4 ms·

From what I understand Germany already is not very start-up friendly it seems like this further exactrebates it. I put together a weekend project to see how it

From what I understand Germany already is not very start-up friendly it seems like this further exactrebates it. I put together a weekend project to see how it goes, I have a bug somewhere I didn't think of now BAM I'm on the hook for millions of dollars in "damages." Another much more chilling question is what happens to FOSS projects? Is Germany going to start going against every software developer that uploads an MIT licensed package on Github? What about the Log4j vulnerability who is on the hook for that? I agree security needs to be taken more seriously and we need to step up our game, but I grow concerned when the government starts making broad laws like this.

felixrieseberg 5y ago
You seem to misunderstand the original request _and_ the proposal. We so far only have the CCC's request, no further details are known. If you go by the proposal, FOSS and Open Source is out of scope. In the case of Log4j, companies knowingly selling software that contains in insecure version of Log4j now need to own that defect.
- tasubotadas 5y ago
  What if they claim that they don't know? You know... haven't got the memo.
  - einherjae 5y ago
    Not sure if you’re already trying to make a joke, but there’s a word for that, isn’t there? Negligence. Doesn’t help your local restaurant if they didn’t get the memo about the poisonous scallops, particularly if there existed a regular scallop-poison-level newsletter they could check.
  - Flocular 5y ago
    that could still be considered negligent, if it has a CVE and you're using it, you gotta know about it
A4ET8a8uTh0 5y ago
I agree with the concern for several related reasons, but the pendulum had to swing eventually. We are at a point, where too much critical infrastructure relies on software. If those building blocks crumble each time someone sneezes at them, some remedy is necessary. Regarding the start-up argument, the amusing upshot ( for Germany ) of this is that they get software that has been already beta tested in US ( think Tesla autopilot ).
ianleeclark 5y ago
> it seems like this further exactrebates it. I put together a weekend project to see how it goes, I have a bug somewhere I didn't think of now BAM I'm on the hook for millions of dollars in "damages." Judging by the CCC statement, this is more intended for cases of negligence in face of known security problems. It specifically says "unkorrigierten oder gehäuften IT-Sicherheitsproblemen" (uncorrected or accumulating/amassed it security problems).
josephg 5y ago
Who do you consider responsible for the code in products we ship? Is it users? It can’t be. They aren’t engineers, and even the users who are don’t have access to our source code. Is it the government? No. Is it … nobody? That sounds like a terrible idea. The only people left are us. The company or team who ships a product. This is the same as everything else in civilisation. I’m responsible for food I sell. If I sell you poisoned food, you can sue me for the harm my food caused. If you hire me to build a house, I’m responsible for making the house safe. If the house falls down and injures you, you can sue me for damages. The general principle is that we are responsible to our neighbours insofar as our actions could foreseeably hurt one another. Lawyers call it Tort Law and frankly it makes sense. Why should software be exempt? As for opensource - if you pull in a random (free) MIT licenced piece of code on GitHub, one of the license conditions is that you take all responsibility for the software. The opensource dev isn’t responsible and (I am not a lawyer) almost certainly wouldn’t be held liable for bugs.
- tasubotadas 5y ago
  Users. They shouldn't use software that they haven't wetted as secure. No amount of regulation will save users from installing a hundred of toolbars if they want to do that. But it will hinder legitimate programmers from publishing useful software (especially free and open source software).
  - einherjae 5y ago
    That only makes sense for FOSS, where part of the deal is that the software is provided for free, but with no guarantees about fitness for purpose. Would you except restaurant-goers to be liable if they get poisoned? Now compare that to picking your own mushrooms, or dumpster diving. Part of the deal when you start charging for something, has to be that the customer can expect the product to… work.
  - cdirkx 5y ago
    How is this different from saying "We shouldn't cross bridges that we haven't vetted as structurally sound."? I don't expect everyone to have an architectural degree, as well as the time and resources to verify everything without access to the building plans.
dathinab 5y ago
> not very start-up friendl I'm not sure about that. The startup culture is different but not necessary worse. The main pain point would be that you must get taxes right and maybe that the system favors more substainable startups then moonshots which mainly hope to be bought for absurd prices by monopolistic companies. > FOSS Isn't sold (normally) so shouldn't be affected (in the common case). Instead the company using it is responsible. Like using open source without vetting or potentially fixing it, is like using a building blueprint you found on the internet without vetting or fixing it. This should favor companies using open source more responsible and payed support contacts. That's is if any law resulting from this is properly done.

felixrieseberg 5y ago

You seem to misunderstand the original request _and_ the proposal. We so far only have the CCC's request, no further details are known. If you go by the proposal, FOSS and Open Source is out of scope. In the case of Log4j, companies knowingly selling software that contains in insecure version of Log4j now need to own that defect.

tasubotadas 5y ago
What if they claim that they don't know? You know... haven't got the memo.
- einherjae 5y ago
  Not sure if you’re already trying to make a joke, but there’s a word for that, isn’t there? Negligence. Doesn’t help your local restaurant if they didn’t get the memo about the poisonous scallops, particularly if there existed a regular scallop-poison-level newsletter they could check.
- Flocular 5y ago
  that could still be considered negligent, if it has a CVE and you're using it, you gotta know about it

A4ET8a8uTh0 5y ago

I agree with the concern for several related reasons, but the pendulum had to swing eventually. We are at a point, where too much critical infrastructure relies on software. If those building blocks crumble each time someone sneezes at them, some remedy is necessary. Regarding the start-up argument, the amusing upshot ( for Germany ) of this is that they get software that has been already beta tested in US ( think Tesla autopilot ).

ianleeclark 5y ago

> it seems like this further exactrebates it. I put together a weekend project to see how it goes, I have a bug somewhere I didn't think of now BAM I'm on the hook for millions of dollars in "damages." Judging by the CCC statement, this is more intended for cases of negligence in face of known security problems. It specifically says "unkorrigierten oder gehäuften IT-Sicherheitsproblemen" (uncorrected or accumulating/amassed it security problems).

josephg 5y ago

Who do you consider responsible for the code in products we ship? Is it users? It can’t be. They aren’t engineers, and even the users who are don’t have access to our source code. Is it the government? No. Is it … nobody? That sounds like a terrible idea. The only people left are us. The company or team who ships a product. This is the same as everything else in civilisation. I’m responsible for food I sell. If I sell you poisoned food, you can sue me for the harm my food caused. If you hire me to build a house, I’m responsible for making the house safe. If the house falls down and injures you, you can sue me for damages. The general principle is that we are responsible to our neighbours insofar as our actions could foreseeably hurt one another. Lawyers call it Tort Law and frankly it makes sense. Why should software be exempt? As for opensource - if you pull in a random (free) MIT licenced piece of code on GitHub, one of the license conditions is that you take all responsibility for the software. The opensource dev isn’t responsible and (I am not a lawyer) almost certainly wouldn’t be held liable for bugs.

tasubotadas 5y ago
Users. They shouldn't use software that they haven't wetted as secure. No amount of regulation will save users from installing a hundred of toolbars if they want to do that. But it will hinder legitimate programmers from publishing useful software (especially free and open source software).
- einherjae 5y ago
  That only makes sense for FOSS, where part of the deal is that the software is provided for free, but with no guarantees about fitness for purpose. Would you except restaurant-goers to be liable if they get poisoned? Now compare that to picking your own mushrooms, or dumpster diving. Part of the deal when you start charging for something, has to be that the customer can expect the product to… work.
- cdirkx 5y ago
  How is this different from saying "We shouldn't cross bridges that we haven't vetted as structurally sound."? I don't expect everyone to have an architectural degree, as well as the time and resources to verify everything without access to the building plans.

dathinab 5y ago

> not very start-up friendl I'm not sure about that. The startup culture is different but not necessary worse. The main pain point would be that you must get taxes right and maybe that the system favors more substainable startups then moonshots which mainly hope to be bought for absurd prices by monopolistic companies. > FOSS Isn't sold (normally) so shouldn't be affected (in the common case). Instead the company using it is responsible. Like using open source without vetting or potentially fixing it, is like using a building blueprint you found on the internet without vetting or fixing it. This should favor companies using open source more responsible and payed support contacts. That's is if any law resulting from this is properly done.