Examining Software Liability In the Open Source Community 241
snydeq writes "Guidelines from the American Law Institute that seek to hold vendors liable for 'knowingly' shipping buggy software could have dramatic impact on the open source community, as vague language around a 'free software' exemption could put open source developers at litigation risk. Meant to protect open source developers, the 'free software' exemption does not take into account the myriad ways in which vendors receive revenue from software products, according to a joint letter drafted by Microsoft and the Linux Foundation. As such, the guidelines — which, although not binding, are likely to prove influential on future lawsuits, according to attorneys on both sides of the issue — call into question the notion of liability in the open source community, where any number of coders may be responsible for any given defect."
Bug free software would be insanely expensive! (Score:5, Insightful)
Bug free software is possible, it's just very very expensive to produce!
I've worked on DoD projects that required bug free software. It is possible, it just requires $150 Million to produce 100,000 lines of code.
Do you really want to force Microsoft or Apple to produce bug free operating systems? Who could afford them?
Re:I believe almost every free software I use has. (Score:3, Insightful)
And so does every bit of commercial software. How do you differentiate?
God damn you, lawyers. (Score:5, Insightful)
Another stupid babysitter law to protect idiots.
At a previous job I asked my boss why we used Oracle and he said that if anything ever went terribly wrong, the company would have someone to sue. Of course, suing someone doesn't restore customer confidence, data, or revenue. No verifiable technical reason, just that OUR lawyers got warm and fuzzy with contractual language that would never, ever get exercised and if it ever did try to sue anyone we'd have run out of money before they dipped into their free soda fund.
Anything that executes code is buggy. Applications, frameworks, libraries, protocol stacks, drivers, bios', FPGAs and microchips. Grow up and deal with it.
Bad idea (Score:4, Insightful)
Vendor liability for software is a good idea only in *very* limited fields, with *very* strict parameters. If the problem domain allows for exhaustive testing (every possible input, every possible code path), then this sort of liability is reasonable. Embedded control software for vehicles is a good candidate. But to apply the law to general purpose computers like we would for mechanical devices is absurd. They aren't a monoculture; they can run anything, which means anything can break them. Every general purpose OS out there suffers from the occasional crash (Windows, OSX and *NIX included), and the very nature of the machine means that you can't always determine the cause. If one kernel level process writes into the memory space of another, overwriting pointers and code, the eventual crash will appear to be the fault of the innocent process (after all, it tried to dereference null). The forensics required to assign blame unquestionably would cost more than the lawyers would.
Much like patent law, this is one field where hardware can go that software should not.
Why should general liability even exist? (Score:5, Insightful)
For software purchased as a custom/customized enterprise type setup, with guys in suits, and contract negotiations, and spec documents and whatnot, surely the parties involved can settle any questions of bugs, liability for bugs, responsibility for timely fixes, etc. as a matter of contract between themselves. Perhaps it would be convenient for a de-facto standard set of terms to exist; but I don't see why any legally binding assumption needs to be made, beyond what was specified in the contract.
For the consumer/shrinkwrap/non-custom stuff, I'd be strongly in favor of a right to return for refund if defective(though deciding exactly what level of buginnes qualifies as "defective" could well be tricky, and settling the issue of whether or not "being able to run on joe sixpack's box-o'-spyware-and-rootkits or timmy the tweaker's bleeding-edge-super-nlite-professional-l33t-3dition-h4x0red-windows-box" is actually a reasonable expectation could be a nuisance); but liability beyond that, unless actual damages can be demonstrated, seems unreasonable.
Already, if software is being used as a component of a system(medical, aviation, whatever) where bugs matter, it is subject to those standards, establishing a set of liabilities for software generally just seems like a good way to encourage ever more onorous disclaimer contracts and quash free/OSS/cheap software.
'knowingly' (Score:3, Insightful)
New guidelines (Score:3, Insightful)
Re:God damn you, lawyers. (Score:5, Insightful)
At a previous job I asked my boss why we used Oracle and he said that if anything ever went terribly wrong, the company would have someone to sue
Next time you encounter this attitude, you should find the relevant clause in the EULA, which disclaims all responsibility for the software containing bugs. If a company like Oracle provides your software then, generally, the only response you have to bugs losing your data is to not buy from them in future (unless, of course, you've just built a large in-house application that depends on Oracle...)
Re:I believe almost every free software I use has. (Score:3, Insightful)
But if I just give away my leftovers from my restaurant to some soup kitchen free, would I still be liable? May be. If I give away left overs from my home to a passing vagrant would I be held liable? What if I brown bag my lunch and in the work place they order pizza for some reason and I give my brown bag to the homeless guy on the way to the trolley stop without even opening to check if the sandwich has spoiled, would I still be liable?
Re:I believe almost every free software I use has. (Score:5, Insightful)
So.....you're going to sue a developer for a defect, intentional or not, even though they said it was not warrantied and use at your own risk?
No lawyer will sue individuals developers . . . they have no money. They will try to sue a big company, um, like what SCO tried with IBM. Lawyers go after the money.
Some big companies even forbid their programmers from working on Open Source projects on their own time . . . unless they are approved by their employer, of course. Because the lawyer suing will try to twist it so that the employer is responsible . . . because only a big company has enough cash to make it worth their effort.
Re:I believe almost every free software I use has. (Score:4, Insightful)
I can see it now....rogue programmers, up late at night working in secret groups on some highly illegal, highly explosive software. Their code may not be perfect but it's the illegal cool factor that makes it worthwhile.
Re:Bug free software would be insanely expensive! (Score:3, Insightful)
Frankly, forcing Microsoft to produce a bug-free OS sounds a great idea. (They'd go bankrupt trying. How much better do you want??)
As for the fraudulent concealment of bugs, I don't think it should matter who produced the software, how, or why. If the bug was fraudulently concealed, that should be what matters. This would likely impact security notices (ie: we'd get them sooner, rather than later) and that sounds a great idea to me too.
I'd consider ANY fraudulent concealment to be a problem, though, not just by developers. Thus, a bank or online store that fraudulently concealed the fact that it had a bug which exposed credit card information should likewise be a crime.
(This might result in better upgrade policies, but it would certainly result in a better-informed public. And since panicked buyers don't buy, it might also result in a better-educated public on how to understand risk. Again, something that is long-overdue and filled with potential benefit.)
Re:I believe almost every free software I use has. (Score:4, Insightful)
As the American Law Institute appears to not hold with that belief, lets see how far they get in their goals WITHOUT ANY SOFTWARE! Ha ha ha ha ha ha ha ha ha!
Re:OSS authors just as liable as commercial ... (Score:3, Insightful)
A business relationship does not require money to change hands. I suspect that like contracts all that is required is that both parties receive some sort of "consideration", http://en.wikipedia.org/wiki/Consideration [wikipedia.org] [wikipedia.org]. Consideration is obvious for the user(s), they get the software, but consideration for the author(s) could be quite varied. Passing along the author's work (as the GPL requires), reporting bugs back to the author, mere use of the software enhancing the author's standing in a community (or maybe just stroking the ego), ... I'm sure a real lawyer could get quite creative, as they have successfully done with consideration under contract law. Unless of course the legislation gives OSS authors a special status which they currently do not have.
These is no contract involved in using software provided under the GPL. The GPL only covers distribution, not use. If no consideration was provided to the author from the end user, no business relationship exists. A distributor of GPL based software has a contract with the author, but that contract only involves distribution, not use of the software. Since that contract states pretty clearly that the software is provided for distribution only if the distributor disclaims that it is fit for any specific purpose the author is pretty much covered against legal action. The distributor, on the other hand, if they don't disclaim warranty they can be held accountable by both the user of the software, and by the author for failure to follow the licensing terms. IANAL, so this ain't legal advice.