6 ms·

I find this article and the reactions here confusing. This seems to me like unequivocally a good thing for open-source devs. Making commercial vendors who rely

• omnicognate 3y ago
  The article is misleading unless you read the whole thing and the reactions are standard knee-jerk ones from HN users that didn't need to read past "EU" to assume the worst possible misinterpretation.
  • withinboredom 3y ago
    I read the article, but it was quite ambiguous, at least to me. It isn't very well written / clear on what is actually going on.
    • omnicognate 3y ago
      I agree it's very ambiguous, but if you read the whole thing it's clear that when dev A releases code under an open source license and it's included in a commercial product by company B that then harms person C, the liability will be on company B. Most of the hot-under-the-collar responses here are assuming it will fall on dev A, which is a misinterpretation the article's author did not do much to discourage.
      • sevagh 3y ago
        Actually, I may have missed buried lede in this case where there is no company B, and citizen C is harmed by dev A's github project. That is actually kinda concerning, if my MIT license of "no guarantee" won't protect me. Other commenters who got it: https://news.ycombinator.com/item?id=38808821 https://news.ycombinator.com/item?id=38808821 https://news.ycombinator.com/item?id=38808756 https://news.ycombinator.com/item?id=38808756
        • fipar 3y ago
          That is concerning, but I think the author’s interpretation of the upcoming regulation may be wrong. See here for example: https://www.euractiv.com/section/digital/news/eu-updates-product-liability-regime-to-include-software-artificial-intelligence/ https://www.euractiv.com/section/digital/news/eu-updates-pro... Specifically: “The Directive will not apply to free and open-source software developed or supplied outside a commercial activity. The liability rules apply when the software is supplied in exchange for a price or personal data used for anything other than improving the software’s security or compatibility.” IMHO the original article is either wrong or trying to spread FUD. My take is, if this law passes, I’m an EU citizen, and I use your MIT software without paying you and without engaging with it through some service of yours (e.g. sevaghbook.com) then you’re not liable if I get damaged.
          • dqv 3y ago
            Why none of these articles (neither TFA nor the one you're linking) link to the actual directive is beyond me. But here it is: https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/739341/EPRS_BRI(2023)739341_EN.pdf https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/7393... > With the aim of not hampering innovation: (i) free and open-source software developed or supplied outside the course of commercial activity, as well as (ii) the source code of software, should be excluded from the definition of products covered under the proposal.
            • fipar 3y ago
              Thanks for linking to the actual directive! In light of it, I think the article I found didn’t link to it out of sloppiness, because their summary seems reasonably accurate to me, and the fine article didn’t link to it because they want to spread FUD, as the text you quoted directly contradicts some of the fear mongering in the original article.
            • eggsboenk 3y ago
              Still not clear for me. What about a company open sourcing some libraries used in its product. Will it be liable? Or would this be 'supplied outside the course of commercial activity'
      • MauranKilom 3y ago
        That completely ignores the second half of the article. I agree that it's confusing why the article goes into so much depth on "companies are now liable, similar to how everyone expects" in the first half when the main talking point is/should be "open source devs are now liable if consumers use their software directly" (as discussed in the second half).
        • tesdinger 3y ago
          Most commenters here only read the first half it seems, I expected more of the hn audience.
  • sevagh 3y ago
    Yes, the author of the article is all over the place >But what if you’re just part of a collaborative open source project, give away your app, or if there’s open source code in the product you put on the market? Who gets blamed when open source might be the heart of the problem? Every other sentence is dripping in "sympathy for open-source creators", but buried in the subtext is "sympathy for the innocent commercial vendors who decided to rely on open-source projects." >So, how is open-source software implicated? If a commercial software product causes harm, whoever put the software on the market will soon be strictly liable. Good! >You will need to prove that your code wasn’t to blame to escape the costs. But what if you’ve embedded open-source code, used open-source tools, or called open-source APIs? Under the pending rules, you’d be liable for any errors in those sources as well, regardless of whether you directly contributed or not. Better! Now a big evil company _can't_ pass the buck to the unpaid hobby project creator!
    • curt15 3y ago
      So can we expect popular yet understaffed open source software -- like OpenSSL -- to get a lot of paid code review or patches?
      • mistrial9 3y ago
        expect new, certified companies with security and finance, to become the officially required caretakers along with many fees; expect new monetized systems to distribute security patches passed through new bureaucracies, with logging of the government ID of all recipients; expect the restriction of new security patches to authorized users only.
    • MaxBarraclough 3y ago
      The end of that paragraph continues in the same line: > Worse still, how will you in turn identify or sue the collaborator or collaboration that actually wrote the faulty open-source code to recoup your costs? In that case, the license you signed likely insulates your open-source partners from your claims. I sincerely hope this will never become a possibility. The chilling effect would presumably be catastrophic for Free and Open Source software in the relevant legal jurisdiction. Why would anyone voluntarily release their code as FOSS if it opens them up to lawsuits?
  • notfed 3y ago
    Are we reading the same article? The final paragraph even says: > My prediction, for what it’s worth, is that open source’s days outside academia and hobbyists are numbered.
  • tracerbulletx 3y ago
    The article literally ends in bold with "Someone, or some entity, will need to accept financial and legal responsibility for what the project does in consumer hands. No license can insulate them from that. " If people are having a fearful reaction to the article it's the authors fault.
• kragen 3y ago
  i think the article is deliberately written to be confusing
  • hutzlibu 3y ago
    Maybe, but maybe the legislation also is: "What if an open source project is used directly by consumers, and causes them harm? The public policy is clear: they must be compensated. Does it matter if they signed a license or didn’t pay someone? Their business is bankrupt, their files are in a hacker’s hands, or their own customers are suing them. Someone should be strictly liable. But who? The EU is grappling with that very question, and it culminates in whether “open source” is exempt from liability in a law designed to protect consumers. So far the answer is “probably not?” Exemption means consumers bear the cost – exactly what the law is trying to change. Perhaps if the open source in question remains an academic or research tool, versus reaching consumers, we’re okay? The proof may come when the first consumer demands compensation, and the courts step in. But lawmakers know enough to realize that much of the open source out there – by definition – belongs to no one, or many someones, or really nobody that can be named and made liable. So waiting on a court case might provide clarity but no compensation and no one to even argue the case. Not the clarity a law is designed to provide." But I rather think that no, the law just talks about products where you pay money for. And when I pay money for something, I do expect liablity in some way and this is allright. But it is not allright to mix them both up for politicial support (or whatever the motivation here is).
    • orwin 3y ago
      > But I rather think that no, the law just talks about products where you pay money for. Ianal but my intuition is that you're on point.
    • mlinksva 3y ago
      The CRA is not about liability or consumer compensation. The remedies for non-compliance are fines or removal of a product from the EU market. The forthcoming update of the Product Liability Directive, which will probably take a similar approach (exempting open source unless it is placed on the market, so as the article describes, developers of products that are placed on the market are responsible for the security of their products, including open source incorporated in said product) on the other hand is. I only skimmed the OP and doubt it's intentionally confusing, but it is confusing because its prediction of doom is wacky. Manufacturers (eg developers of IoT devices, the insecurity of a major impetus for the legislation, apps, etc) will need to adopt modern development practices such as updating their dependencies when a vulnerability is known -- and that includes manufacturers that wrap a mostly open source codebase in a final product or monetise an open source codebase in various ways called out in the legislation. Yes if a consumer is harmed by a completely open source thing not placed on the market, say something in Debian, they will not be able to sue the developers, and the developers aren't subject to fines etc under the CRA. That's the balance intended by the legislation (after lots of attempts to get it right), to not wreck incentives to develop open source, but to make product developers more responsible. In other words, the public policy is not exactly as you state it. :)
• rebeccaskinner 3y ago
  I think that this part of it could break either way, but the concern is that when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. If so, that would be a net harm to open source and user freedom. I'm not sure it'll happen, but it might. The biggest issue I see with this law is around liability for open source projects that people are using directly. It'll be disastrous if all open source software ceases to exist or be available in Europe because volunteers face legal liability if their code has a bug. In theory this could even impact people outside of Europe if they don't prohibit access to their code by EU citizens. I release a lot of code on github. Most of it is just random crap that I wrote to solve a specific need or to explore an idea, and I put it up under an open source license because why not? If it helps someone, that's great. Now I need to be concerned that the random "example-service" project I wrote in C and published a decade ago to go with a blog post I wrote will end up costing me all the money I have ever or will ever earn in my career.
  • lifeisstillgood 3y ago
    >>> when faced with a choice between being liable for their own code or being liable for open source code, most companies will choose to write their own code. Not even FAANG can achieve this for 1/10th of the code they rely on.
    • flir 3y ago
      Hmm. They can probably find other companies willing to sell them support contracts, and take on that liability. Even for things that are open source. You're back to the old enterprise software model then, really, even if the code in question is "officially" open source. You won't be able to run versions that your supplier hasn't certified, and the rate of change will slow to a crawl.
      • Aerbil313 3y ago
        > You won't be able to run versions that your supplier hasn't certified, and the rate of change will slow to a crawl. Interesting times indeed. Though I think open source software generally is reliable enough that companies will simply continue business as usual and take on all the liability. They have enough deep pockets to pay compensation that one time something goes wrong, or at least that's my impression.
• golol 3y ago
  Very bizarre, the implication is literally reversed in the analysis of the problem versus the actual problem.
• deleted 3y ago
  [deleted]
• zoogeny 3y ago
  > This seems to me like unequivocally a good thing for open-source devs. I'm not certain the second order (or later) effects will necessarily be unequivocally good. Software supply chains are more like a double pendulum in that changes are probably chaotic enough to obscure their effects. For example, my very first thought was that large businesses are generally risk adverse specifically in the realm of liability. Have you ever read a TOS? It feels to me the major elements of that interminable document are statements that limit liability. It is to the point of humor that we engage in the clicking through the "I accept" of a software license like some strange universal ritual. This is the realm we are dealing in here, deep and arcane. The ubiquitous TOS ritual should remind us all that software is beholden to forces outside of itself. Companies go through insane effort to avoid legal liability. This law is going to change that calculus. If the cost of covering that change is high this could precipitate a change to closed-sourced alternatives that come with some delegation of liability. For the cynically minded, companies that offer equivalents to OSS that come with a liability waver might see an ascendance and potentially offer a good investment opportunity. Alternatively, repackaging existing OSS as a commercial product while only adding some legal liability as an add-on might become a viable business. Those considerations challenge any argument towards unequivocally stating this is a good thing, even if there are definitely positive aspects to this change.
  • mistrial9 3y ago
    > Alternatively, repackaging existing OSS as a commercial product while only adding some legal liability as an add-on might become a viable business. bingo
    • jahav 3y ago
      It's called tidelift.com
      • mistrial9 3y ago
        this looks interesting https://www.bestpractices.dev/en https://www.bestpractices.dev/en ... from a longer transcript here https://www.infoq.com/presentations/security-supply-chain-oss/ https://www.infoq.com/presentations/security-supply-chain-os...
• grumps 3y ago
  How in the world is this good for devs? It's terrible. Do you really think that "big corp" will not figure out how to pass the liability directly to the author? What will happen the opensource world once you're held liable for some moron who uses some software I wrote for myself? or incorrectly uses it? do you really believe the curl should be held liable because some POST failed and a user lost something over it? what about my old backup scripts? I need to remove them from my repos?
  • moses-palmer 3y ago
    I read the article twice, because the link title made me think that I as an open source contributor and publisher liable for complaints. My reading of the text is that the one actually selling the software product is the one having to abide by this law. Am I incorrect? How could this be negative? I presume that most publishers of open source software would prefer that some Silicon Valley Unicorn did _not_ half-heartedly integrate their library, causing security issues and tainting their library name?
    • grumps 3y ago
      Because lawyers and courts become involved. They don't understand software or anything related to it.
  • ImmutiableTruth 3y ago
    [flagged]
• tesdinger 3y ago
  You failed to read and understand the article. Not only commercial vendors but also authors of open source software aimed at consumers , could be held liable. The courts would decide. > "whether “open source” is exempt from liability in a law designed to protect consumers. So far the answer is “probably not?” Exemption means consumers bear the cost – exactly what the law is trying to change. Perhaps if the open source in question remains an academic or research tool, versus reaching consumers, we’re okay? The proof may come when the first consumer demands compensation, and the courts step in.