10 ms·

What you wrote puts a shiver down my spine. If I can't disclaim any sort of warranty, and my FOSS has a bug which a company incorrectly thinks is nefarious code

What you wrote puts a shiver down my spine. If I can't disclaim any sort of warranty, and my FOSS has a bug which a company incorrectly thinks is nefarious code, what defense do I have should that company decide to sue me? (Or threatens to sue me unless I fix the code to their satisfaction.) I thought I could point to the explicit disclaimer of warranty&usability, the lack of a contract between us, the lack of payment, and the lack of copyright permission to even use my software unless they agreed to the license terms, as an absolute defense to request the court to dismiss the case. And now you suggest it might be otherwise, and I might end up paying a lot in lawyer and court costs over years? Has anything like this ever been taken to court? For example, was there any legal liability for the people who added the Bitcoin miner to event-stream? Or the denial-of-service caused by colors.js? It comes down to what specific law is broken, and where the person is living. Extradition requires the crime be illegal in both countries, yes? And who says the nefarious code must be hidden? What if it's described in the CHANGELOG and documentation? Because I know few people read those.

seanhunter 3y ago
Firstly I'm not any kind of lawyer and could be wrong. I was giving you my understanding. Secondly I said you can't disclaim liability for willful actions. If you do something by mistake or it's an unintentional side-effect of course you can disclaim liability. If you do something on purpose you can't say you weren't responsible for harm you caused because you put a disclaimer in somewhere. Yes some of these sorts of things have been taken to court. In the UK where I am they are typically prosecuted under the Computer Misuse act[1] but many countries have similar legislation. See the bit about a person being guilty of an offense if "the person intends by doing the act to cause serious damage of a material kind or is reckless as to whether such damage is caused.". There is specific UK guidance from the prosecution service that DDos is covered[2] Secondly Extradition doesn't require the conduct to be a crime in both countries. It requires it to be a crime in the country requesting extradition, there to be an extradition treaty between the two countries, and the conduct and request to meet the standard for extradition in the country where you are. That doesn't necessarily mean a crime in the place you are. It also means the evidence doesn't necessarily need to be at the standard that would be required where you are. So in the UK for example you can be extradited to the US if the US show "Probable cause" (the US standard) that you committed an offense in the US because the extradition treaty says that's equivalent to the standard that would be required to get a warrant for your arrest in the UK. I didn't say anything about the code being hidden - it would depend on the legislation but as you can see from the sources I posted, the important standard in the UK is that it was intended to cause harm or that you were reckless as to whether or not it could cause harm, not anything to do with being hidden. If you did hide it, that would probable help to show that it was intentional rather than an error though. In that legislation the max sentence for that part is 14 years or life if you cause harm to critical national infrastructure. [1] https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA [2] https://www.cps.gov.uk/legal-guidance/computer-misuse-act https://www.cps.gov.uk/legal-guidance/computer-misuse-act and DPP vs Lennon
- eesmith 3y ago
  Clearly I am not a lawyer, and my understanding of extradition faulty. I'll have to increase my bribe rate enough to get a lawyer involved. Wikipedia tells me that Namibia has no extradition treaty with the US... I looked at [1], and I think it comes down to what "authorised" means. If you install one of my non-malicious FOSS packages, does that automatically authorise me on your systems? If not, then I'm clearly already in trouble for doing an "unauthorised act in relation to a computer". Who authorised me? Who decides if I am unauthorised? How do I know it's unauthorized, as required by (b), when I don't even know you installed it? My likely naive belief is that when you get a software package from me - one which disclaims even usability of purpose, and which disclaims all liability for damages, to the fullest extent allowed by law - then you are responsible for vetting the software and authorising its use on your system. If the documentation says "doing X will wipe your home directory", and you do X, then you've authorised that action, yes?
  - seanhunter 3y ago
    That’s not what authorised means and I think know that and are just being deliberately obtuse. If I install your package I would need to be authorised not you. But as I say if you deliberately put something in your software package intended to cause damage you can’t disclaim liability for that. That’s exactly the same as if you write any other piece of malware and it gets installed on my computer you are responsible for the damage it causes. I’m not going to respond futher on this thread now.
    - eesmith 3y ago
      I was pointing out that the law you pointed to specifically requires that "the person does any unauthorised act in relation to a computer". My comment was to highlight that discussion of "authorised" does not make sense, strongly suggesting the specific law you mentioned was not relevant. You give an example saying that I can't disclaim liability for software which deliberately causes damage. That may be true, but what law am I breaking? Can I distribute an "rm" tool which will let you do "rm -f /"? Can I disclaim damages for using that tool? I really hope so! Your "it gets installed" is doing a lot of heavy lifting. Who installed it? You? Why did you install it? Did you read the documentation to learn about any changes? What counts as sufficient notice for the potential of causing damage? But back to the chilling effect - if I did NOT deliberately put something in your software package intended to cause damage, but a company thinks I did, must I go through a lengthy and expensive lawsuit, or can I point to the lack of warranty, etc. and have the suit dropped? Because if I can't easily get the suit dropped, then a company can use the threat of a lawsuit to get me to make changes to the code, eg, to "fix" the code they think I maliciously added.
eadmund 3y ago
> What you wrote puts a shiver down my spine. If I can't disclaim any sort of warranty, and my FOSS has a bug which a company incorrectly thinks is nefarious code, what defense do I have should that company decide to sue me? I am not a lawyer, you are not my client and this is not legal advice. My layman’s understanding is that it is not possible to disclaim liability for malicious action which harms another. If someone believes that you have maliciously harmed him, then he may try to recover damages from you for doing so — this is independent of software (he could do the same if you broke his leg). > And now you suggest it might be otherwise, and I might end up paying a lot in lawyer and court costs over years? Yup. The mechanism for sorting out claims of truth and liability is court, and wise plaintiffs and defendants engage lawyers. Unfortunately, this can be expensive, and in some cases the process is the punishment: one might be exonerated, but only after years and years of litigation and worry. I imagine that generally a potential plaintiff’s lawyers would advise him that absent clear evidence of malice that he is unlikely to win, and would be wasting his money. Particularly if you have no real assets, the game is not likely to be worth the candle. But if he is rich or foolish, he might waste it anyway.
- eesmith 3y ago
  > for malicious action which harms another Here's are things a lawyer might be able to answer. What specifically is my action that I am legally responsible for? I did not install my software on your machine - you did that. And I explicitly warned you not to trust it. Yet some reason you decided not only to trust that code base, but to keep trusting me in the future enough to auto-update, likely without even telling me. What makes it malicious? I can sell you a tool to re-format your hard disk. That is not malicious, because I described it that way. So how well do I need to document some "malicious" feature before it's no longer legally malicious? And, if I sell my company to another company, who then carries out these actions, is it my responsibility? Are these criminal liabilities, or civil? What is the relevant law? What is the maximum penalty? > Yup. The mechanism for sorting out claims of truth and liability is court Sure. But clearly invalid cases can get summary judgement for far less than taking the whole thing to trial, and I've been judging my risk based on the former overriding any of my users' claims of malicious intent. This doesn't seem like a topic that can go any further without an appropriate lawyer involved.

seanhunter 3y ago

Firstly I'm not any kind of lawyer and could be wrong. I was giving you my understanding. Secondly I said you can't disclaim liability for willful actions. If you do something by mistake or it's an unintentional side-effect of course you can disclaim liability. If you do something on purpose you can't say you weren't responsible for harm you caused because you put a disclaimer in somewhere. Yes some of these sorts of things have been taken to court. In the UK where I am they are typically prosecuted under the Computer Misuse act[1] but many countries have similar legislation. See the bit about a person being guilty of an offense if "the person intends by doing the act to cause serious damage of a material kind or is reckless as to whether such damage is caused.". There is specific UK guidance from the prosecution service that DDos is covered[2] Secondly Extradition doesn't require the conduct to be a crime in both countries. It requires it to be a crime in the country requesting extradition, there to be an extradition treaty between the two countries, and the conduct and request to meet the standard for extradition in the country where you are. That doesn't necessarily mean a crime in the place you are. It also means the evidence doesn't necessarily need to be at the standard that would be required where you are. So in the UK for example you can be extradited to the US if the US show "Probable cause" (the US standard) that you committed an offense in the US because the extradition treaty says that's equivalent to the standard that would be required to get a warrant for your arrest in the UK. I didn't say anything about the code being hidden - it would depend on the legislation but as you can see from the sources I posted, the important standard in the UK is that it was intended to cause harm or that you were reckless as to whether or not it could cause harm, not anything to do with being hidden. If you did hide it, that would probable help to show that it was intentional rather than an error though. In that legislation the max sentence for that part is 14 years or life if you cause harm to critical national infrastructure. [1] https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA [2] https://www.cps.gov.uk/legal-guidance/computer-misuse-act https://www.cps.gov.uk/legal-guidance/computer-misuse-act and DPP vs Lennon

eesmith 3y ago
Clearly I am not a lawyer, and my understanding of extradition faulty. I'll have to increase my bribe rate enough to get a lawyer involved. Wikipedia tells me that Namibia has no extradition treaty with the US... I looked at [1], and I think it comes down to what "authorised" means. If you install one of my non-malicious FOSS packages, does that automatically authorise me on your systems? If not, then I'm clearly already in trouble for doing an "unauthorised act in relation to a computer". Who authorised me? Who decides if I am unauthorised? How do I know it's unauthorized, as required by (b), when I don't even know you installed it? My likely naive belief is that when you get a software package from me - one which disclaims even usability of purpose, and which disclaims all liability for damages, to the fullest extent allowed by law - then you are responsible for vetting the software and authorising its use on your system. If the documentation says "doing X will wipe your home directory", and you do X, then you've authorised that action, yes?
- seanhunter 3y ago
  That’s not what authorised means and I think know that and are just being deliberately obtuse. If I install your package I would need to be authorised not you. But as I say if you deliberately put something in your software package intended to cause damage you can’t disclaim liability for that. That’s exactly the same as if you write any other piece of malware and it gets installed on my computer you are responsible for the damage it causes. I’m not going to respond futher on this thread now.
  - eesmith 3y ago
    I was pointing out that the law you pointed to specifically requires that "the person does any unauthorised act in relation to a computer". My comment was to highlight that discussion of "authorised" does not make sense, strongly suggesting the specific law you mentioned was not relevant. You give an example saying that I can't disclaim liability for software which deliberately causes damage. That may be true, but what law am I breaking? Can I distribute an "rm" tool which will let you do "rm -f /"? Can I disclaim damages for using that tool? I really hope so! Your "it gets installed" is doing a lot of heavy lifting. Who installed it? You? Why did you install it? Did you read the documentation to learn about any changes? What counts as sufficient notice for the potential of causing damage? But back to the chilling effect - if I did NOT deliberately put something in your software package intended to cause damage, but a company thinks I did, must I go through a lengthy and expensive lawsuit, or can I point to the lack of warranty, etc. and have the suit dropped? Because if I can't easily get the suit dropped, then a company can use the threat of a lawsuit to get me to make changes to the code, eg, to "fix" the code they think I maliciously added.

eadmund 3y ago

> What you wrote puts a shiver down my spine. If I can't disclaim any sort of warranty, and my FOSS has a bug which a company incorrectly thinks is nefarious code, what defense do I have should that company decide to sue me? I am not a lawyer, you are not my client and this is not legal advice. My layman’s understanding is that it is not possible to disclaim liability for malicious action which harms another. If someone believes that you have maliciously harmed him, then he may try to recover damages from you for doing so — this is independent of software (he could do the same if you broke his leg). > And now you suggest it might be otherwise, and I might end up paying a lot in lawyer and court costs over years? Yup. The mechanism for sorting out claims of truth and liability is court, and wise plaintiffs and defendants engage lawyers. Unfortunately, this can be expensive, and in some cases the process is the punishment: one might be exonerated, but only after years and years of litigation and worry. I imagine that generally a potential plaintiff’s lawyers would advise him that absent clear evidence of malice that he is unlikely to win, and would be wasting his money. Particularly if you have no real assets, the game is not likely to be worth the candle. But if he is rich or foolish, he might waste it anyway.

eesmith 3y ago
> for malicious action which harms another Here's are things a lawyer might be able to answer. What specifically is my action that I am legally responsible for? I did not install my software on your machine - you did that. And I explicitly warned you not to trust it. Yet some reason you decided not only to trust that code base, but to keep trusting me in the future enough to auto-update, likely without even telling me. What makes it malicious? I can sell you a tool to re-format your hard disk. That is not malicious, because I described it that way. So how well do I need to document some "malicious" feature before it's no longer legally malicious? And, if I sell my company to another company, who then carries out these actions, is it my responsibility? Are these criminal liabilities, or civil? What is the relevant law? What is the maximum penalty? > Yup. The mechanism for sorting out claims of truth and liability is court Sure. But clearly invalid cases can get summary judgement for far less than taking the whole thing to trial, and I've been judging my risk based on the former overriding any of my users' claims of malicious intent. This doesn't seem like a topic that can go any further without an appropriate lawyer involved.