3 ms·

Firstly I'm not any kind of lawyer and could be wrong. I was giving you my understanding. Secondly I said you can't disclaim liability for willful actions. If

Firstly I'm not any kind of lawyer and could be wrong. I was giving you my understanding. Secondly I said you can't disclaim liability for willful actions. If you do something by mistake or it's an unintentional side-effect of course you can disclaim liability. If you do something on purpose you can't say you weren't responsible for harm you caused because you put a disclaimer in somewhere. Yes some of these sorts of things have been taken to court. In the UK where I am they are typically prosecuted under the Computer Misuse act[1] but many countries have similar legislation. See the bit about a person being guilty of an offense if "the person intends by doing the act to cause serious damage of a material kind or is reckless as to whether such damage is caused.". There is specific UK guidance from the prosecution service that DDos is covered[2] Secondly Extradition doesn't require the conduct to be a crime in both countries. It requires it to be a crime in the country requesting extradition, there to be an extradition treaty between the two countries, and the conduct and request to meet the standard for extradition in the country where you are. That doesn't necessarily mean a crime in the place you are. It also means the evidence doesn't necessarily need to be at the standard that would be required where you are. So in the UK for example you can be extradited to the US if the US show "Probable cause" (the US standard) that you committed an offense in the US because the extradition treaty says that's equivalent to the standard that would be required to get a warrant for your arrest in the UK. I didn't say anything about the code being hidden - it would depend on the legislation but as you can see from the sources I posted, the important standard in the UK is that it was intended to cause harm or that you were reckless as to whether or not it could cause harm, not anything to do with being hidden. If you did hide it, that would probable help to show that it was intentional rather than an error though. In that legislation the max sentence for that part is 14 years or life if you cause harm to critical national infrastructure. [1] https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA [2] https://www.cps.gov.uk/legal-guidance/computer-misuse-act https://www.cps.gov.uk/legal-guidance/computer-misuse-act and DPP vs Lennon

eesmith 3y ago
Clearly I am not a lawyer, and my understanding of extradition faulty. I'll have to increase my bribe rate enough to get a lawyer involved. Wikipedia tells me that Namibia has no extradition treaty with the US... I looked at [1], and I think it comes down to what "authorised" means. If you install one of my non-malicious FOSS packages, does that automatically authorise me on your systems? If not, then I'm clearly already in trouble for doing an "unauthorised act in relation to a computer". Who authorised me? Who decides if I am unauthorised? How do I know it's unauthorized, as required by (b), when I don't even know you installed it? My likely naive belief is that when you get a software package from me - one which disclaims even usability of purpose, and which disclaims all liability for damages, to the fullest extent allowed by law - then you are responsible for vetting the software and authorising its use on your system. If the documentation says "doing X will wipe your home directory", and you do X, then you've authorised that action, yes?
- seanhunter 3y ago
  That’s not what authorised means and I think know that and are just being deliberately obtuse. If I install your package I would need to be authorised not you. But as I say if you deliberately put something in your software package intended to cause damage you can’t disclaim liability for that. That’s exactly the same as if you write any other piece of malware and it gets installed on my computer you are responsible for the damage it causes. I’m not going to respond futher on this thread now.
  - eesmith 3y ago
    I was pointing out that the law you pointed to specifically requires that "the person does any unauthorised act in relation to a computer". My comment was to highlight that discussion of "authorised" does not make sense, strongly suggesting the specific law you mentioned was not relevant. You give an example saying that I can't disclaim liability for software which deliberately causes damage. That may be true, but what law am I breaking? Can I distribute an "rm" tool which will let you do "rm -f /"? Can I disclaim damages for using that tool? I really hope so! Your "it gets installed" is doing a lot of heavy lifting. Who installed it? You? Why did you install it? Did you read the documentation to learn about any changes? What counts as sufficient notice for the potential of causing damage? But back to the chilling effect - if I did NOT deliberately put something in your software package intended to cause damage, but a company thinks I did, must I go through a lengthy and expensive lawsuit, or can I point to the lack of warranty, etc. and have the suit dropped? Because if I can't easily get the suit dropped, then a company can use the threat of a lawsuit to get me to make changes to the code, eg, to "fix" the code they think I maliciously added.

eesmith 3y ago

Clearly I am not a lawyer, and my understanding of extradition faulty. I'll have to increase my bribe rate enough to get a lawyer involved. Wikipedia tells me that Namibia has no extradition treaty with the US... I looked at [1], and I think it comes down to what "authorised" means. If you install one of my non-malicious FOSS packages, does that automatically authorise me on your systems? If not, then I'm clearly already in trouble for doing an "unauthorised act in relation to a computer". Who authorised me? Who decides if I am unauthorised? How do I know it's unauthorized, as required by (b), when I don't even know you installed it? My likely naive belief is that when you get a software package from me - one which disclaims even usability of purpose, and which disclaims all liability for damages, to the fullest extent allowed by law - then you are responsible for vetting the software and authorising its use on your system. If the documentation says "doing X will wipe your home directory", and you do X, then you've authorised that action, yes?

seanhunter 3y ago
That’s not what authorised means and I think know that and are just being deliberately obtuse. If I install your package I would need to be authorised not you. But as I say if you deliberately put something in your software package intended to cause damage you can’t disclaim liability for that. That’s exactly the same as if you write any other piece of malware and it gets installed on my computer you are responsible for the damage it causes. I’m not going to respond futher on this thread now.
- eesmith 3y ago
  I was pointing out that the law you pointed to specifically requires that "the person does any unauthorised act in relation to a computer". My comment was to highlight that discussion of "authorised" does not make sense, strongly suggesting the specific law you mentioned was not relevant. You give an example saying that I can't disclaim liability for software which deliberately causes damage. That may be true, but what law am I breaking? Can I distribute an "rm" tool which will let you do "rm -f /"? Can I disclaim damages for using that tool? I really hope so! Your "it gets installed" is doing a lot of heavy lifting. Who installed it? You? Why did you install it? Did you read the documentation to learn about any changes? What counts as sufficient notice for the potential of causing damage? But back to the chilling effect - if I did NOT deliberately put something in your software package intended to cause damage, but a company thinks I did, must I go through a lengthy and expensive lawsuit, or can I point to the lack of warranty, etc. and have the suit dropped? Because if I can't easily get the suit dropped, then a company can use the threat of a lawsuit to get me to make changes to the code, eg, to "fix" the code they think I maliciously added.