Provided without warranty. Period. If an entity has the capital to be in the business of using software to manage goods and services in the public space where

Provided without warranty. Period. If an entity has the capital to be in the business of using software to manage goods and services in the public space where failure to follow industry practices can result in harm to property, assets, or people then they should be liable. Breached customer data because the company used an open source library they didn’t vet before hand? That’s too bad. It happens. Maybe take more care to assess dependencies instead of assuming you can throw the cost of such failures on customers. Don’t want to vet the software? Write it yourself. I think a good deal of this could be worked out if Software Engineer was a more broadly protected term. Software Engineers, like their trad engineer cousins, should be liable. Companies should be forced to have one on staff or retainer to sign off on their projects. It’s not a perfect system but it works in ways we understand well from experience in other disciplines (and we have some experience with its failure modes). Not every software developer needs to be an engineer in order to work. I believe that having this level of professionalism would change the incentives in the marketplace towards better behaviours. Right now it’s all based on class action suits that end up just being the cost of business. If a company doesn’t do well by their engineers they’ll find themselves out of business or having a hard time hiring. But open source developers? Nope. No warranty is no warranty. You need to vet your sources and get insurance.