigh technical advantages of OSS. Sad but true.

  66. no *hidden* defects by Chirs · · Score: 1

    Notice the "hidden" in there.

    My reading of that is that the software vendor could just make their internal bug-tracker publicly accessible and they'd be compliant because the bugs would no longer be hidden.

  67. Re:I believe almost every free software I use has. by JStegmaier · · Score: 1

    The GPL is not an end user license. It forces absolutely no terms on the user of the software. The terms of the GPL apply only to the distributor of the software. You don't have to agree to the terms of the GPL in order to use the software, only to distribute it.

  68. No relation on use by gd2shoe · · Score: 1

    Attempting to make people who give things away entirely for free liable for the consequences is a very dangerous path to tread.

    Barring malicious intent and conscious negligence, I agree.

    Here's a point worth considering, the GPL, BSD, et al do not place any limits on the use of software, only it's distribution. Hence, it can be argued that there exists no usage relationship, only a distribution relationship. If a user gets in trouble for using gratis software, how can they claim a business contract? The other party has already disavowed any claim or contract for the purpose of using said software (and disclaimed damages).

    (Obviously doesn't apply to Red Hat, Novel, et al where a monetary relationship and fitness-for-a-given purpose exists)

    --
    I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
  69. Law and capitalism don't mix by ztransform · · Score: 1

    The fact is that capitalism, which seeks to promote efficient and desired activity through profit seeking, is completely incompatible with the legal system and judiciary which seek to arbitrarily impose non-natural constraints on behaviour.

    1. Re:Law and capitalism don't mix by DM9290 · · Score: 1

      The fact is that capitalism, which seeks to promote efficient and desired activity through profit seeking, is completely incompatible with the legal system and judiciary which seek to arbitrarily impose non-natural constraints on behaviour.

      I see nothing nothing natural about private ownership beyond direct physical possession but capitalism depends on this. I own property I've never even seen. property that doesn't even exist in any tangible concrete way. This is only possible because of the legal system and judiciary which seek to arbitrarily impose non-natural constraints on behaviour making it so.

      (actually I'm just quoting you back.. in my opinion the judiciary do not seek to impose anything except a rational interpretation of the laws.)

      --
      No one has a right to their *own* opinion. They have a right to the TRUTH.
    2. Re:Law and capitalism don't mix by sazy · · Score: 1

      The fact that you are sooo correct about this is yet another reason to buy gold, guns & ammo. It won't be long now. -- sazy

  70. Hahahaha! by Anonymous Coward · · Score: 0

    FTA: Don't software buyers, both consumers and enterprise, deserve to get what they've paid for: software that solves the problem it was written to address?

    Why, yes. Yes they do. MicroSoft, I am looking at you! Cough up for the last 20 years!

  71. Why stop at software? by AxeTheMax · · Score: 1

    I'm assuming that the story can be taken at face value, that it applies to all bugs that cause the end user problems.

    But then, this would not and should not stop at software. What about any other type of procedure that people devise to solve a problem? Medical diagnostic procedures for instance. If my cancer was not found because Professor X wrote the diagnostic procedure, and failed to allow for the symptoms being masked by the cold / indigestion / hangover that was affecting me at the time of diagnosis, should I be able to sue him?

    Or perhaps a better example, if my lawyer lost a case for me because he did not allow for all possibilities in dealing with it, but could show that he followed standard guidelines; maybe I would have a case against whoever drew up the guidelines, and especially if it was the ALI that was responsible...

    1. Re:Why stop at software? by Tacvek · · Score: 1

      I'm reasonably confident that you would have a hard time winning any lawsuit against Professor X (Professor Charles Francis Xavier) given his psychic abilities to influence others.

      --
      Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524
  72. Re:I believe almost every free software I use has. by Fulcrum+of+Evil · · Score: 1

    What about a project who used the GPL but charges for the product like Redhat enterprise server or something.

    That's a commercial venture run for profit; shouldn't it get different treatment than someone releasing an OSS drawing app that they made for fun? Anyway, if you get support, there's an implication that the product is suitable for common server tasks.

    --
    "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
  73. Re:I believe almost every free software I use has. by Imagix · · Score: 1

    Crunchy frog? Cockroach cluster? Spring Surprise?

  74. Will they sue everyone, so? by Tomahawk · · Score: 1

    The problem is that everyone ships software with known bugs. The bigger the software, the more bugs.

    A handy case in point is Windows - MS will release a version of Windows, knowing that they will be releasing hotfixes before it get's installed onto a single machine.

    Any software company is going to release software knowing that bugs are in it.

    So, are the going to sue everyone?

    T.

    1. Re:Will they sue everyone, so? by kencoe · · Score: 1

      This sounds like a reason to support the idea, not a reason to prevent it. If you are correct that "everyone" releases buggy code, then maybe we need to give them an incentive to do a little more testing. Do you believe that manufacturers should be allowed to continue production of a product when they are deliberately ignoring safety recalls? Would you feel cheated if you found out that Ford had deliberately ignored a known safety issue, and sold you a car that is known to catch fire, or to repeatedly stall without reason?

      Programmers love to put out an upgrade with new bells and whistles, and this is good. I have no problem with the fact that open-source AND proprietary software will have bugs that show up and require addressing. I also have no problem with software having a limited support cycle. I DO have a problem with the fact that a new revision of a product (or several new revisions in the case of some developers) will be released without ever addressing the known issues, or that vendors will refuse to address issues on a current product. This is gross negligence, and needs to be addressed.

      I think that the idea of a stated legal responsibility warrants consideration. If nothing else, it gives direction to a area that is, as of yet, not being addressed at all. If we can create a standard set of responsibilities for IT professionals, then it will not only hold them responsible for failing to meet their obligation, but also define what is NOT their responsibility.

  75. Legal industry is desparate. by tjstork · · Score: 1

    The problem with the country is that there are obviously too many lawyers and right now the legal industry is utterly desperate. So they are thinking up new ways to try and sue people and going to lean on their puppets in Congress to promote those new kinds of cases just as much as the defendant's puppets in Congress will oppose them. Should be interesting to see how it all pans out, so long as, our puppets that are opposed to such lawsuits win.

    --
    This is my sig.
  76. Re:I believe almost every free software I use has. by The+Grim+Reefer2 · · Score: 2, Funny

    Not all Open source software is free and in beer.

    I should think not. The last time I tried to download FOSS from a server that was in beer I kept losing the connection, and the time I drank beer with FOSS in it, was even worse.

  77. Suing restores revenue by sconeu · · Score: 1

    Darl McBride, is that you?

    --
    General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
  78. Re:I believe almost every free software I use has. by Greyfox · · Score: 3, Insightful
    Pretty much every EULA I've read states that you not hold the vendor accountable for defects in their software or any data loss of yours that occurs while using their software. I don't recall exactly what the Windows one says but I seem to recall that Microsoft is at most liable for $2 in damages if anything goes wrong with their software.

    As the American Law Institute appears to not hold with that belief, lets see how far they get in their goals WITHOUT ANY SOFTWARE! Ha ha ha ha ha ha ha ha ha!

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

  79. Re:I believe almost every free software I use has. by mdwh2 · · Score: 1

    That's presumably why he explicitly stated free as in beer, to make it clear that the issue isn't with open source software.

    I mean, if someone is selling open source software, then why should they be treated differently to closed source commercial software? (Though as the letter suggests, there are worrying grey areas - it seems unfair if a hobby developer is liable because he runs an ad on the download website.)

  80. Attorneys Ruined the Medical Profession by CodeBuster · · Score: 1

    If the software development interests are wise then they will learn from the example of the medical profession and what excessive litigation has done to doctors attempting to practice medicine under the weight of crushing malpractice insurance premiums. The attorneys out there would argue that we must be able to sue in order to recover damages, but in reality most of us pay extra for our health care every day on the off chance that we might one day be in a position to win the legal lottery with a favorable malpractice judgment of which the attorney will take 40%+ while the government taxes away most of the rest. Meanwhile, the attorneys continue extracting uncompensated value from society while everyone, with the possible exception of the attorneys, is worse off; and this is better for society how? No, we do not need the attorneys and their associated baggage in the software industry, it just isn't remotely worthwhile.

  81. Re:I believe almost every free software I use has. by mdwh2 · · Score: 1

    "Delicious candy may contain succulent lead, eat at own risk, non-toxicity not warrantied" would not make selling tainted food any less problematic.

    Well it's all in the labelling isn't it - a court would argue that the wording still implies it's food ("candy"), it's meant to be eating ("delicious", "succulent") and that it's probably safe. Supposing instead you wrote:

    "Substance that may contain lead" - if someone came along and ate it, would you be liable? I don't think so.

    Products are sold for an intended purpose. If I drive a car on a road and it blows up, they're liable. If I drive it into the sea, they're not liable. If I buy a toy buggy and drive it on a road, they're not liable.

    You see, the idea that software companies are held to a different standard to car companies (as the article claims) is a myth. Both are free to describe what purpose their product may be used for - it's just that for various reasons, companies are willing to sell you products to drive on the road, but very few companies are willing to sell you software that is guaranteed to work (they do exist though - if you're prepared to pay ten times the price).

    Furthermore, I'm not sure your original example is correct - consider that putting "may contain nuts" is apparently enough to remove their liability should someone die from a nut allergy, whether or not the company has any clue that the product contains nuts.

    If the broad "there is no warranty" messages are not enough to avoid liability, then the answer is simple: we have software licences that say "this software should not be used in any situation where any injury or loss may occur" (or perhaps, at all), or "this software may contain bugs". The point is that they'll all end up doing that, and we'll be in exactly the same situation as we are now. Obviously despite the warning, you'll still use the software - you'd still rather do the equivalent of eating a substance that may contain lead, because you're too cheap to pay the money that's needed to fund extensively tested bug-free products.

    And if software companies were held to an higher standard than car companies, and not allowed to explain how their software may be used, then all that will happen is you can kiss goodbye to cheap software. Software prices will rocket, and it'll be fine for commercial software companies who can now charge loads of money. Well, assuming the industry doesn't collapse.

  82. Re:I believe almost every free software I use has. by turbidostato · · Score: 1

    "Pretty much every EULA I've read states that you not hold the vendor accountable for defects in their software or any data loss of yours that occurs while using their software."

    So what? It is not as if EULA writer was Yahveh and it was written on the Stones of Law. Since nobody gets to negotiate the terms of the EULA with the provider, the EULA itself is nothing more than a declaration of intentions on the provider's side. As such declaration of intentions it can obviously be overruled by laws and courts if/when "the other side" (the end user) finds it against his interests.

  83. Re:I believe almost every free software I use has. by mdwh2 · · Score: 1

    The problem is that for that warranty to be effective, the parties had to agree.

    Right - they don't agree, there's no warranty.

    Either this clause in unenforceable because their is no agreement

    Even the GPL itself points out that this does not trump what liabilities may be dictated by law. It's just making it clear that no warranty is being offered. It's not an agreement, it's for informative purposes. As you say yourself, an agreement is only needed if there is a warranty being given.

  84. Re:I believe almost every free software I use has. by turbidostato · · Score: 1

    "But if I just give away my leftovers from my restaurant to some soup kitchen free, would I still be liable?"

    For sure. Just take to the extreme and see:

    Your honour, I'm only a poor terrorist and all I did was provide anthrax *for free* via the water system to NY. It's not as if I made a profit out of it, is it?

    "What if I brown bag my lunch and in the work place they order pizza for some reason and I give my brown bag to the homeless guy on the way to the trolley stop without even opening to check if the sandwich has spoiled, would I still be liable?"

    So it was cocaine!? Your honor, I only took the brown bag from my godfather and passed it to the guy looking as a 50's gangster, but I didn't even opened it to see what was in the bag!

    All in all, if you break it, you pay for it.

  85. Re:I believe almost every free software I use has. by mdwh2 · · Score: 1

    For instance, in my State, contracts to purchase a car that are "AS-IS" are not legal. You can write those terms into the contract and the buyer can sign it, but if she turns around and sues you the Court won't give effect to that part of the contract.

    Of course you can - I can happily sell a device that looks just like a car, with wheels, can be driven, but make it clear that this is not intended to be driven on roads. If you do so, that's your problem.

    Another example, I cannot rent an apartment or house "AS-IS", I am required by law that my rentals conform to a general standard of habitability.

    Housing is a very special case (for good reasons - housing is limited, and it also makes good sense to give people rights for what is their home). On top of that, it's specifically renting that is an issue.

    However, if I sell a tatty old tent, or shed, or whatever else, you can't sue me because it doesn't live up to some expected measure of housing.

    You can't sell food without a warranty of non-contamination or edibility

    But I can damn well sell a substance that would be inedible, and it's your own fault if you eat it.

    The only issue here is to do with expectation of use - are the current disclaimers enough, or would they have to go further, and state that the software should not be used at all? Is there an issue with referring to it as "software"? (Perhaps calling something a "car" implies it can be driven on the road, OTOH, one can clearly use the term if it's otherwise clear it's not intended for that purpose, e.g., a toy car.)

    Yes, you can't sign or agree away rights allowed under law, but since these disclaimers aren't contracts or agreements, that's not an issue. They're disclaimers - no different to the disclaimer that says that the "car" you bought is not intended to be driven on roads. If that's allowed for physical products, why should software be held to a different standard?

  86. Re:I believe almost every free software I use has. by turbidostato · · Score: 1

    "Either this clause in unenforceable because their is no agreement (one party did not agree to it), or the GPL requires every user to accept the terms of it."

    You didn't do your homework, did you?

    Case 1) You don't want to accept the GPL: good to know, but then you have to abide by laws, IP laws. What can you do with a random piece of software you don't own an explicit rights grant from its IP holders? You certainly can't use it, copy it, modify it nor redistribute it. Since you can't use it, how do you expect to ask for proportional damages on its defects?
    Case 2) You do accept the GPL: OK, now you can use it, modify it, copy and redistribute it but by you accepting the GPL you resign at the same time to ask for damages if things wreak havoc.

    That's the way the things go. Of course, that doesn't preclude local laws from saying anything else. I.e.: I don't expect the GPL to be a safeguard if you on purpose write a piece of software that will make the user's home explode and transmit AIDS at the same time; local consumer laws may hold you responsible for unrelated unintentioned damages -my home is on fire because I used your GPL word processor, and even might hold you responsible for related unitentional damages -I lost one year of bussiness transactions I confied to this GPL RDBM), but that's local laws and local tribunals to say.

  87. Re:I believe almost every free software I use has. by mdwh2 · · Score: 1

    Doesn't compile. Prepare to be sued!

  88. Re:I believe almost every free software I use has. by turbidostato · · Score: 1

    "The question is what happens when an open source product is used in a sold product. Is the seller of the end-product solely liable, or is the producer of the open-source (and free) component also liable?"

    You sold it to me, you retaliate me. Full stop. (of course IANAL, so take my opinion at your own risk).

    "Can Sony recoup their fines from the battery manufacturer, if the battery was not delivered to spec?"

    Not. But Sony can certainly sue the battery manufacturer out of their own concerns by whatever it considers apropriate.

    "Can Sony sue to recoup their costs from the authors of that piece of software, which was provided free-of-charge under an OS license, and was probably not developed specifically for Sony's specifications?"

    Certainly yes. But that's not the question. The question is "can Sony win?" I don't think so. By not checking the software against their own internal specifications and not contacting the providers -which I'll suppouse acting on good faith, to see what can really be expected from the software, Sony is obviously failing on its due dilligence. It is not the same an end user agains a corp (which may have an extra protection through consumer laws) than a corp trying to go cheap and both laws and tribunals recognize the difference.

  89. first rule of lawsuits- follow the money by Maxo-Texas · · Score: 1

    open source projects which have no assets will be judgement proof.

    the code will morph to a different set of supporters.

    you do not want to be a wealthy person hacking on the software however.

    --
    She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
  90. What's a bug? by mdwh2 · · Score: 1

    Further to my earlier reply, I think another difference between software and physical products is that "bug" pretty gets used to describe anything that the software won't do, whether or not it's really a defect. This isn't the case with physical products - hell, we don't even have the word "bug" for physical products.

    Consider, if I drive a car along a road, and it stops, or blows up, it's a bug. What if I drive it over a hole, or in muddy conditions, and I get stuck? Most people would say tough luck, it's a limitation of the car's capabilities. Yet when it comes to software, any situation where it breaks down, even if it's one the company never considered or tested, is a "bug".

    In fact, even stupid or intentional malicious input is seen as a bug if it causes the software to misbehave. With physical products, if I take an axe to my car, they're not liable for it not working. If a thief breaks in, they're not liable (unless perhaps it's shown that it was a defect, e.g., the locks weren't working). But with software - if a hacker can exploit software with malicious input that it was never meant to handle, and where the software company never intended it to survive such an attack, it's seen as a "bug".

    I think much of this is due to the fact that people see software as something that should be easy - it's only lines of code, not something that's difficult to construct like a physical product, so they think surely it should be easy to make, and fix any problems? In fact, the reverse is true.

    Countless times I've seen physical products that flaws that allowed them to be easily broken, yet the assumption is always that you'd be stupid to do it. With software, the philosophy is that it should be so good that the user can't break it if they try.

    1. Re:What's a bug? by Wrath0fb0b · · Score: 1

      That's a fine policy argument about why the legislature. If I weren't already convinced that software liability is a terrible idea, I'd be convinced now. My point was that the legislature is not required to believe that the distinctions and arguments you've made if they aren't persuasive to them. They can (I hope not) reject your reasoning and decide that all software in $STATE must be sold with a warranty of suitability.

      The GGP (to which I was responding) basically said "there's a disclaimer, that's the end of the story". My point is that what warranties can and cannot be disclaimed is a matter of State law that can change as often as the whims of the legislature do.

  91. Re:I believe almost every free software I use has. by Schraegstrichpunkt · · Score: 1

    That's what Microsoft and the Linux Foundation are fighting against: a recommendation that there be an implied warranty that cannot be disclaimed.

  92. He had no reason, company was correct one. by jotaeleemeese · · Score: 1

    Just because your boss didn't know why it does not mean the company is not the adequate one.

    In most cases you use Oracle because its features and support, maybe your boss was checking how gullible you are.

    --
    IANAL but write like a drunk one.
  93. You may be great progrmmers and sys admins.... by jotaeleemeese · · Score: 1

    But are lousy readers:

    "seek to hold vendors liable for 'knowingly' shipping buggy software"

    Do I need to explain what knowingly means?

    How many /.ers complain bitterly about PHBs pushing software to users in full knowledge that it is not fit for purpose?

    Those are the people that should be worried.

    --
    IANAL but write like a drunk one.
  94. Re:I believe almost every free software I use has. by Anonymous Coward · · Score: 0

    Without knowing the language it's hard to say that it's bug free. If it was C you're missing an #include (if as I say later it is printf you meant to use), a definition of main, it's printf not print, and what about the \n at the end of the string?

    Besides it can't run on a toaster, toasters are mean to run AIs so they can determine the amount of toasty goodness you want to have every second of the day.

  95. Re:I believe almost every free software I use has. by Eskarel · · Score: 1

    A lot of contracts all over the world have clauses which are unenforceable.

    Employment contracts contain overly broad non compete agreements, stores claim they won't refund your money under any circumstances, companies deny liability for things they are liable for.

    Just because software developers claim they are not liable, doesn't in any way mean that they are actually not liable. They're claiming it and hoping that it either isn't challenged or it stands in court. It might, it might not. Even contracts both parties discuss and sign cannot enforce an illegal provision. If I sign a contract selling myself, or someone else into slavery in a country where slavery is illegal, that contract isn't binding or legal. There are limitations to everything.

  96. Re:I believe almost every free software I use has. by Eskarel · · Score: 1

    Well aside from the fact that the answer is probably "yes" anyway, TFA refers to software which is knowingly selling buggy software, which in your metaphor would be giving the homeless guy a sandwich you knew was tainted. If you knowingly gave the homeless guy a tainted sandwich and he died you'd not only be liable in a financial sense, you'd probably also be liable criminally.

  97. How is this a problem? by adamkennedy · · Score: 2, Interesting

    The article quotes the requirement as being "contains no material hidden defects".

    That idea would superficially (I am not a lawyer) appear to allow any open source off the hook as long as you have a public bug tracker.

    1. Re:How is this a problem? by AlgorithMan · · Score: 1

      wouldn't the open sourcecode already make the defects "not-hidden"?

      --
      The MAFIAA is a bunch of mindless jerks who will be the first up against the wall when the revolution comes
  98. Re:I believe almost every free software I use has. by Eskarel · · Score: 1

    There's always an agreement.

    It may not be financial, and it may not actually be with the developer of the software, but there's always an agreement even if the agreement is implicit. I ask for a piece of software(by clicking on a url or whatever) and the distributor agrees to give it to me. I can tell they agreed to give it to me because the file started downloading. Presuming I haven't circumvented any security to access this link, and the distributor knows that the link is there, there is an implicit distribution agreement between myself and the party providing the software. Where that agreement exists, there exists the potential for liability. There's a question of course as to that liability transfers to the developer, but just because you got it for free and didn't sign anything doesn't mean there wasn't an agreement, and it's got nothing at all to do with the GPL. You could definitely make it a provision of a new GPL version that in order to distribute the software, you take liability, and protect the original developer, but I don't think that would work very well.

    The reality of the situation is that people who provide software for a purpose are probably liable for ensuring that the software is fit for that purpose. There's almost certainly a lot of work that needs to be done to determine what level of bugs and what level of knowledge is required for liability and whether you can get explicit acceptance of known bugs as part of the distribution of a piece of software(in the case of bugs which are too expensive to fix) and to what degree. There may also need to be explicit protection for software provided gratis, but that would probably need to be an explicit exception to liability. Free as in speech makes no difference at all, only free as in beer.

  99. Re:I believe almost every free software I use has. by Wrath0fb0b · · Score: 2, Interesting

    Of course you can - I can happily sell a device that looks just like a car, with wheels, can be driven, but make it clear that this is not intended to be driven on roads. If you do so, that's your problem.

    If it's a model that was road-legal, no you cannot. That is you can't sell your old beater Honda Civic if the seatbelts are broken, even if I want to use it as a bird house.

    But I can damn well sell a substance that would be inedible, and it's your own fault if you eat it.

    You can't sell rotten apples as "non-food-substance" no matter how many disclaimers you put on it.

    Yes, you can't sign or agree away rights allowed under law, but since these disclaimers aren't contracts or agreements, that's not an issue. They're disclaimers - no different to the disclaimer that says that the "car" you bought is not intended to be driven on roads. If that's allowed for physical products, why should software be held to a different standard?

    I should have stated it this way: there are some warranties that the legislature will not let you disclaim. The legislature is not required to respect every possible form of disclaimer.

  100. Re:LOL by Anonymous Coward · · Score: 0

    thanks for the family reunion update, try not to knock up your sister again.

  101. Re:I believe almost every free software I use has. by CroDragn · · Score: 1

    I would suspect you could sell the formerly street-legal car as scrap metal to a wrecking company, or rotten apples as mulch to a farmer, simply because entire industries would shut down otherwise.

  102. Re:I believe almost every free software I use has. by truckwash · · Score: 1

    If it's a model that was road-legal, no you cannot. That is you can't sell your old beater Honda Civic if the seatbelts are broken, even if I want to use it as a bird house.

    You can sell a car without (or non-functioning) brakes as long as you disclose it.

  103. Re:I believe almost every free software I use has. by the_womble · · Score: 1

    It is not as if EULA writer was Yahveh

    Shh. He thinks he his.

  104. Re:I believe almost every free software I use has. by tapanitarvainen · · Score: 1

    "NO WARRANTY OR GUARANTEE IS IMPLIED. USE THIS SOFTWARE AT YOUR OWN RISK" or some combination of that. Even my home server says that every time I SSH into it.

    There is no reason that a legislature cannot pass a law saying that this disclaimer is contrary to public policy and won't be respected in the courts.

    Indeed. In Finland, just about all such disclaimers are totally worthless. In particular consumer rights are defined in law and can only be extended by warranties, never reduced by disclaimers. Some rights can't even be signed away.

  105. Re:August 6th, 1945 A Day That Will Live in Infamy by cmarkn · · Score: 1

    It's hi.rosh'ma. The 'i' is silent. And where's the infamy? They were warned and given a chance to prevent it.

    --
    People should not fear their government. Governments should fear their people.
  106. Mod parent up by Anonymous Coward · · Score: 0

    Please mod parent up, he is exactly right. The GP says:

    The problem is that for that warranty to be effective, the parties had to agree

    Even if that would be true for the GPL (or BSD/MIT licenses), the parties "agreeing" to anything are the distributor and his upstream. The end user does not enter into this agreement. Ever.

    Either this clause in unenforceable because their is no agreement (one party did not agree to it), or the GPL requires every user to accept the terms of it.

    It's not an either/or because:

    • the basic premise is false (user and "one party" are not the same entity)
    • "this clause" has no defined antecedent, so the statement is ambiguous at best
    • the second part is clearly wrong (see previous paragraph), but doesn't imply anything about the first part
    • an end user does not have to accept the terms of the GPL until he starts distributing his own modifications to the software. End users don't do that
  107. Software is not like normal engineering by jabjoe · · Score: 1

    I can see the logic, but it's flawed. It's thinking of software like any other engineering. It's not. It's right on the edge of what our little monkey brains can deal with. The people for this are probably for big design up front, thinking software engineers have ignored everything from normal engineering. But this is not the case, normal engineering development models were the first tried. No development model works perfectly in software, I'm sorry, but there is no magic bullet. Software is not bridges or cars. We are left doing the best we can, which is iteration and test,test and test again. I personally feel that working openly gives the best results, i.e "with enough eye balls, all bugs are shallow", but the project needs critical mass before that kicks in.

  108. Re:I believe almost every free software I use has. by Anonymous Coward · · Score: 0

    You certainly didn't do your homework.

    You certainly don't need an grant from the licensor to use a piece of software. And even if you don't (which you do), he gives you an impicit license by giving it to you.

    And your "local laws" are almost universal, even more outside of the USA.

  109. You just made this up. by z80kid · · Score: 1
    Modded interesting? Your examples have no basis in reality - you just popped them out of your ass.

    That is you can't sell your old beater Honda Civic if the seatbelts are broken,

    You most certainly can sell a non functioning car. It happens all the time. People sell cars in all sorts of conditions to hobbyists who restore them or scrap yards that sell parts off of them. In my state, buyers often insist on a mechanic inspecting a vehicle first, since it's perfectly legal to sell one that doesn't pass the state's annual safety inspection. It isn't necessary for a car to have a windshield or brakes - let alone seatbelts - in order to sell it.

    You can't sell rotten apples as "non-food-substance"

    Rotten apples certainly can be sold and actually are for hog feed or making cider vinegar.

    In most places, there is nothing wrong with selling something that doesn't work for it's primary purpose - as long as you don't mislead the buyer about the condition of the item. Yes, in most places there are warranties that you cannot disclaim. But if you warrant (claim) the apples to be rotten, you are certainly within the warranty.

  110. Re:I believe almost every free software I use has. by Ihmhi · · Score: 1

    Every time I hear the "Free as in beer" statement, I want to make a microbrew.

    "FOSSter's - it's open source, for beer!

  111. Re:I believe almost every free software I use has. by rtb61 · · Score: 1

    Differentiating it is the easiest thing in the world to do. So easy in fact, that and country and government can do it. Compare the advertising, to the warranty to the actual product. The lies will be pretty obvious and based upon the damage caused by the software, penalise them accordingly.

    Now giving something away does not compare to selling it and there is a distinct difference between one product where the faults are not only hidden from public view they are in fact denied, over and over again versus the other product which is available for for public review and auditing.

    In the case of open source the customer can review every line of code, nothing is hidden from them, they aren't even forced to do it on their own, in fact the whole greater community upon a global scale can review that code and anybody can access those reviews of that code as they are broadcast.

    So there is a huge difference between closed source proprietary code that is sold and open source code that is given away. Really in point of fact with FOSS you are not so much giving away the application you are giving away the code behind the application and have access to review all faults known and unknown to the distributor of that software, a substantive warranty difference when compared to closed source software where you are selling the application not the code behind the application which is kept secret from you along with all it's faults known and unknown.

    So in this case the FOSS people have made a major error in not differentiating between an application as the final product and the code for that application as the final product.Now add to that the all the commercial FOSS companies do not sell software they sell service and support, hence their underlying reasonable warranty requirements are bound to that only. Just to make it even trickier, I own a piece of every FOSS package out there even without writing one line of code, so do you and so does every one else, nobody at any time or in any way is excluded from accessing the product, the code, that they already technically own.

    --
    Chaos - everything, everywhere, everywhen
  112. Re:I believe almost every free software I use has. by deadkennedy · · Score: 1

    It comes down to irresponsible end users. If they are able to successfully sue an open source developer for a bug is besides the point. If the end user cannot comprehend use at your own risk, they are in much deeper trouble and the resulting lawsuit victory will not help them in the long run. Submit a bug report and be helpful about it. With bugs in open source software you can become the number one enemy of the developer(s) you sue, or you could potentially be credited in the subsequent release. Seems like a no-brainer to me...

  113. Re:I believe almost every free software I use has. by PitaBred · · Score: 1

    If it's a model that was road-legal, no you cannot. That is you can't sell your old beater Honda Civic if the seatbelts are broken, even if I want to use it as a bird house.

    Umm... no. You can't sell it without slightly more paperwork than a normal car sale, but you can sure as hell sell it with a junk/salvage title. And if the new owner makes it road legal again, they can get the vehicle re-titled.

    You can't sell rotten apples as "non-food-substance" no matter how many disclaimers you put on it.

    So what do you do with rotten apples? You mean you can't sell them to someone who wants to make compost with them? I'd love to see you call the police on that sale. It's perfectly legal to sell things like that as long as you don't represent them as a food item.

    Where do you get your information? And why were you modded up?

  114. Re:I believe almost every free software I use has. by turbidostato · · Score: 1

    "You certainly don't need an grant from the licensor to use a piece of software."

    Good to know I can use as much copies of Windows as I want without a license from Microsoft. It's a pity the BSA doesn't seem to think the same.

    "And even if you don't (which you do), he gives you an impicit license by giving it to you."

    If that's the case which is not in the vast majorities of cases with regards to open source: most of the times it is not the provider giving it to me but I taking it (i.e. downloading) from the provider. A subtle but important difference.

  115. Re:I believe almost every free software I use has. by Ironica · · Score: 1

    Some rights cannot be signed away. What these guidelines are suggesting is that the right to a warranty against material defects that the developer KNOWS are in the software when you buy it is one such right.

    I think that the general concept of these guidelines is sound, but that the folks who drafted them had an insufficient grasp of the issue. Hopefully they will refine them and we'll get something workable.

    --
    Don't you wish your girlfriend was a geek like me?
  116. Customer signs waiver acknowledging complexity by presidenteloco · · Score: 1

    What about the idea of having the sale/download/use of the software conditional on agreeing
    with a waiver of liability whose wording states that the user/purchaser recognizes that
    software systems in general, and the software/system being downloaded/used in particular,
    are inherently too complex to be able to provide any warrantee of correct operation or fitness for use.

    The general truth of this claim can be inferred by taking a survey of any 100 real software products or
    services which have been at version 1.0 or greater for more than a year,
    and asking which of them have not had, since version 1.0 delivery, at least one newly discovered
    bug.

    For any given bug, it is only a matter of opinion whether it constitutes an unfitness for use or
    a significant hidden defect.

    --

    Where are we going and why are we in a handbasket?
  117. Re:I believe almost every free software I use has. by sumnerp · · Score: 1

    "NO WARRANTY OR GUARANTEE IS IMPLIED. USE THIS SOFTWARE AT YOUR OWN RISK" or some combination of that. Even my home server says that every time I SSH into it.

    There is no reason that a legislature cannot pass a law saying that this disclaimer is contrary to public policy and won't be respected in the courts.

    Indeed. In Finland, just about all such disclaimers are totally worthless. In particular consumer rights are defined in law and can only be extended by warranties, never reduced by disclaimers. Some rights can't even be signed away.

    and of course because of this all software sold in Finland is free of bugs.

  118. Re:I believe almost every free software I use has. by tapanitarvainen · · Score: 1

    In Finland, just about all such disclaimers are totally worthless. In particular consumer rights are defined in law and can only be extended by warranties, never reduced by disclaimers. Some rights can't even be signed away.

    and of course because of this all software sold in Finland is free of bugs.

    If only. :-)

    Actually, in particular regarding software the "implied warranties" are not much stronger than what you'd get in most US states by disclaiming everything you can. So the end result is just that there's no need to add lots of complex legalese in EULAs: just don't promise anything you can't keep and you're fine. (On the other hand, you can't arbitrarily restrict software buyers' or users' rights with EULAs either, sometimes not even with signed contracts: e.g., law explicitly states that a contract that forbids backups is void.)

  119. Re:I believe almost every free software I use has. by Anonymous Coward · · Score: 0

    "You certainly don't need an grant from the licensor to use a piece of software."

    Good to know I can use as much copies of Windows as I want without a license from Microsoft. It's a pity the BSA doesn't seem to think the same.

    Yes you can. You can't make new ones, except the ones needed to operate that one copy. That's the whole point of copyright. And that's an explicitly granted fair use exception.

    "And even if you don't (which you do), he gives you an impicit license by giving it to you."

    If that's the case which is not in the vast majorities of cases with regards to open source: most of the times it is not the provider giving it to me but I taking it (i.e. downloading) from the provider. A subtle but important difference.

    A subtle, but unimportant difference. The copyright holder gave the licensee the *explicit* grant (and in case of the GPL, demand) to give all subsequent licensee the same rights as he has.