http://news.bbc.co.uk/2/hi/technology/4318502.stm

basically he is calling for ALL software distributors to be 100% liable for any flaw or security issue to the extent of potential law suits.

I think that is nuts. Software code is so complex now days there is no way to guarantee perfection.

I think it is rediculous and would be the end to not only Open Source but all Software companies. holding manufactures responsible for how the public uses it's products is ludicrous...

The deep pocket law comes to mind here... they use an example of automobiles... well I have see people sueing and winning for auto's that have had safety problems... ie: (Ford/Firestone) and yes their should be some resonable liability when human life is involved but we are talking about software here... not car's that can kill people...

That would be like suing Smith and Wesson because you got shot because you had the safety on... just because you can own something does not mean you know how to use or how it should be used.

People need to take responsibility for their actions... not sue the light poll manufacture because it got in the way of your car...

KC

I intend, by this utilization of an obscure colloquialism, to imply that his sanity is not up to scratch; indeed, I would even go so far as to deny the semi-existence of his friend "Eric".

My personal opinion would be that commercial companies must be liable for bugs in their code, Microsoft, Powerquest, Adobe.

In other industries companies are made liable for their mistakes. BMW had to rectify the problem with the new Mini when the body sparked with the fuel nozzle whilst filling up, it was not left to the comsumer to sort the problem out out of their own pocket for example. There are many other examples but this came to my head first.

Software is the only industry where a company can make a product then sell it free of any form of responsibility.

I can't seem to form my sentences and arguments very well tonight, so I won't go on, but in summary I think Software companies should be made to take their responsibilities towards their customers seriously and be made accountable for any damage caused to the customer because of an error with the software product.

Another example, my brother recently got a new mobile phone and the backlight on the keypad didn't work, the phone was sent back and a replacement sent, my brother wasn't left to dismantle the phone and replace the LEDs or whatever lights up the keypad by himself

On the same note as some of the previous posts, I must be perfectly OK to nick someones TV, as long as I give them a document saying that I can not be held liable for entering their house and any actions made by me whilst in the house. I am not physically or mentally (well directly anyway) harming anyone.

Again your comparing personal injury with personal property...

Comparing the software industry with the car industry is insane... Do you think Ford would introduce a new model car and let the public do the testing? FORD: "Hmmm well, that axle is no good it killed 10 people we better redesign that"... I don't think so...

Microsoft has been using it's users as guinipigs for years for their software... They release an OS and wait for the complaints to come in to see what needs fixing... fortunetally no lives are at stake in this process...

If Microsoft ran the auto industry we would have 10 times the deaths by faulty workmanship... at least the car manufactures have a little sympathy for human life, unlike MS...

Hmmm, the ranting continues...

KC

Another example I just thought of, my brother just got a new phone and the keypad backlight didn't work. Do you think he had to fix the phone himself, or take it to a repair shop and have it fixed out of his own pocket. Of course not, it was sent back to the manufacturer and a replacement sent.

I once attended a lecture about how to be a good engineer, the codes of practices I should follow, what is acceptable and not. I was told that the readme's provided by Microsoft and other companies denying any liability have no legal standing. From a legal point of view you can't sell a product and not accept liability for it. I'm not sure of the accuracy of that information, but I agree with that whole heartedly.

Beta versions of Software are another matter, commercial companies do not expect customers to use the beta version in production environments. If Microsoft, and other companies were made liable for errors in products that the company intended to be used in production environments (for example Windows XP, not alpha or beta) then maybe we would be seeing software products of much, much better quality

If from the start of cars the public were allowed to 'test' cars then I expect people would still be driving Ford Mondeo LX Beta's about. Just because something has allways been done, and everyone is accustomed to it doesn't make it right.

PS I am not saying that the companies should be made responsible for customers not using the product correctly, just made liable for their own errors

Kencaz said
Microsoft has been using it's users as guinipigs for years for their software... They release an OS and wait for the complaints to come in to see what needs fixing... fortunetally no lives are at stake in this process...

you better sit down while I'll break this news to you
unfortunately ....
regarding that statement "no lives are at stake here"

this is not true !

Many hospitals use Microsoft on their computers
Many Navies including the RAN and the RN, in fact use Windows
( and I hope you are sitting down )
The RN uses Windows 2000 in its nuclear subs, controlling their nuclear missiles.

Imagine you are in hospital, and the little computer controlled thingy is keeping you alive and suddenly there is an error, "This programme has committed an illegal operation and will be shut down" - that's it son - lights out !

Some petty officer on a Trident Missile Sub somewhere playing minesweeper clicks on the wrong icon - poof - bye bye human race.

and on that happy note
enjoy the rest of your day

cheers floppy

Your correct floppywhopper
I used this phrase "fortunetally no lives are at stake in this process" reluctently but I do realize the MS is everywhere, even in Hospital software... It's just to bad that they depend on such and OS that is not tested, (even to government standards)...

Most of our military and other agencies use propriotary software ( I think) I can only hope that tank commenders in the gulf don't depend on windows software their target acquisition or they would be in terrible trouble... I tend to think that they do not...

I don't really care who uses what as long as they know that nothing is perfect... And Hey! You can't sue the test pilot for a faulty airplane...

KC

Hmm...interesting points.

There should be some kind of limit on who is liable, perhaps based on income or net worth of the company. Definitely, Microsoft, Adobe, and Apple should be responsible. They have the manpower, the money, to ensure an excellent product. However, smaller companies such as Grisoft and Lavasoft do not have such power, therefore should not be liable. It is simply too much effort to try to ensure perfection with every release, and those companies in particular have frequently updated products.

In response to floppywhopper, would Red Hat be subject to your suspicion had it been RHL on those hospital computers and submarines?

Warning: small novel ahead

You better believe there would be a lawsuit for this, and I would say 99 times out of 100 the person that got shot would win. That's a faulty product if the gun discharged while the safety was on. There's a legal doctrine called "strict product liability." Basically, it says that a business is liable for any injury caused by the malfunction of its product. Now, what trips people up is the word "injury." It doesn't mean what most people think it means. In legal terms, injury means "an invasion of one's legally protected interests." That may not be exact (and it may vary between jurisdictions) but it will suffice for this discussion. In case you're thinking "still, how in the world could Smith and Wesson be held liable regardless; the person shouldn't be pulling the trigger when the safety is on" I'll elaborate...

The argument you put forward that the business shouldn't be held liable for the misuse of its product leads you to one conclusion regarding a gun's safety: that the gun shouldn't have a safety at all. If the owner doesn't intend to shoot anything, their hand shouldn't be anywhere near the trigger to begin with. The safety is totally irrelevant. If the person shoots someone else, it's clearly intentional or a misuse of the product, right?

That might make sense, but we all know accidents happen. There's "foreseeability" the trigger will get pulled accidentally. It might be an accident while swapping the gun between hands, maybe the person's clothing somehow wrapped around the trigger and pulled it back (loose threads in a pocket? How about straps from the holster?), maybe a twig or tree branch managed to work the trigger back while walking through the woods. So now there are situations where there's a reasonably foreseeable chance an accident will occur that falls outside the scope of intent and misuse. In the law, if an accident is reasonably foreseeable, a business is negligent and liable for any injury (remember, that does not always mean physical detriment) resulting from that reasonably foreseeable accident. That is exactly why gun manufacturers put safeties on their weapons: to prevent those reasonably foreseeable accidents. Now, if the safety is there, the public expects it to work. If it doesn't that's a faulty product, and we get back to strict product liability.

Now, don't get me wrong. If there are some morons playing with guns, pointing them at each other, and pulling the trigger, there is a good share of liability to go around. However, if the gun's safety was on, that gun's manufacturer will be liable for some (probably a large portion) of the damages caused if that gun goes off. The only way they could escape liability is if they could show the gun's owner was negligent in maintenance of the gun, and that the owner's negligence was the reason for the safety's failure to operate.

Whew... now how does this relate to software?

Go back to that legal definition of "injury"... and let me pose a hypothetical situation:

Should a software company be liable for a bug in their software that caused a bank transaction to move 10 times as much money as expected? What if the money wasn't recoverable? Say, for instance, the transfer was to another country. Or consider the error wasn't discovered until after the money was spent by a non-profit organization (like relief for hurricane Katrina). There would hardly be any cause for a suit against the non-profit organization. They didn't do anything wrong; they acted in good faith, and they can't expend the effort to verify each donation was accurate. Clearly, the software was responsible. Does it make sense to say, "Sorry. The software development firm can't be held liable."?

A consumer has a "legally protected interest" not to be robbed, and that is arguably what's happening above: money is being taken, without the owner's consent. The software is a product, the doctrine of strict product liability sure seems to apply.

Basically, that doctrine is just trying to create an environment of trust for consumers. If someone puts a product out in the market (whether for charge or free), the public has an expectation that it will work within reason. When people begin to depend on that software for their livelihood or integrate it into the management of their personal lives, the bar for reasonable operation gets raised.

Software developers CAN be held to a higher standard. There are procedures and methods to reduce the errors. HOWEVER, those things eat up a great deal of time and money. The last 20 years, stability has been traded off in favor of cheap computing. Reliable computing is quite possible, but speed of innovation, and price will suffer a good deal initially. Once development methods mature, speed will come back up some and price will come down, but it'll never be as good as it is now. I don't depend on my computers for much at all, so I'm quite happy to crash from time to time in exchange for cheap computing...

Well first off, the hospitals don't use windows for life support machines, those are much more specialized and there makers are held accountable (one reason why those machines cost so much). MS software is on the hospital PC's holding patient records and such and if the hospital gives you someone else's medication, fault of the OS/Software or not then they can be sued, that kind of thing happens a lot. The same situation happens if your Ford burns up due to faulty wiring, Ford is liable for the recall if its proven to be a recurring problem even if Ford didn't make the wire (they usually buy sub that out). Same happens with guns, if the gun goes off while on safety and it can be proven to happen enough that there was an issue with the safety then the gun maker can be held liable. However if just one goes off due to a worn/damaged safety then the gun maker shouldn't be liable.
I think software companies should be held liable for recurring problems if they don't fix the problem in a timely mannor, or the problem is recurring. For example when MS05-018 started crashing all the w2k servers it was installed on and MS claimed it was rare and drug their feet releasing a fix, then didn't test the fix proactively, then yes they should have been held liable, because they not only had a security vulnerability but the fix caused more damage and they refused to acknowledge it completely and when they finally did admit to it they refused to fix the patch. That cost us more downtime because we had applied all the patches during the maintenance windows but then servers were rebooting during business hours. I don't think we should start out with 100% liability because no product it perfect, thats what the new car/computer/whatever warranty is for. If a problem is found then the vendor needs to have a set amount of time to provide a fix depending on the severity of the problem. Then if the vendor doesn't provide a fix within the set time they start having to pay. We don't want to go from one extreme of 0% to the other extreme of 100%, we need a happy medium.
The great thing about open source then is since no one person/company owns it then there would be no liability.

That might not be entirely accurate.

No one has ever tried this with open source software, but it might be a viable legal argument. There is another legal doctrine (I know, I know... enough with the doctrines!!) called alternative liability. Say there is a person that suffers an injury from multiple people simultaneously. A classic example is this (modeled after a real case - I can provide the citation if anyone is curious):

• A group goes out to hunt quail
• Hunter A gets out in front of the others
• A quail is flushed out and flies between Hunter A and the others
• The hunters in back take aim and shoot at the quail
• Hunter A gets hit with a pellet from one of the guns

Hunter A knows one of the other hunters shot him, but can't prove which one. Alternative liability will shift the burden of proof from Hunter A to the others. It says:
"There was negligence involved, we don't know who, but it was one of you. Either you guys cough up an equal share, or prove that you weren't the one that caused the injury."

The idea behind this is, there's clearly someone who commited a wrong for which they are liable. If the burden of proof was left with Hunter A, he couldn't get compensated for being shot, and someone escapes liability. That doesn't seem fair considering the people that did the shooting probably have knowledge of what happened, and are just keeping quiet to avoid paying.


Again, how does this relate to open source software?

If the software was negligently written (won't get into that), and the section of code responsible could have been written by multiple developers, that runs parallel with the situation above. Somebody had to write the code. The person that got injured by the software has no idea which developer wrote it, but clearly, something was written incorrectly. The court might tell the developers "you guys figure it out, or you'll each pay an equal portion."

I keep saying "might" because this argument hasn't (to my knowledge) been used with a court. So the theory might be rejected completely. However, if it would be accepted, then it would actually be beneficial (from the developer's perspective) to write code under employment. The employer would shield them from liability for poorly written code. Under open source, the developer could be personally liable.

Again, this is all speculation. I'm just pointing out similarities to existing legal concepts.