[HN Gopher] No good deed goes unpunished: can we now be sued ove...
___________________________________________________________________
No good deed goes unpunished: can we now be sued over software we
give away?
Author : ingve
Score : 49 points
Date : 2025-02-15 12:41 UTC (10 hours ago)
(HTM) web link (kevinboone.me)
(TXT) w3m dump (kevinboone.me)
| Terr_ wrote:
| > It's notable, I think, that you're not absolved from operating
| "in the course of a commercial activity" just because you're
| supplying software free-of-charge.
|
| I can see why someone would have added this provision, if you
| think in terms of what loophole would exist without it.
|
| Imagine a company that sells you a router, and they declare that
| the necessary software is provided "free of charge", and as an
| extra convenience they've pre-installed it for you.
|
| Sure, maybe the device won't work with any other software, and
| maybe the software can't be installed on any other device, but
| anybody can download a copy from their website, so it is free...
| card_zero wrote:
| > I'm unsure whether the CRA would allow me to distribute ready-
| to-run binaries along with source code.
|
| Why?
| x0x0 wrote:
| Because that makes Kevin a manufacturer and thus subject to
| liability for a product that he gives away for free, which is a
| ludicrous proposition. And would lead anyone rational to ban
| all UK downloads, because you can't put your personal finances
| at risk to give someone free software.
| hnfong wrote:
| The author has a hard time understanding whether the CRA applies
| because he is thinking like a software engineer and not a lawyer.
|
| It would be very clear to a lawyer what "in the course of a
| commercial activity" means. And accepting open source
| contributions from a business entity normally isn't considered
| "in the course of a commercial activity". (It's like buying
| apples from the supermarket is not a engaging in commercial
| activity on the part of the customer, even if the supermarket
| is.)
|
| No disrespect to the author, but even consulting with a law
| student would clear up the issue. Maybe better access to law
| would be nice, but if the OSS community is really concerned with
| this issue some lawyer would have clarified this already.
|
| IANAL of course, and this is not legal advice.
| dataflow wrote:
| If you give out apples for free and one of them turns out to
| hurt someone, are you liable?
|
| Edit: I'm not talking about deliberate poisoning or any other
| malicious intent. (Apparently this wasn't obvious?)
| s1artibartfast wrote:
| IANAL, I expect it would depend on how you represented them
| and any negligence or malicious intent.
|
| You certainly cant hand out poison apples for free without
| liability.
| hnfong wrote:
| (This is what I learned in school, for common-law-ish
| jurisdictions.)
|
| What you said is true, if there's negligence or malicious
| intent you're generally liable. In tort. (Edit: also
| criminally liable as well but that's far off topic)
|
| However, whether you sold it or gave it out for free does
| matter, because for sales of goods, there's also contract
| law involved, there's usually additional implied warranties
| about the product being "merchantable" (you see this word
| in OSS disclaimers as well), and generally you can't
| disclaim your liability if you sold the product for money.
|
| If there's no money and no other considerations involved
| when you give away the apple, then there's no contract, so
| only the tort part applies.
|
| Generally the idea of holding the seller of a product
| liable for harms caused by the product is that the law (or
| society at large) don't like businesses profiting from
| selling stuff yet shifting risks to the consumer at the
| same time.
|
| Again, IANAL and not legal advice.
| eh_why_not wrote:
| _> In tort._
|
| New word for me.
|
| _A tort is a civil wrong, other than breach of contract,
| that causes a claimant to suffer loss or harm, resulting
| in legal liability for the person who commits the
| tortious act. Tort law can be contrasted with criminal
| law, which deals with criminal wrongs that are punishable
| by the state. While criminal law aims to punish
| individuals who commit crimes, tort law aims to
| compensate individuals who suffer harm as a result of the
| actions of others_
|
| https://en.wikipedia.org/wiki/Tort
| s1artibartfast wrote:
| Perhaps it gets into a legal area that considers
| "reasonable expectations and behavior". You can
| absolutely sell buggy, non-functional, and even dangerous
| code. You just need to go to greater length too ensure
| that the buyer is informed about what they will be
| getting.
|
| >Generally the idea of holding the seller of a product
| liable for harms caused by the product is that the law
| (or society at large) don't like businesses profiting
| from selling stuff yet shifting risks to the consumer at
| the same time.l
|
| I think it is more about the law attempting to mirror
| social expectations than having high-minded objectives
| itself.
| gradientsrneat wrote:
| In the United States you have limited liability if you donate
| the apples to a food bank or a nonprofit feeding the hungry.
| Not sure about the case where you give away apples directly
| to random people on the street.
|
| https://www.usda.gov/about-usda/news/blog/good-samaritan-
| act...
| captainbland wrote:
| It does seem like they have explicit provisions to exempt those
| distributing non-commercial OS/FOSS from these requirements. This
| is in keeping with the EU's promotion/funding of public benefit
| software.
| fred_is_fred wrote:
| If a company uses free software in building their product, how
| does the law apply here. Does the liability fall on the
| commercial use or the original provider?
|
| Or what if the open source library itself is provided by a
| company. Let's say Intel's IPMI library has a vulnerability
| that affects Dell servers and causes a breach at a bank in
| Paris.
| orwin wrote:
| It's on the commercial user. Basically if you don't pay for
| support you're liable for the issues, at least in my only
| experience: a company I worked for decided to stop paying for
| Atos/Bullion support because of how shitty/useless it was,
| and the only reason the CEO agreed was that we could instead
| use Redhat software and support to take on part of the
| liability.
| immibis wrote:
| AFAIK if you take open source software, provided without
| liability, and use it commercially then you take the
| liability for that product, since you can't shift it to the
| creator, since they're volunteering for free.
|
| Which seems like common sense to me. It's good when the law
| mirrors common sense.
| x0x0 wrote:
| > AFAIK if you take open source software, provided without
| liability, and use it commercially then you take the
| liability for that product, since you can't shift it to the
| creator, since they're volunteering for free.
|
| That is incorrect per my understanding. If that open source
| org offers eg paid support, they likely have liability, at
| least in the EU. Now they're probably, practically
| speaking, judgement proof. But they do have liability. see
| [1]
|
| [1] https://ubuntu.com/blog/the-cyber-resilience-act-what-
| it-mea...
| immibis wrote:
| Okay, but then they're selling a product, not
| volunteering. And the law is that people who sell
| software can be liable for that software. Which makes
| sense. _This is how every other product on the market
| works._
|
| Note that "can be liable" does not mean "will pay so much
| money they go bankrupt". It just means that normal
| liability rules will apply and that person is not
| shielded from liability. If I sold you a broken car
| saying it was in perfect order, I may be liable, but if I
| can prove a mechanic told me it was in perfect order and
| I didn't break it after that, I may be able to transfer
| my liability to them. Now, if because the car was faulty,
| you crashed into a children's picnic, your car exploded
| into flames and and killed an entire orphanage, I or the
| mechanic may still go bankrupt paying their medical
| bills...
| x0x0 wrote:
| "selling" a product for $0 is an insane twisting of
| english and common sense.
|
| And something now that only idiots do. And the reason no
| physical world analogies apply in the slightest is even
| if you give away ( _not_ sell) a new car, you don 't sell
| a million copies and incur liability across a million
| users. For that same $0 cost. So that free download
| incurs effectively unbounded liability.
| fjfaase wrote:
| What I understand (from having attended some Dutch government
| meetings about this), is that companies are liable and should
| make an assessment of all third party libraries that they are
| using with respect to the risk involved with cyber security.
| Furthermore, they should actively monitor any security
| updates of those third party libraries and incorporate fixes
| in their own software and push those to users of their
| software. This does include embedded software in the devices
| they sell.
|
| This applies to all software that is part of a commercial
| interaction, no matter whether the other party has to pay for
| the software or not. The software could be part of a device
| or be part of a certain service.
|
| I understood that as long as the developers of open software
| are not involved in a commercial interaction, they cannot be
| held liable. I guess that if you receive some kind of support
| (a grant) for developing open source software, you are not
| immediately in a commercial interaction. But if you have some
| kind of agreement with an organization to develop or maintain
| open source software specific for that organization, that
| could count as commercial interaction.
| x0x0 wrote:
| > _But if you have some kind of agreement with an
| organization to develop or maintain open source software
| specific for that organization, that could count as
| commercial interaction._
|
| I think that's the risk. It's not clear what counts as a
| commercial interaction. eg I built a lib used for data
| analysis of bio samples. I have occasionally done some
| consulting for users, but nothing in over a decade. Does
| that count as commercial interaction? It's unclear to me.
| I'm considering deleting the open source and/or updating
| the license to ban the EU.
|
| Like obviously this is a very low probability risk, but I
| don't care to take any risks for something that I give away
| for free :shrug:
|
| Separately, the idea that I have to have a security policy
| or any other thing; I decline.
| thrtythreeforty wrote:
| Would it be possible to provide software under a license which is
| only valid _if_ the manufacturer cannot be held liable for
| defects? That is, just turn the problematic scenario into
| copyright infringement.
|
| Seems to me this would be perfectly enforceable in the US, but EU
| laws often feel like they'd rather force software authors to take
| on liability and not be able to opt out of the whole problem. I'm
| unfamiliar with this area of law.
|
| I'm unsure if this modification would still qualify as Free
| software (as defined by FSF)... It would seem to interfere with
| Freedom 0 in a way that isn't really obvious. The legal
| environment would constrain what the software could be used for,
| because the license would terminate in case the author would be
| liable for defects.
| bad_user wrote:
| One can argue that this is implicit in FOSS licenses, including
| the GPL. If the author can be held liable for any defects, then
| they can't really share their contributions, and FOSS
| contributions would only be possible by entities with well-paid
| lawyers. This is against the spirit of both Open Source and
| Free Software.
|
| Furthermore, similar clauses have existed for patents. E.g., if
| you use an Apache licensed library, but sue one of the
| contributors for patent infringement having to do with the
| library in question, then any grants of the Apache license
| terminate, so you can then be countersued. The way you framed
| your text, this would qualify as an interference with Freedom
| 0, as you can't eat your cake and have it too.
|
| Lest we forget, here's what the MIT license, one of the most
| permissive ones, have to say:
|
| _" THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
| KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
| WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE
| AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
| HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
| WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
| FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
| OTHER DEALINGS IN THE SOFTWARE."_
|
| So the MIT license already says what you think is against
| Freedom 0.
| thrtythreeforty wrote:
| Agreed so far, but in the US that clause is enforceable and
| doesn't affect the ability to use or _run_ the software, only
| the ability to receive support for it. My understanding is
| that any such disclaimer by businesses in the EU is not
| enforceable due to this new law. As someone who wouldn 't
| want to accidentally be on the hook, I'd want a license which
| precludes uses where the law would kick in - but _that_ is a
| restriction on use.
| spacemanspiff01 wrote:
| So, on the plus side, assuming that the absurd aspects get ironed
| out, couldn't this be a good thing.
|
| Businesses that rely on open source software will either have to
| accept liability for defects, or contract out to a third party
| who accepts liability.
|
| That seems like it might encourage open-source business models
| that encourage selling support, even just for the liability
| protection.
|
| Or am I being too hopeful?
| nullc wrote:
| In ~2022 myself and a dozen other former and current volunteer
| Bitcoin contributors were sued in the UK by a shell company
| controlled by a fraudster/imposter.
|
| The plaintiff alleged that they had 'lost' (through no fault or
| negligence of ours) in a 'hack' the private keys to some $4
| billion dollars in Bitcoins and that we owed them tortuous and/or
| fiduciary duties to aid them in "recovering" these assets.
|
| Our position was that there wasn't anything we could do to help,
| that even if there were we had no obligation to do so, owing to
| the fact the software we published was MIT licensed with a
| forceful disclaimer of liability which the plaintiff had accepted
| and without which we wouldn't have allowed the plaintiff to use
| or redistribute the software we wrote and the fact that normally
| no one has an active duty to save another (e.g. a police officer
| can stand holding a life preserver as you drown, and finally that
| their claim of ownership was obviously fraudulent.
|
| (plaintiff's position was that we could help by publishing
| backdoored software, we were never able to pin them down how how
| we were supposed to force anyone to adopt it in order to give it
| any effect at all, among other issues)
|
| We originally succeeded at getting the case tossed as having no
| reasonable prospect of success, but the dismissal was overturned
| by the appeals court.
|
| Fortunately (???) the fraudster behind the claim brought an
| additional spurious claim against us (this time demanding
| hundreds of billions in damages) during the brief window before
| the initial dismissal was overturned. Owing to a spectacular
| tactical blunder by our opponent the new case was joined in with
| other cases involving him which were more advanced in their
| development, and we were able to factually destroy all of the
| evidence that his initial case used to show his ownership as a
| collateral effect.
|
| All in all our litigation cost millions of dollars, tens of
| millions in for all parties across all the related cases.
| Fortunately good actors in the Bitcoin space stood up to pay our
| costs or otherwise we would have been personally ruined long
| before successfully winning the case on its merits, which was
| presumably his strategy. -- this is a thing often missed in these
| discussions: that it doesn't matter so much if you would
| ultimately win when if you can't immediately get a summary
| dismissal the legal costs will ruin you long before you get that
| opportunity. Not every project has supporters as wealthy as ours.
|
| Unfortunately, we had essentially no support from the free
| software legal or online rights world. I hope we avoided the
| precedent created by the initial reversal trashing things up for
| the future, time will tell. I was disappointed by parties who
| denied us support out of ick at anything cryptocurrency... when
| it comes to defending civil liberties you can't necessarily pick
| who you defend. There is a lot of good free speech law in the US
| thanks to the deplorable people at the Westboro Baptist Church.
|
| Our case was in the UK even though none of the defendants were
| there and many were in the US, because that's where the plaintiff
| brought it. Unfortunately when you write software that's used
| world wide you're potentially exposed to the systems of other
| countries, at least ones your own country will domesticate
| judgements from, regardless of your desires. (and perhaps an
| absence of choice of venue clauses is a defect in popular
| licenses...)
___________________________________________________________________
(page generated 2025-02-15 23:02 UTC)