That is doubly true for actual persons, locations and events that are not from the US.
I always found it amazingly stupid and saddly funny how a dozen jerks from the US have a heated debate about whether or not some place in Europe is "notable". Chances are, none of them has ever been within a thousand miles of it. All they know about it they must have from - gasp - third party sources. So there is enough info out there to build an intense discussion around, but it's not "notable"? Yeah, right.
Your understanding is much better than most here on/.
German law uses responsibility and concepts such as "reasonable" a lot, instead of micro-managing things. Its basic assumption is that the body of laws is there to regulate a society of reasonable, adult people who are not entirely self-obsessed, and that you can expect a certain amount of regard from everyone else, but in turn are required to offer your fellow citizen the same in return.
For example, this is the entire first paragraph of the Straßenverkehrsordnung, the law governing road traffic:
"1 Grundregeln
(1) Die Teilnahme am Straßenverkehr erfordert ständige Vorsicht und gegenseitige Rücksicht.
(2) Jeder Verkehrsteilnehmer hat sich so zu verhalten, daß kein Anderer geschädigt, gefährdet oder mehr, als nach den Umständen unvermeidbar, behindert oder belästigt wird."
Rough translation:
(1) Participation in road traffic requires constant care and regard for each other. (2) Every participant in traffic has to act in such a way that nobody else will be damaged, endangered or, more than the conditions make unavoidable, inconvenienced.
I have no idea about German law, other than that, to the extent that it forbids running an open WiFi network, German law needs to be changed.
You have no idea about german courts, either.
Germany is a civil law country, which means that our laws are written by the legislative body, not by caselaw. The courts only interpret the law, they don't make it.
What the court did was take existing laws about negligence and apply them to an open Wifi network. And it found out that you may be responsible for damages. It explicitly does NOT FORBID running an open Wifi network, it only says that if you do, you have to apply reasonable precautions against abuse.
And what if my computer has issues connecting to a router that has encryption, or the router has a bug where it can't maintain a connection when encryption is enabled? Or I have a very high-speed link & I don't want the overhead of encryption throttling my bandwidth?
Then you should dump your early 80s equipment and go buy something new.
Seriously, "what if the brake pedal is always in the way of my foot?" is not a proper defense for having removed it when you run someone over. Your car has to have a brake, and how is usually your problem. All Wifi routers sold in the past 10 years or so come with some form of encryption. All computers sold in the past 10 years or so have more than enough power to run it. If your equipment is fast enough that it can saturate the connection, then it is fast enough that it can do encryption without noticeable overhead.
Or as others pointed out, I use WEP instead of WPA2?
No specific level of encryption was required, only "reasonable security". Commentators are discussing whether or not WEP would count or not.
The government should not be in the business of trying to legislate the configuration of any network
It doesn't.
One, this isn't the government, this is the courts. You have heard of this concept of "seperation of powers", have you? Two, this isn't the legislative, this is... see above. Three, nobody is trying to enforce any specific "configuration of any network". The court says that if your house is open for everyone, then you could be responsible for what happens in it and can't simply say "some stranger I don't know did it".
Claimant should (and generally is in the US) be forced to prove the infringing action to a specific person.
But there are many other cases in the law where that is not true. Driving offenses, for example, only require the identification of a specific person in some countries. In most countries, the owner is held responsible if the driver can not be identified (and the car hasn't been reported as stolen).
Which is why some commentators already believe that one solution for hotels, etc. will be to identify their hotspot users, so if the police comes in about something, they can do what you ask for.
Wrong analogy. Unlike the car, the router by itself wouldn't cause any damage. *Someone* committed a crime, they should prosecute that guy.
They will.
This was not a case about criminal prosecution. It was about civil damages. You can be held responsible to pay damages in a civil case, even if someone else was the criminal. That's actually pretty commonplace.
Then I guess I'm an idiot for being a nice guy and providing free access for people passing by. Why am I an idiot? My traffic is secure (I have two networks, one encrypted with WPA2-Enterprise with a RADIUS server, another open) and I have no traffic limits. Why shouldn't I share?
According to the court (note: I don't necessarily share that opinion, just trying to point out that as courts go, this is a pretty good judgement and many of us here in Germany expected far worse):
You shouldn't share because you know that it is not only easy, but common for people to break the law using unsecured Wifi. By providing them with the means to do so, you could be held liable for damages (civil), but the court recognizes that you providing access is not an intentional aiding of a crime, so you're off the hook regarding criminal prosecution.
the judgment here clearly means to say that an internet connections main purpose is to help you infringe on copyright.
If it would mean that, then you would be in trouble just for having that open Wifi. That is not what the court said. It said that if you have an open Wifi and someone uses it to do something bad, then you may be liable for a share of the damage, because you didn't put in reasonable precautions that would have prevented it.
As I read court papers (and IANAL, but my last job gave me more contact with lawyers and courts than is really good), that means the court recognizes that these infringements are not the main purpose, but are at least common enough that a reasonable person can know that they can happen, and therefore that he should take reasonable precautions to prevent them.
That's a pretty normal POV to take in the real world. Your insurance will take the same view if your house gets broken into and it turns out you not only had all doors unlocked, but you didn't even have locks on them. Sure, you didn't do the robbing, but your insurance will gladly hold you responsible for at least some of the damage and refuse to pay it. And a court would probably agree with them.
How can you hold someone criminally and financially responsible when they couldn't have known?
Please read the judgement or at least the clued-in comments about it before passing judgement.
Criminal liability was explicitly declined. The court ruled, however, that it is a case of negligence, and thus you could be liable (in part) for damages that are caused through your open Wifi.
In this case, to continue with the car analogy... when the dealership sold you the car, it had no brakes on it.
Analogy bad.
The car had brakes. But you had to actually engage them, they don't magically do that all by themselves.
Here's a better car analogy: In Germany, it is illegal for you to go out of gas while driving on the Autobahn. I'm not kidding. The reason is that it's fucking dangerous - when a modern cars engine dies, so do most of the driving support systems, including steering - when's the last time you actually steered the car by muscle power? - you don't want that going 200 kph with someone else coming up at 240 kph behind you. And that's pretty typical speeds on the parts where there are no speed limits. The reasoning is that by making it a law and putting a serious fine on it, even if nothing happens, people will bother to check the gas level before driving unto the Autobahn. And it works.
So the court now asks all Wifi drivers to check that they have encryption enabled before they start broadcasting. Contrary to what some posters here try to feed, that is not a major technical feat. You don't have to write the crypto algorithm and upload it in binary to the firmware, you know? Usually, there's a setup screen that you visit anyways because you have to put your DSL data and your network name in, and there's a checkbox, dropbox or whatever there asking if you want WEP, WPA, WPA2 or no encryption.
So call me an idiot, but why are we actually securing our wireless, again?
I, personally, secure my Wifi (WPA + Mac filtering) because I don't want any jerk down the street on my internal network. It means I don't have to bring every device in the network up to the security standard of being in an open, potentially hostile, network. Remember that there aren't just computers in most home networks. There's a network-enabled printer and some remote speakers in mine, for example.
But this is flawed logic. YOU didn't put the brakes on the car so you're responsible for the damage that was directly caused by this action, yes.
But this is a case of you not doing something,
Like not putting on the brakes?;)
and then someone came along and intentionally did something that was wrong with the opportunity given.
So amend my example saying that someone shoved your car. Would you be held liable? I claim a court would at least entertain the thought, yes. Sure, the actual culprit would bear the main responsibility, but courts do know such measured judgements as holding multiple persons responsible to varying degrees. You would certainly not be sued criminally, but a civil case asking for damages may well succeed. And look! That's exactly the judgement that was passed in this case.
But in all too many cases, the object was not designed to do such and should not be counted as an immediate danger, and thus negligence laws should not apply.
Except that a Wifi router was designed to give network access to everyone in range.
A value of like 90 cents was lost, and that only if you're generous and actually count it as lost sale, which I'm not sure should be easy to prove.
The point of judgements like these isn't in the value, but in the guidelines they provide. We now have a guideline for the case where something of actual value/damage might happen. There are tons of court cases about stuff like your example, they just never make the news.
Please visit Comprehension Basics 101, down the floor, last door on the right, the one with the big "idiots here" sign next to it.
The judgement asks for "some minimal security", not "unbreakable security" and it specifically says that if you have some security, then you are not liable.
If you can't get input validation right, then it is better you quit programming. Seriously. Even if your programming language is more forgiving and I can hand it 1000 null characters when it asks for an integer, you still want to do input validation, or something else may break further down the chain (database, other connected systems, transfer stacks, etc.)
Agreed, it should be way more clear what exactly this deal is.
Personally, I don't mind Steam. The renting model does have its advantages, too. For example, I can download the stuff again, so I don't have to keep a local backup copy. I can reinstall it on my next machine with no hassle. About the only thing I'd like to see is the ability to transfer the license, i.e. give it to someone else after I'm done playing.
But yes, we need a new word and mental model for what exactly software is. Owned? Rented? Neither, really.
Wikipedia (or rather, the people running it) is taking itself way too serious, and has for a long time now. Just read the comments of any edit war, or most of the delete request discussions.
Some seriousness is good and necessary, but when you're running a community project, you should never forget that there are only three base motivators for people to contribute stuff: Money, Fun and Fame. Since money is out, that leaves the other two. If you remove the fun by becoming too serious, you're left with a bunch of low-lifes who are trying to get the fame real life denies them in your community, usually through extended power trips. Ooops, did I just describe the average Wikipedia admin?
As a matter of fact, in most countries (and US states, I believe) you are required to adequately secure your guns. So if it's just lying around on the table in your unlocked home, you may well be liable. If the thieves have to break open your gun locker, you're not.
And that's pretty much what the court said. Turn on encryption and change the default password and you're fine.
The actual judgement is a bit more level-headed than the/. summary makes it to be.
The judge essentially said you ought to have some minimum level of security, elst you're liable for damages, much like everything else (e.g. if you don't put the brakes on in your car and it starts to roll and crashes into something).
The standard requested is pretty much "turn on encryption and change the default password".
Most commentators agree that for home users, not much will change. Unless you're an idiot, you already have these things for your home network. The challenge will mostly be to hotels, Starbucks, etc. with their open hotspots.
All the stuff you mention is why I think C is excellent to learn programming in. Not on its own, but if anything teaches you about mistakes and their consequences, it is the unforgiving C.
When I was assistent back in university, I crashed pretty much every C program the students brought in with input errors. Yes, they hated me. Then they learnt about input validation. I'm pretty sure none of those students are responsible for the horrible input validation exploits we find around to this day.
Square is a nice tool, and a great demonstration that automatically crawling data doesn't give you facts, only a popularity index.
Example, one of their examples is "biggest companies", which gives you the likes of Microsoft at the top. Sorry, but MS may be a big name in the tech industry, but it is dwarves by companies such as Nestle (food industry, twice the revenue of MS) or BP (oil industry, over 4 times the revenue of MS) and many others.
You just don't read much about Nestle on the Internet, and BP only when they blow up an oil rig.
If you get less for your money, you expect to pay less. If I can buy a CD for 40, or rent it on Steam for 30, then I can decide whether the limitations on Steam are worth 10 to me or not.
Slashdot Mirror
That is doubly true for actual persons, locations and events that are not from the US.
I always found it amazingly stupid and saddly funny how a dozen jerks from the US have a heated debate about whether or not some place in Europe is "notable". Chances are, none of them has ever been within a thousand miles of it. All they know about it they must have from - gasp - third party sources. So there is enough info out there to build an intense discussion around, but it's not "notable"? Yeah, right.
Your understanding is much better than most here on /.
German law uses responsibility and concepts such as "reasonable" a lot, instead of micro-managing things. Its basic assumption is that the body of laws is there to regulate a society of reasonable, adult people who are not entirely self-obsessed, and that you can expect a certain amount of regard from everyone else, but in turn are required to offer your fellow citizen the same in return.
For example, this is the entire first paragraph of the Straßenverkehrsordnung, the law governing road traffic:
"1 Grundregeln
(1) Die Teilnahme am Straßenverkehr erfordert ständige Vorsicht und gegenseitige Rücksicht.
(2) Jeder Verkehrsteilnehmer hat sich so zu verhalten, daß kein Anderer geschädigt, gefährdet oder mehr, als nach den Umständen unvermeidbar, behindert oder belästigt wird."
Rough translation:
(1) Participation in road traffic requires constant care and regard for each other.
(2) Every participant in traffic has to act in such a way that nobody else will be damaged, endangered or, more than the conditions make unavoidable, inconvenienced.
I have no idea about German law, other than that, to the extent that it forbids running an open WiFi network, German law needs to be changed.
You have no idea about german courts, either.
Germany is a civil law country, which means that our laws are written by the legislative body, not by caselaw. The courts only interpret the law, they don't make it.
What the court did was take existing laws about negligence and apply them to an open Wifi network. And it found out that you may be responsible for damages. It explicitly does NOT FORBID running an open Wifi network, it only says that if you do, you have to apply reasonable precautions against abuse.
If you are running an open wifi spot how does "common carrier" status play into this, because this all sounds ABSURD...
"common carrier" is a concept from the common-law system, e.g. a US/UK concept. Germany is a civil law country.
And what if my computer has issues connecting to a router that has encryption, or the router has a bug where it can't maintain a connection when encryption is enabled? Or I have a very high-speed link & I don't want the overhead of encryption throttling my bandwidth?
Then you should dump your early 80s equipment and go buy something new.
Seriously, "what if the brake pedal is always in the way of my foot?" is not a proper defense for having removed it when you run someone over. Your car has to have a brake, and how is usually your problem. All Wifi routers sold in the past 10 years or so come with some form of encryption. All computers sold in the past 10 years or so have more than enough power to run it. If your equipment is fast enough that it can saturate the connection, then it is fast enough that it can do encryption without noticeable overhead.
Or as others pointed out, I use WEP instead of WPA2?
No specific level of encryption was required, only "reasonable security". Commentators are discussing whether or not WEP would count or not.
The government should not be in the business of trying to legislate the configuration of any network
It doesn't.
One, this isn't the government, this is the courts. You have heard of this concept of "seperation of powers", have you?
Two, this isn't the legislative, this is... see above.
Three, nobody is trying to enforce any specific "configuration of any network". The court says that if your house is open for everyone, then you could be responsible for what happens in it and can't simply say "some stranger I don't know did it".
Claimant should (and generally is in the US) be forced to prove the infringing action to a specific person.
But there are many other cases in the law where that is not true. Driving offenses, for example, only require the identification of a specific person in some countries. In most countries, the owner is held responsible if the driver can not be identified (and the car hasn't been reported as stolen).
Which is why some commentators already believe that one solution for hotels, etc. will be to identify their hotspot users, so if the police comes in about something, they can do what you ask for.
You can. Nothing in the judgement says you can't.
What it does say that if you do, you could be held responsible for what it is being used for.
Wrong analogy. Unlike the car, the router by itself wouldn't cause any damage. *Someone* committed a crime, they should prosecute that guy.
They will.
This was not a case about criminal prosecution. It was about civil damages. You can be held responsible to pay damages in a civil case, even if someone else was the criminal. That's actually pretty commonplace.
Then I guess I'm an idiot for being a nice guy and providing free access for people passing by. Why am I an idiot? My traffic is secure (I have two networks, one encrypted with WPA2-Enterprise with a RADIUS server, another open) and I have no traffic limits. Why shouldn't I share?
According to the court (note: I don't necessarily share that opinion, just trying to point out that as courts go, this is a pretty good judgement and many of us here in Germany expected far worse):
You shouldn't share because you know that it is not only easy, but common for people to break the law using unsecured Wifi. By providing them with the means to do so, you could be held liable for damages (civil), but the court recognizes that you providing access is not an intentional aiding of a crime, so you're off the hook regarding criminal prosecution.
the judgment here clearly means to say that an internet connections main purpose is to help you infringe on copyright.
If it would mean that, then you would be in trouble just for having that open Wifi. That is not what the court said. It said that if you have an open Wifi and someone uses it to do something bad, then you may be liable for a share of the damage, because you didn't put in reasonable precautions that would have prevented it.
As I read court papers (and IANAL, but my last job gave me more contact with lawyers and courts than is really good), that means the court recognizes that these infringements are not the main purpose, but are at least common enough that a reasonable person can know that they can happen, and therefore that he should take reasonable precautions to prevent them.
That's a pretty normal POV to take in the real world. Your insurance will take the same view if your house gets broken into and it turns out you not only had all doors unlocked, but you didn't even have locks on them. Sure, you didn't do the robbing, but your insurance will gladly hold you responsible for at least some of the damage and refuse to pay it. And a court would probably agree with them.
How can you hold someone criminally and financially responsible when they couldn't have known?
Please read the judgement or at least the clued-in comments about it before passing judgement.
Criminal liability was explicitly declined. The court ruled, however, that it is a case of negligence, and thus you could be liable (in part) for damages that are caused through your open Wifi.
In this case, to continue with the car analogy ... when the dealership sold you the car, it had no brakes on it.
Analogy bad.
The car had brakes. But you had to actually engage them, they don't magically do that all by themselves.
Here's a better car analogy: In Germany, it is illegal for you to go out of gas while driving on the Autobahn. I'm not kidding.
The reason is that it's fucking dangerous - when a modern cars engine dies, so do most of the driving support systems, including steering - when's the last time you actually steered the car by muscle power? - you don't want that going 200 kph with someone else coming up at 240 kph behind you. And that's pretty typical speeds on the parts where there are no speed limits.
The reasoning is that by making it a law and putting a serious fine on it, even if nothing happens, people will bother to check the gas level before driving unto the Autobahn. And it works.
So the court now asks all Wifi drivers to check that they have encryption enabled before they start broadcasting. Contrary to what some posters here try to feed, that is not a major technical feat. You don't have to write the crypto algorithm and upload it in binary to the firmware, you know? Usually, there's a setup screen that you visit anyways because you have to put your DSL data and your network name in, and there's a checkbox, dropbox or whatever there asking if you want WEP, WPA, WPA2 or no encryption.
So call me an idiot, but why are we actually securing our wireless, again?
I, personally, secure my Wifi (WPA + Mac filtering) because I don't want any jerk down the street on my internal network. It means I don't have to bring every device in the network up to the security standard of being in an open, potentially hostile, network. Remember that there aren't just computers in most home networks. There's a network-enabled printer and some remote speakers in mine, for example.
In other words: It's less effort for me.
But this is flawed logic. YOU didn't put the brakes on the car so you're responsible for the damage that was directly caused by this action, yes.
But this is a case of you not doing something,
Like not putting on the brakes? ;)
and then someone came along and intentionally did something that was wrong with the opportunity given.
So amend my example saying that someone shoved your car. Would you be held liable? I claim a court would at least entertain the thought, yes. Sure, the actual culprit would bear the main responsibility, but courts do know such measured judgements as holding multiple persons responsible to varying degrees. You would certainly not be sued criminally, but a civil case asking for damages may well succeed. And look! That's exactly the judgement that was passed in this case.
But in all too many cases, the object was not designed to do such and should not be counted as an immediate danger, and thus negligence laws should not apply.
Except that a Wifi router was designed to give network access to everyone in range.
A value of like 90 cents was lost, and that only if you're generous and actually count it as lost sale, which I'm not sure should be easy to prove.
The point of judgements like these isn't in the value, but in the guidelines they provide. We now have a guideline for the case where something of actual value/damage might happen. There are tons of court cases about stuff like your example, they just never make the news.
Please visit Comprehension Basics 101, down the floor, last door on the right, the one with the big "idiots here" sign next to it.
The judgement asks for "some minimal security", not "unbreakable security" and it specifically says that if you have some security, then you are not liable.
Yes, I didn't mean there are specific laws about this. You don't need specific laws if there are general laws about things like endangerment.
If you can't get input validation right, then it is better you quit programming. Seriously. Even if your programming language is more forgiving and I can hand it 1000 null characters when it asks for an integer, you still want to do input validation, or something else may break further down the chain (database, other connected systems, transfer stacks, etc.)
Agreed, it should be way more clear what exactly this deal is.
Personally, I don't mind Steam. The renting model does have its advantages, too. For example, I can download the stuff again, so I don't have to keep a local backup copy. I can reinstall it on my next machine with no hassle. About the only thing I'd like to see is the ability to transfer the license, i.e. give it to someone else after I'm done playing.
But yes, we need a new word and mental model for what exactly software is. Owned? Rented? Neither, really.
Dual-booting isn't security, either. There are windos drivers for HFS+ and most Linux filesystems, you know?
Wikipedia (or rather, the people running it) is taking itself way too serious, and has for a long time now. Just read the comments of any edit war, or most of the delete request discussions.
Some seriousness is good and necessary, but when you're running a community project, you should never forget that there are only three base motivators for people to contribute stuff: Money, Fun and Fame. Since money is out, that leaves the other two. If you remove the fun by becoming too serious, you're left with a bunch of low-lifes who are trying to get the fame real life denies them in your community, usually through extended power trips. Ooops, did I just describe the average Wikipedia admin?
As a matter of fact, in most countries (and US states, I believe) you are required to adequately secure your guns. So if it's just lying around on the table in your unlocked home, you may well be liable. If the thieves have to break open your gun locker, you're not.
And that's pretty much what the court said. Turn on encryption and change the default password and you're fine.
The actual judgement is a bit more level-headed than the /. summary makes it to be.
The judge essentially said you ought to have some minimum level of security, elst you're liable for damages, much like everything else (e.g. if you don't put the brakes on in your car and it starts to roll and crashes into something).
The standard requested is pretty much "turn on encryption and change the default password".
Most commentators agree that for home users, not much will change. Unless you're an idiot, you already have these things for your home network. The challenge will mostly be to hotels, Starbucks, etc. with their open hotspots.
All the stuff you mention is why I think C is excellent to learn programming in. Not on its own, but if anything teaches you about mistakes and their consequences, it is the unforgiving C.
When I was assistent back in university, I crashed pretty much every C program the students brought in with input errors. Yes, they hated me. Then they learnt about input validation. I'm pretty sure none of those students are responsible for the horrible input validation exploits we find around to this day.
Square is a nice tool, and a great demonstration that automatically crawling data doesn't give you facts, only a popularity index.
Example, one of their examples is "biggest companies", which gives you the likes of Microsoft at the top. Sorry, but MS may be a big name in the tech industry, but it is dwarves by companies such as Nestle (food industry, twice the revenue of MS) or BP (oil industry, over 4 times the revenue of MS) and many others.
You just don't read much about Nestle on the Internet, and BP only when they blow up an oil rig.
It depends on the price, doesn't it?
If you get less for your money, you expect to pay less. If I can buy a CD for 40, or rent it on Steam for 30, then I can decide whether the limitations on Steam are worth 10 to me or not.
It's only a problem when you don't have a choice.
Or, you could just make a user account for gaming, you know?
Could do that on OS X and windos, too. With fast user switching, it wouldn't even be any trouble.