5 ms·

Why is there _any_ open source? There are enough areas, libraries, whatnot, where it would be perfectly fine to share forth code. I mean, look at device drive

Why is there _any_ open source? There are enough areas, libraries, whatnot, where it would be perfectly fine to share forth code. I mean, look at device drivers for linux. Doing this would really have helped the ecosystem, I suspect, because people would have tried to clean up their code a bit before throwing it on github, for instance. Not that examples that are on github today are all stellar.

shagie 4y ago
Because those examples are medical and industrial devices. The insurance issues that a manufacturer gets when people are provided the software to modify it becomes much more complicated. It becomes much more difficult to insure a facility that has an industrial refrigeration unit where it is possible for people to change how it runs. Note that this is an issue with industrial and medical systems - the insurance for these is such that the manufacture is liable unless they have taken every possible precaution to prevent misuse. From an insurance perspective, that includes keeping the source code closed. This is a very different issue from consumer devices. An open source device driver tinkering causes the computer to overheat? "No warranty" is enough to disclaim that for consumer systems - not so with industrial devices where the tinkering person can kill someone and the company making the device is liable because this was a precaution they could have taken.
- skissane 4y ago
  > Note that this is an issue with industrial and medical systems - the insurance for these is such that the manufacture is liable unless they have taken every possible precaution to prevent misuse. Is that an accurate statement of the legal liability? If the vendor clearly states in the sales contract that it disapproves of unauthorised customer modifications, that such modifications will invalidate product safety and regulatory compliance testing, and that it excludes all liability for customers who ignore those warnings – and the customer does it anyway – why should they be liable? > This is a very different issue from consumer devices. I think it is indeed different, but in a different way than you think. Products sold directly to ordinary consumers, courts accept that most consumers won't read or won't understand the sale contract, and so are more likely to invalidate exclusions of liability contained therein. Industrial and medical devices are not sold directly to individual consumers; their purchasers are usually corporate entities (whether a business or a not-for-profit enterprise such as a hospital), which can be assumed to have ready access to legal counsel; and the staff of the entity involved in the purchase can be expected to have a professional level of understanding of the technology, safety/regulatory/compliance risks involved, etc. Given that, courts are far more likely to uphold exclusions of liability (including exclusions of liability for unauthorised customer modifications), than for a contract of sale to individual consumers. Furthermore, the vendor can put in the sale contract that the customer indemnifies the vendor for any liability caused by the customer's unauthorised modifications. Such an indemnity is far more likely to be upheld in a B2B contract than a B2C one. And unlike the B2C case, the customer is likely to have significant financial resources, and its own liability insurance, making such an indemnity much more meaningful in practice. The vendor can also do customer due diligence, such as asking customers to provide evidence of their own liability insurance – something which is rarely practical in the B2C space.
  - shagie 4y ago
    With industrial and medical equipment, it falls into the category of strict liability. https://www.law.cornell.edu/wex/products_liability https://www.law.cornell.edu/wex/products_liability https://www.biren.com/blog/2020/september/defective-machinery-products-liability-litigatio/ https://www.biren.com/blog/2020/september/defective-machiner... > For the latter, California law provides options to Plaintiffs who pursue products claims against manufacturers, distributors, and others responsible for a defective product. These claims may allege: > Design defects, which can include a lack of adequate safety devices (i.e. machine guarding, shut-off valves, etc.) or other potential hazards in a product’s design that a manufacturer could and should have known would increase the risk of foreseeable harm. If it is foreseeable that "here's the source code to the industrial refrigerator controller" that someone might alter it and update it, then the manufacturer will have a harder time not being liable. Similarly, "here's the spinal nerve stimulation controller" may be risky to have people get the source code to to modify on their own. --- If you modify your car, and its not a design defect and something breaks, that's on you. If you remove a throttle on the computer's CPU and melt the solder, that's on. If you can reprogram a controller on an industrial device - that's on the manufacturer always. Industrial and medical equipment falls in a different category for product liability than consumer devices. > The Court’s ruling in Demara means the consumer expectation test may effectively be used to demonstrate the inappropriateness of a design for a broad range of products – even those which perform highly complex tasks in industrial settings – and hold manufacturers to higher standards. Note that the manufacturer of an industrial or medical device is held to a higher standard of "not letting the customer do the wrong thing with it." The issue is that at the end of the day, the manufacturer of industrial and medical equipment is liable for damages unless they take every possible foreseeable precaution to prevent the user of the device from inadvertently causing harm to themselves or others. That liability extends through resellers, rentals, and 3rd parties.
    - skissane 4y ago
      See https://www.druganddevicelawblog.com/2020/11/no-manufacturer-liability-for-after-market-modifications.html https://www.druganddevicelawblog.com/2020/11/no-manufacturer... “No Manufacturer Liability for After Market Modifications” which reports on the case Lowe v. Cerner Health Services, 2020 U.S. Dist. LEXIS 218240 (E.D. Va. Nov. 20, 2020) - https://casetext.com/case/lowe-v-cerner-health-servs https://casetext.com/case/lowe-v-cerner-health-servs - a hospital customised an EHR system, and flaws in the hospital’s modifications was a contributory factor to plaintiff’s injury. The Court held that the EHR vendor was not liable for flaws in the hospital’s implementation (as opposed to the base product itself). > Note that the manufacturer of an industrial or medical device is held to a higher standard of "not letting the customer do the wrong thing with it." > The issue is that at the end of the day, the manufacturer of industrial and medical equipment is liable for damages unless they take every possible foreseeable precaution to prevent the user of the device from inadvertently causing harm to themselves or others. You are essentially repeating the plaintiff’s contentions in that case, and the Court rejected them.

shagie 4y ago

Because those examples are medical and industrial devices. The insurance issues that a manufacturer gets when people are provided the software to modify it becomes much more complicated. It becomes much more difficult to insure a facility that has an industrial refrigeration unit where it is possible for people to change how it runs. Note that this is an issue with industrial and medical systems - the insurance for these is such that the manufacture is liable unless they have taken every possible precaution to prevent misuse. From an insurance perspective, that includes keeping the source code closed. This is a very different issue from consumer devices. An open source device driver tinkering causes the computer to overheat? "No warranty" is enough to disclaim that for consumer systems - not so with industrial devices where the tinkering person can kill someone and the company making the device is liable because this was a precaution they could have taken.

skissane 4y ago
> Note that this is an issue with industrial and medical systems - the insurance for these is such that the manufacture is liable unless they have taken every possible precaution to prevent misuse. Is that an accurate statement of the legal liability? If the vendor clearly states in the sales contract that it disapproves of unauthorised customer modifications, that such modifications will invalidate product safety and regulatory compliance testing, and that it excludes all liability for customers who ignore those warnings – and the customer does it anyway – why should they be liable? > This is a very different issue from consumer devices. I think it is indeed different, but in a different way than you think. Products sold directly to ordinary consumers, courts accept that most consumers won't read or won't understand the sale contract, and so are more likely to invalidate exclusions of liability contained therein. Industrial and medical devices are not sold directly to individual consumers; their purchasers are usually corporate entities (whether a business or a not-for-profit enterprise such as a hospital), which can be assumed to have ready access to legal counsel; and the staff of the entity involved in the purchase can be expected to have a professional level of understanding of the technology, safety/regulatory/compliance risks involved, etc. Given that, courts are far more likely to uphold exclusions of liability (including exclusions of liability for unauthorised customer modifications), than for a contract of sale to individual consumers. Furthermore, the vendor can put in the sale contract that the customer indemnifies the vendor for any liability caused by the customer's unauthorised modifications. Such an indemnity is far more likely to be upheld in a B2B contract than a B2C one. And unlike the B2C case, the customer is likely to have significant financial resources, and its own liability insurance, making such an indemnity much more meaningful in practice. The vendor can also do customer due diligence, such as asking customers to provide evidence of their own liability insurance – something which is rarely practical in the B2C space.
- shagie 4y ago
  With industrial and medical equipment, it falls into the category of strict liability. https://www.law.cornell.edu/wex/products_liability https://www.law.cornell.edu/wex/products_liability https://www.biren.com/blog/2020/september/defective-machinery-products-liability-litigatio/ https://www.biren.com/blog/2020/september/defective-machiner... > For the latter, California law provides options to Plaintiffs who pursue products claims against manufacturers, distributors, and others responsible for a defective product. These claims may allege: > Design defects, which can include a lack of adequate safety devices (i.e. machine guarding, shut-off valves, etc.) or other potential hazards in a product’s design that a manufacturer could and should have known would increase the risk of foreseeable harm. If it is foreseeable that "here's the source code to the industrial refrigerator controller" that someone might alter it and update it, then the manufacturer will have a harder time not being liable. Similarly, "here's the spinal nerve stimulation controller" may be risky to have people get the source code to to modify on their own. --- If you modify your car, and its not a design defect and something breaks, that's on you. If you remove a throttle on the computer's CPU and melt the solder, that's on. If you can reprogram a controller on an industrial device - that's on the manufacturer always. Industrial and medical equipment falls in a different category for product liability than consumer devices. > The Court’s ruling in Demara means the consumer expectation test may effectively be used to demonstrate the inappropriateness of a design for a broad range of products – even those which perform highly complex tasks in industrial settings – and hold manufacturers to higher standards. Note that the manufacturer of an industrial or medical device is held to a higher standard of "not letting the customer do the wrong thing with it." The issue is that at the end of the day, the manufacturer of industrial and medical equipment is liable for damages unless they take every possible foreseeable precaution to prevent the user of the device from inadvertently causing harm to themselves or others. That liability extends through resellers, rentals, and 3rd parties.
  - skissane 4y ago
    See https://www.druganddevicelawblog.com/2020/11/no-manufacturer-liability-for-after-market-modifications.html https://www.druganddevicelawblog.com/2020/11/no-manufacturer... “No Manufacturer Liability for After Market Modifications” which reports on the case Lowe v. Cerner Health Services, 2020 U.S. Dist. LEXIS 218240 (E.D. Va. Nov. 20, 2020) - https://casetext.com/case/lowe-v-cerner-health-servs https://casetext.com/case/lowe-v-cerner-health-servs - a hospital customised an EHR system, and flaws in the hospital’s modifications was a contributory factor to plaintiff’s injury. The Court held that the EHR vendor was not liable for flaws in the hospital’s implementation (as opposed to the base product itself). > Note that the manufacturer of an industrial or medical device is held to a higher standard of "not letting the customer do the wrong thing with it." > The issue is that at the end of the day, the manufacturer of industrial and medical equipment is liable for damages unless they take every possible foreseeable precaution to prevent the user of the device from inadvertently causing harm to themselves or others. You are essentially repeating the plaintiff’s contentions in that case, and the Court rejected them.