4 ms·
> There is a reason why the open-source world has concerns: the legislation indirectly defines who is responsible for the security of open source and who should
by lijok 3y ago
> There is a reason why the open-source world has concerns: the legislation indirectly defines who is responsible for the security of open source and who should pay to improve the current state. In addition, it puts the responsibility on individual developers and foundations hosting open-source projects instead of the manufacturers of goods embedding the software.
Why is this a concern? If you are unable to produce high quality, safe software, then don't make it publicly available for use. If you make something publicly available for use, you should be liable for maintaining it and any damages that software causes due to bugs. No different than if I were to make some crappy fire extinguishers and hand them out to people for free. No different than if I were to build a little bridge over a river.
- jauntywundrkind 3y agoWhat a horrible statement. Who is ever certain? How certain are you? How willing to endure false claims are you, even if miraculously you have convinced yourself the work is flawless? This is insulting beyond words. We think together with open source. Ideas are shared. The world iterates forward & we learn & improve, together. Saying we cannot open our mouths unless we have only the voices of the angels is a demonic silencing. Hard disagree.
- lijok 3y ago> Who is ever certain? How certain are you? How willing to endure false claims are you, even if miraculously you have convinced yourself the work is flawless? If you're not certain and unwilling to fight false claims, just don't publish it for public use. It's kind of that simple. > We think together with open source. Ideas are shared. The world iterates forward & we learn & improve, together Indeed. And we have, and continue to produce plenty of resources for that. > This is insulting beyond words My sincere apologies that I insulted you by stating you shouldn't be allowed to hand out home-made fire extinguishers to the public and expect no repercussions
- jauntywundrkind 3y agoI have the hardest time imaging what it would take to develop software we are certain of. Developers of greatest talent are experts at finding doubts and potential weaknesses. They see accrued depth of complexity far beyond what the minds of simpler beings floating only on the surface of interface see. They can imagine all kinds of complex interactions. And they are never certain. That doubt is a doubt they work against, guard against ad best they can, but live with. It feels like such a ridiculous silly alien voice, such absurd naivety, to say, oh, just be certain. Just make it flawless. Whatever happens, it must be perfect. It's a juvenile fantasy, that only one ignorant to the complex nature of reality, unthinking of the combinatorial explosions of possibilities that happen as layers of systems & libraries intersect, unseeing of the absurd misuse by users of technology, that any and all difficulties could be conquered by just demanding someone making something make it perfect or never ever share it with the world, never allow users.
- lijok 3y agoYou're thinking in absolute terms. I think that might be the source of the disagreement. I am not advocating that it should be illegal to publish OSS unless you can mathematically prove it is faultless. I am advocating that if you are going to publish software for public consumption you better be damn sure it wont cause harm, because you will be (should be) accountable for any harm caused.
- whatisyour 3y agoWould manufacturer of knives be liable for knife attacks? The world runs on limited liability.
- lijok 3y agoNo, as in that scenario the knife is not being used for its intended purpose
- orangecat 3y agoThis would eliminate the vast majority of non-monetized open source, because authors would be exposing themselves to unbounded liability with no upside. I'd have to take down all my apps and repos even though as far as I know they have never caused any harm. Maybe you consider that an acceptable tradeoff; I don't.
- alphanullmeric 3y agoWhether or not my software is of quality is none of your business. I’m allowed to say “no guarantees”. It’s not your right to force me to provide you a guarantee. Force is only justified in response to force, and nobody forces you to use open source software.
- Ekaros 3y agoI'm starting to believe that "no guarantees" should be explicitly banned. You release software, you should guarantee it.
- rpdillon 3y agoFor what use case?
- Ekaros 3y agoEvery reasonably viable use case.
- rpdillon 3y agoThis is entirely divorced from reality, then. You'd have to make the code resilient to failure modes specific to operating environments you're entirely unaware of while authoring the code. E.g. someone takes your code and cross-compiles it for use as part of one of several daemons running in an embedded system on an architecture you never tested on, and it leaks memory in that environment due to how to OS allocates memory there. I'm not thrilled with this example I just made up, but I hope it captures the distinction between writing an algorithm and deploying a full solution into a known environment. The idea that software engineers can 'guarantee' against this is fantasy and precisely what integration testing is for. It has to be the case that those who deploy the code take responsibility for its behavior, not the original authors, since only those deploying have the full picture of the system.
- ls612 3y agoWould you like to propose a method for guaranteeing your software is bug free?
- convolvatron 3y agoIf the bar is that high it would have a pretty chilling effect on education and the sort of grass roots experimentation that fuels innovation. I should be able to say 'don't use this for anything serious, its a toy', and not be liable if you choose to link it into your avionics software anyways.
- lijok 3y agoI'll amend my comment as it seems to have confused a few folk on the meaning of "public". Yes you should be able to say "don't use this", "for education purposes only", "this is a demonstration", etc.
- ApolloFortyNine 3y agoWell there's already a statement in almost every open source license saying there is no warranty or expectation that it works at all, but sure let's tack on 'for education purposes only'. It'd be the same result as California's law leading to 'this may cause cancer' printed on so many items no one even cares any more.
- convolvatron 3y agoI'll amend mine to seriously endorse the idea that there should be a software supply chain that is verified to the degree that's possible and should hold liability. and ramps from world A to world B. this idea that you can hoover up a bunch of slop from the internet, sell it, and not be responsible in any way is really the problem here.
- lijok 3y agoFully agree
- PixyMisa 3y agoYou mean, something like this? THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- salawat 3y ago>Why is this a concern? If you are unable to produce high quality, safe software, then don't make it publicly available. If you make something publicly available, you should be liable for maintaining it and any damages that software causes due to bugs. Don't blame me for not building the house to code, blame the guy who made my nails, fasteners, and lumber. ^this is what you're endorsing, because any failures generally occur at the stage wherein the End User is adapting the component to integrate into their own systems. Responsibility falls on the composer of a system to deal with the composition's quirks. Anything that tries to put it up a layer is just trying to pass the buck. The Software Author has a particular case in mind. Yours is probably not it, but might become so. If it fits, go ahead and ship, if not, smooth it out. Nothing is stopping you but your unwillingness to wrangle the code.
- lijok 3y ago> Don't blame me for not building the house to code, blame the guy who made my nails, fasteners, and lumber. I'll blame you for using poor quality nails, fasteners and lumber.
- beebeepka 3y agoNot what you said earlier > If you make something publicly available for use, you should be liable for maintaining it and any damages that software causes due to bugs.
- lijok 3y agoThat does not mean the consumer (the builder) is absolved of any responsibility, nor does it mean that the product of the builder using the poor quality materials is of good quality itself.
- AnthonyMouse 3y ago"Quality" is relative. A hinge which is fine for a closet door may be unsuitable for a bank vault.
- caesil 3y agoYour comment gave me a headache. To which address should I send the bill for this bottle of ibuprofen I used to treat it?
- lijok 3y agoI welcome you to debate it.
- AnthonyMouse 3y agoThe comment was the debate. Your comment (information, like software) created an externality on the reader which they would now like to bill you for.
- lijok 3y agoHaha, you're right. It went right over my head. I'd be happy to pay for their ibuprofen if they can prove the adverse effect my comment had, and if it continues having adverse effects, I'll make sure to take my comment down or improve its quality so as to stop causing the adverse effect.
- AnthonyMouse 3y agoAre you sure you're willing to do that? This website is read by hundreds of thousands of people. If even 1% of them have been adversely affected by your comment, you could be on the hook for thousands of dollars. And you've posted many other comments in this thread alone.
- lijok 3y agoYeah, it would be pretty bad for my wallet. Would make me reconsider posting low quality comments going forward, potentially increasing the quality of the forum long term.
- 3y ago
- transfire 3y agoBut software is extremely complex. A fire extinguisher is something like a million times less complicated than even a moderate sized program. Legislation like this is missing the real problem. Reminds me of when legislators tried to redefine Pi to be exactly 3.