5 ms·

None whatsoever, their contracts with customers will limit liability to the price paid for the software/subscription. If there was open-ended liability for sof

by rwmj 2y ago

None whatsoever, their contracts with customers will limit liability to the price paid for the software/subscription. If there was open-ended liability for software failures then very little software would get written.

account42 2y ago
This is an insane take. Do you think other industries get away with limiting their liability to the product cost? No, because that doesn't provide adequate incentives for making a safe product. The amount of software that gets written depends mostly on the demand for that software. Even if Micrososft would not be willing to up their game to make the risk viable then someone else would.
- rwmj 2y ago
  The thing is we know how to make (eg) food that is safe or to a lesser extent bridges that don't fall down. If you sell food that makes people sick you should have known how to avoid that and so you can be held liable. We don't have a good idea how to make software that is flawless, at least, not at scale for a cost that is acceptable. This is changing a little bit now with the drive by governments to use memory-safe languages, but that only covers a small part of the possible spectrum of bugs in software and hardware.
  - Manfred 2y ago
    Nothing is without flaws, it's about limiting risk to an acceptable amount. Critical software should be held against higher standards.
    - rwmj 2y ago
      What's "critical software"? Software controlling flight systems in planes is already held to very high standards, but is enormously expensive to write and modify. In this case it seems most of the software which is failing is dull back office stuff running on Windows - billing systems, train signage, baggage handling - which no one thought was critical, and there's no way on earth we could afford to rewrite it in the same way as we do aircraft systems.
      - Manfred 2y ago
        I meant critical software a short-hand for something like: quality of software should be proportional to the amount of disruption caused by downtime. Point of sale in a records store, less important. Point of sale in a pharmacy, could be problematic. Web shop customer call center, less important. Emergency services call center, could be problematic.
        burnished 2y ago
        What you're describing is a system where the degree of acceptable failure is determined after the software becomes a product because it is being determined by how important the buyer is. That is backwards and unworkable.
        kuboble 2y ago
        I think the system is rather a one where if you offer critical services then you're not allowed to use a software that hasn't been developed up to a particular high standard. So if you develop your compression library it can't be used by anyone running critical infra unless you stamp it "critical certified", which in turn will make you liable for some quality issues with your software.
        regularfry 2y ago
        It isn't, though. "You may not sell into a situation that creates an unacceptable hazard" is essentially how hazardous chemical sale is regulated, and that's just the first example that I could find. It's not uncommon for a seller to have to qualify a buyer.
        Manfred 2y ago
        I assume you mean "if the buyer will use the software in critical systems." That's very realistic and already happens by requiring certain standards from the resulting product. For example, there are security standards and auditing requirements for medical systems, payment systems, cars, planes, etc.
        Quekid5 2y ago
  - llm_trw 2y ago
    We don't know how to make general software safe, but we do know how to make any one piece of software safe. If you're software is going to be used as infrastructure then it should be held to the same standards. If you don't want it to be treated as infrastructure don't sell it to hospitals.
    - burnished 2y ago
      Mixing up the responsibility, in your world hospitals shouldn't purchase it.
      - account42 2y ago
        Responsibility can be shared.
- deleted 2y ago
  [deleted]
Reason077 2y ago
It doesn’t really matter what the contract says. Laws take precedence over contracts. For example, Boeing’s liability for 737 airliners that crash due to faulty software certainly isn’t limited to the price of the planes.
- YeBanKo 2y ago
  But only $243.6M for fraud, which caused death of 346 people.
anigbrowl 2y ago
Crowdstrike's stock closed at $343 yesterday, I imagine that and MSFT are going to be cratering later this morning.
- dist-epoch 2y ago
  MSFT will be fine. They are riding the AI waves, this is not meaningful, especially since they are not at fault.
  - Cthulhu_ 2y ago
    It may not be their fault directly but it is causing Windows systems to bluescreen, which IS their fault and their responsibility, ultimately.
    - hulitu 2y ago
      Windows blue screen was never Microsoft's responsibility. /s
    - echoangle 2y ago
      How is it their fault and responsibility? Isn’t falcon sensor basically running like a kernel module? Does it mean that Windows is not engineered properly when it can be crashed by this?
    - wwtrv 2y ago
      Are you saying that they should prevent or limit the ability of their users from installing third party software? Or at the very least prevent it from running in kernel mode?
      - rocqua 2y ago
        A more reasonable claim would be that microsoft should have a way to allow virus-scanners to run without needing to be able to crash the kernel. That isn't an easy thing to do, but it should be possible.
ssss11 2y ago
That’s what the license agreement says. Wait till every man and his dog sues them.
beejiu 2y ago
Caveat to this: In the UK and many other countries, you cannot limit liabilities that cause death or personal injury arising from negligence.
- Cthulhu_ 2y ago
  Yeah but if it's a hospital, they should be able to operate without these IT systems. Nothing critical / life-or-death / personal injury should rely on Windows / IT systems.
  - SuperNinKenDo 2y ago
    Why? Because you simply wish it to be so?
    - Y_Y 2y ago
      Because it's evidently a bad idea and there are reasonable alternatives.
      - cqqxo4zV46cp 2y ago
        That’s easy for you to say, with the benefit of recency bias, and with presumably zero experience in running a hospital.
        throwaway3306a 2y ago
        That's not about experience, that's about following the regulated standards. This is well known ever since technology (not computers) got into hospitals.
        bdd8f1df777b 2y ago
        None of the points you mention detracts from the correctness of his/her statement.
      - SuperNinKenDo 2y ago
citrin_ru 2y ago
Yes, software industry as we know would not exists if companies where held liable for all damages. But in the current state of affairs they have little incentive to improve software quality - when incident like this happens they can suffer an insignificant short term valuation loss but unless it happens too often they can continue businesses as usual. Many companies paying lip service to quality/reliability but internal incentives almost always go against maintenance and quality of service work (and instead reward new projects, features e. t. c.).
- josephg 2y ago
  > Yes, software industry as we know would not exists if companies where held liable for all damages. Of course it would. Restaurants are held liable for food poisoning, but they still operate just fine. They just - y’know - take care that they don’t poison their customers. If computer systems were held liable, software would be a lot more expensive. There would be less of it. And it would also be better. I think I can get behind that future.
  - butlike 2y ago
    I like that future too, but to play devil's advocate: Write me software that coordinates all flights to and from airports, capturing all edge-cases, that's bug free. Then tell me the number you estimate and the number of years to roll this out.
    - josephg 2y ago
      Sure, but ... thats not a spec. Specs have clear goals and limited scope. "All flights from all airports forever" is impossible to program, full stop. The right way to write code like that is to start simple and small - we're going to service airports X, Y and Z. Those airports handle Q planes per day. The software will be used by (this user group) and have (some set of responsibilities). The software engineers will work with the teams on the ground during and after deployment to make sure the software is fit for purpose. Someone will sign off on using it and trusting its decisions. And lets also do a risk assessment where we lay out all the ways defects in the software could cost money and lives, so we can figure out how risk averse we need to be. Give me scope like that, and sure - I'll put a team together to write that code. It'll be expensive, but not impossible. And once its working well, I'd happily roll it out to more airports in a controlled and predictable manner.
0x1ceb00da 2y ago
From windows tos: Disclaimer. Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. Microsoft and the devicemanufacturer and installerexclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement. If your local law does not allow the exclusion of implied warranties, then any implied warranties, guarantees, or conditions last only during the term of the limited warranty and are limited as much as your local law allows. If your local law requires a longer limited warranty term, despite this agreement, then that longer term will apply, but you can recover only the remedies this agreement allows.
- moffkalast 2y ago
  "We give you no guarantees, unless the local law says we have to give them to you, in which case we do." So they might get sued on a local level?

by rwmj 2y ago

account42 2y ago

This is an insane take. Do you think other industries get away with limiting their liability to the product cost? No, because that doesn't provide adequate incentives for making a safe product. The amount of software that gets written depends mostly on the demand for that software. Even if Micrososft would not be willing to up their game to make the risk viable then someone else would.

rwmj 2y ago
The thing is we know how to make (eg) food that is safe or to a lesser extent bridges that don't fall down. If you sell food that makes people sick you should have known how to avoid that and so you can be held liable. We don't have a good idea how to make software that is flawless, at least, not at scale for a cost that is acceptable. This is changing a little bit now with the drive by governments to use memory-safe languages, but that only covers a small part of the possible spectrum of bugs in software and hardware.
- Manfred 2y ago
  Nothing is without flaws, it's about limiting risk to an acceptable amount. Critical software should be held against higher standards.
  - rwmj 2y ago
    What's "critical software"? Software controlling flight systems in planes is already held to very high standards, but is enormously expensive to write and modify. In this case it seems most of the software which is failing is dull back office stuff running on Windows - billing systems, train signage, baggage handling - which no one thought was critical, and there's no way on earth we could afford to rewrite it in the same way as we do aircraft systems.
    - Manfred 2y ago
      I meant critical software a short-hand for something like: quality of software should be proportional to the amount of disruption caused by downtime. Point of sale in a records store, less important. Point of sale in a pharmacy, could be problematic. Web shop customer call center, less important. Emergency services call center, could be problematic.
      - burnished 2y ago
        What you're describing is a system where the degree of acceptable failure is determined after the software becomes a product because it is being determined by how important the buyer is. That is backwards and unworkable.
        kuboble 2y ago
        I think the system is rather a one where if you offer critical services then you're not allowed to use a software that hasn't been developed up to a particular high standard. So if you develop your compression library it can't be used by anyone running critical infra unless you stamp it "critical certified", which in turn will make you liable for some quality issues with your software.
        regularfry 2y ago
        It isn't, though. "You may not sell into a situation that creates an unacceptable hazard" is essentially how hazardous chemical sale is regulated, and that's just the first example that I could find. It's not uncommon for a seller to have to qualify a buyer.
        Manfred 2y ago
        I assume you mean "if the buyer will use the software in critical systems." That's very realistic and already happens by requiring certain standards from the resulting product. For example, there are security standards and auditing requirements for medical systems, payment systems, cars, planes, etc.
      - Quekid5 2y ago
- llm_trw 2y ago
  We don't know how to make general software safe, but we do know how to make any one piece of software safe. If you're software is going to be used as infrastructure then it should be held to the same standards. If you don't want it to be treated as infrastructure don't sell it to hospitals.
  - burnished 2y ago
    Mixing up the responsibility, in your world hospitals shouldn't purchase it.
    - account42 2y ago
      Responsibility can be shared.
deleted 2y ago
[deleted]

Reason077 2y ago

It doesn’t really matter what the contract says. Laws take precedence over contracts. For example, Boeing’s liability for 737 airliners that crash due to faulty software certainly isn’t limited to the price of the planes.

YeBanKo 2y ago
But only $243.6M for fraud, which caused death of 346 people.

anigbrowl 2y ago

Crowdstrike's stock closed at $343 yesterday, I imagine that and MSFT are going to be cratering later this morning.

dist-epoch 2y ago
MSFT will be fine. They are riding the AI waves, this is not meaningful, especially since they are not at fault.
- Cthulhu_ 2y ago
  It may not be their fault directly but it is causing Windows systems to bluescreen, which IS their fault and their responsibility, ultimately.
  - hulitu 2y ago
    Windows blue screen was never Microsoft's responsibility. /s
  - echoangle 2y ago
    How is it their fault and responsibility? Isn’t falcon sensor basically running like a kernel module? Does it mean that Windows is not engineered properly when it can be crashed by this?
  - wwtrv 2y ago
    Are you saying that they should prevent or limit the ability of their users from installing third party software? Or at the very least prevent it from running in kernel mode?
    - rocqua 2y ago
      A more reasonable claim would be that microsoft should have a way to allow virus-scanners to run without needing to be able to crash the kernel. That isn't an easy thing to do, but it should be possible.

ssss11 2y ago

That’s what the license agreement says. Wait till every man and his dog sues them.

beejiu 2y ago

Caveat to this: In the UK and many other countries, you cannot limit liabilities that cause death or personal injury arising from negligence.

Cthulhu_ 2y ago
Yeah but if it's a hospital, they should be able to operate without these IT systems. Nothing critical / life-or-death / personal injury should rely on Windows / IT systems.
- SuperNinKenDo 2y ago
  Why? Because you simply wish it to be so?
  - Y_Y 2y ago
    Because it's evidently a bad idea and there are reasonable alternatives.
    - cqqxo4zV46cp 2y ago
      That’s easy for you to say, with the benefit of recency bias, and with presumably zero experience in running a hospital.
      - throwaway3306a 2y ago
        That's not about experience, that's about following the regulated standards. This is well known ever since technology (not computers) got into hospitals.
      - bdd8f1df777b 2y ago
        None of the points you mention detracts from the correctness of his/her statement.
    - SuperNinKenDo 2y ago

citrin_ru 2y ago

Yes, software industry as we know would not exists if companies where held liable for all damages. But in the current state of affairs they have little incentive to improve software quality - when incident like this happens they can suffer an insignificant short term valuation loss but unless it happens too often they can continue businesses as usual. Many companies paying lip service to quality/reliability but internal incentives almost always go against maintenance and quality of service work (and instead reward new projects, features e. t. c.).

josephg 2y ago
> Yes, software industry as we know would not exists if companies where held liable for all damages. Of course it would. Restaurants are held liable for food poisoning, but they still operate just fine. They just - y’know - take care that they don’t poison their customers. If computer systems were held liable, software would be a lot more expensive. There would be less of it. And it would also be better. I think I can get behind that future.
- butlike 2y ago
  I like that future too, but to play devil's advocate: Write me software that coordinates all flights to and from airports, capturing all edge-cases, that's bug free. Then tell me the number you estimate and the number of years to roll this out.
  - josephg 2y ago
    Sure, but ... thats not a spec. Specs have clear goals and limited scope. "All flights from all airports forever" is impossible to program, full stop. The right way to write code like that is to start simple and small - we're going to service airports X, Y and Z. Those airports handle Q planes per day. The software will be used by (this user group) and have (some set of responsibilities). The software engineers will work with the teams on the ground during and after deployment to make sure the software is fit for purpose. Someone will sign off on using it and trusting its decisions. And lets also do a risk assessment where we lay out all the ways defects in the software could cost money and lives, so we can figure out how risk averse we need to be. Give me scope like that, and sure - I'll put a team together to write that code. It'll be expensive, but not impossible. And once its working well, I'd happily roll it out to more airports in a controlled and predictable manner.

0x1ceb00da 2y ago

From windows tos: Disclaimer. Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. Microsoft and the devicemanufacturer and installerexclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement. If your local law does not allow the exclusion of implied warranties, then any implied warranties, guarantees, or conditions last only during the term of the limited warranty and are limited as much as your local law allows. If your local law requires a longer limited warranty term, despite this agreement, then that longer term will apply, but you can recover only the remedies this agreement allows.

moffkalast 2y ago
"We give you no guarantees, unless the local law says we have to give them to you, in which case we do." So they might get sued on a local level?