7 ms·
The EU Throws a Hand Grenade on Software Liability
- com 2y agoIt’s really interesting how tech has had a lot of special exemptions from rules that apply to normal businesses, and how these are being rolled back slowly. On the face of it, having a product security obligation doesn’t seem too extreme, since most manufactured goods and service offerings operate under similar rules. I’m a bit worried that the “move fast, break things” mindset in SaaS startups isn’t going to be easy to change, and that, in the context of product liability, might have big impacts on future profitability and valuations too.
- sokoloff 2y agoDoes a (mechanical) door lock maker have liability when someone batters down the door? Or when someone’s key is left exposed and copied? It seems like some (most?) of the security vulnerabilities are analogous to things that physical goods manufacturers do not have liability for either.
- dartos 2y agoYeah, smart door locks are notoriously easy to break
- lukev 2y agoI mean, to use the same analogy: 1. A lock maker does not have liability if someone uses a battering ram on my door, or if I give a key to the wrong person. 2. A lock maker may certainly have liability if the lock has a design defect and can be readily opened without a key. I see no problem with holding software liable for the latter category and not the former, provided the liability is proportionate to the value being protected. Software makers have skated by with poor quality software for a long time, based mostly on the fact that users can't tell the difference. As the field gets more sophisticated and software is relied on for more and more important things, this needs to change.
- wrs 2y ago#2 isn’t, practically speaking, true. Ordinary hardware store door locks can be opened in a few seconds (using techniques like “bump keys”). Is that a “design defect” if every professional knows it to be true? Locks get security ratings based (partially) on how long it will take to open them without a key. Perhaps the lock analogy is good, but that means the eventual answer is that software will have security ratings like locks (on a sliding scale, not binary secure/insecure), and you’ll get what you pay for.
- lukev 2y agoWell, it's an analogy and that's where it breaks down, as all analogies do. A hardware store lock might protect a single shed, locker, or house. A software "lock" on a critical system is more equivalent in importance to the full physical security system surrounding a bank vault.
- wrs 2y agoThat’s why the lock analogy is good, though — not everything protected by software is like a bank vault. Door locks cost a lot less than vault locks, and as the customer I get to choose the appropriate level of security and pay accordingly. Right now as a software customer you don’t pay based on how secure you want the software to be, and the vendor isn’t liable for not meeting your expectations. In the end the customers are going to have to finance all this improved security, it won’t come for free.
- eqvinox 2y ago> It seems like some (most?) of the security vulnerabilities are analogous to things that physical goods manufacturers do not have liability for either. I don't think this is true — just shipping whatever junk you've piled together by some deadline has become frustratingly common. Also note the article has this to say: Software makers can avoid liability if they prove a defect was not discoverable given the “objective state of scientific and technical knowledge” at the time the product was put on the market.
- gruez 2y agoThat sounds like most bugs wouldn't be able to avoid liability? Most bugs are stuff like memory corruption or sql injection, and could be discovered if you looked hard enough
- eqvinox 2y agoYes and no — I think there'll be an expectation that you follow best practices and use the tools available. The legal system doesn't expect "mathematical" perfection in cases like this; if you can show that you worked diligently (kept up on tools, have a test suite, use static analyzers and sanitizers, etc.) I'm reasonably sure you'll be off the hook. If you can show that.
- Ekaros 2y agoAnd/or follow some industry standard in process and product. Even if that standard is less than perfect. Lot of documentation. It might not entirely make sense for your use case, but having the trail that you did things is often good enough.
- spwa4 2y agoAnd how will you get paid for doing that in perpetuity? Are they asking you to do this for free?
- whimsicalism 2y ago
- deleted 2y ago[deleted]
- pjmlp 2y agoNice to see, it is about time liabilities start be taking into account, specially if this is the only way to make software companies care about best practices.
- zaroth 2y agoWhat “best practices” are you even taking about. Point to one piece of bug free software that performs a useful task. I’ll wait.
- pjmlp 2y agoFor me, you can wait as long as you feel like waiting. Here is one example of best practices, "A consequence of this principle is that every occurrence of every subscript of every subscripted variable was on every occasion checked at run time against both the upper and the lower declared bounds of the array. Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to--they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980 language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law." -- C.A.R Hoare's "The 1980 ACM Turing Award Lecture" Law is finally catching up.
- keikobadthebad 2y agoHow does this apply to FOSS under a license that explicitly doesn't provide any warranty?
- carlosjobim 2y agoPut in a condition that Europeans are not allowed to use the code or the software in any way.
- arlcode 2y agoI am not a lawyer (very definitely not) and may have missed context and or other paragraphs but the directive says "(14) Free and open-source software, whereby the source code is openly shared and users can freely access, use, modify and redistribute the software or modified versions thereof, can contribute to research and innovation on the market. Such software is subject to licences that allow anyone the freedom to run, copy, distribute, study, change and improve the software. In order not to hamper innovation or research, this Directive should not apply to free and open-source software developed or supplied outside the course of a commercial activity, since products so developed or supplied are by definition not placed on the market. Developing or contributing to such software should not be understood as making it available on the market. Providing such software on open repositories should not be considered as making it available on the market, unless that occurs in the course of a commercial activity. In principle, the supply of free and open-source software by non-profit organisations should not be considered as taking place in a business-related context, unless such supply occurs in the course of a commercial activity. However, where software is supplied in exchange for a price, or for personal data used other than exclusively for improving the security, compatibility or interoperability of the software, and is therefore supplied in the course of a commercial activity, this Directive should apply" see also the following recitals. I think this sounds pretty sensible. If you want to build a business you are responsible for defects in your wares. If you are gifting software you not "selling".
- amelius 2y agoMaybe we will now see companies that will absorb the liability, e.g. reselling a FOSS package with a different license slapped on.
- whimsicalism 2y agoThe EU should be trying to move away from greater liability burden, as the US has also realized it is a mistake with its current litigation nightmare. It saddens me how poorly the bloc seems to be governed right now. It should basically be all hands on deck for capital markets formation. Tort reform is one of the major ways economists/prominent policymakers believe we could improve in the US, but of course the EU goes the exact opposite direction.
- hggigg 2y agoSomeone’s been reading a bit too much Ayn Rand
- whimsicalism 2y agoI am no fan of Ayn Rand at all. We have an obligation to help those worse off than us. Germany is now poorer on a per-capita basis than Mississippi, one of our most underinvested in regions. I am no libertarian at all. The EU has such great potential it saddens me to see the level of mismanagement currently ongoing. Of course, they are also facing larger exogenous problems right now.
- binoct 2y agoComparing across countries on US-Dollar-adjusted per-capita income is easy to calculate but a pretty tricky metric to get a lot of value from. Another easy metric to look at that adds a couple more dimensions is the Human Development Index. It includes per capita GNI as a third of its weight, but Germany gets a 0.95 and Mississippi a 0.858. And the GINI score (lower is less inequality) for Germany is roughly .3 and for Mississippi it’s close to .5. None of these high level economics stats really captures what is going on and how people live. Higher economic output isn’t strictly better, nor is lower inequality. You may be right - Germany as one of the main EU economies may be massively suffering due to EU mismanagement, but I think you need to provide different support for that argument.
- whimsicalism 2y ago
- zaroth 2y agoIf this actually becomes law, it instantly makes it too dangerous to bother for me to ever ship software into the EU again. Under this law, consumers can claim compensation for damages caused by defective products without having to prove the vendor was negligent or irresponsible. In addition to personal injury or property damages, for software products, damages may be awarded for the loss or destruction of data. Rather than define a minimum software development standard, the directive sets what we regard as the highest possible bar. Software makers can avoid liability if they prove a defect was not discoverable given the “objective state of scientific and technical knowledge” at the time the product was put on the market. Look the the liability standard they are pushing! Not willful negligence, not reasonable care, but rather it sounds more akin to “could the bug have even theoretically been prevented given perfect information and unlimited funds”. Yeah, no thanks, I’m human, so I won’t be accepting that level of liability for words I write into a text editor any time soon. And kinda mind boggling that anyone who knows anything about how software actually works wouldn’t see this as completely batshit insane. A more reasonable standard (malicious intent or reckless disregard for human safety would be a good starting point) would go a long way toward fixing this. This current standard would get any developer sued out of existence by armies of AI lawyers long before you can ship a patch when someone complains that your software divide by zero bug caused them “damages”. And get a load of this; Burden of proof: When the injured consumer is faced with excessive difficulties to prove the defectiveness of the product or the causal link between its defectiveness and the damage, a court may decide that the claimant is only required to prove the likelihood that the product was defective or that its defectiveness is a likely cause of the damage. There’s a reason why EU GDP has completed stagnated versus the US, and the EU tech sector is a virtual rounding error in the world… and this trash mentality is a big part of it. But wait, it gets worse… Circular economy: When a product is repaired and upgraded outside the original manufacturer’s control, the company or person that modified the product should be held liable. Bye bye downstream distro patches! And knowing the EU, they’ll say that “import Foo from Bar as MyFoo” is a “modification” and try to make anyone with cash in their pocket liable for any bug in any dependency they link to… Online platforms can be held liable for a defective product sold on their platform just like any other economic operators if they act like one. Bye bye app stores! Of course some will probably cheer this blindly ignoring or not comprehending the extraordinary value creation app stores are responsible for.
- kachurovskiy 2y agoThere was a lot of commotion about 2018 GDPR but it turned out to be rather uneventful, some basic practices have been adopted, very few companies were fined a small amount and the question is largely settled. For small companies and individual devs, pretty much nothing changed apart from adding a boilerplate ToS and PP to their projects. I would expect this this legislative change to follow a similar path. If you run a business, liability is a big concern from the start and this extension of the liability scope seems reasonable overall. I'd say they even tread lightly here as "damages for professional use are explicitly excluded".
- whimsicalism 2y agoThat’s because the EU is very discretionary in its enforcement. > For small companies and individual devs, pretty much nothing changed apart from adding a boilerplate ToS and PP to their projects. A significant portion of these players are probably non-compliant but nobody cares
- _DeadFred_ 2y agoTo quote a wise hackernewsian: https://news.ycombinator.com/item?id=41916279 https://news.ycombinator.com/item?id=41916279
- goethes_kind 2y agoMy reading of this: the EU wants to give its old fashioned SME software houses a chance with their software products, against the likes of FAANG that typically offer the software for free. Of course this also hurts EU startups, but that does not concern Brussels because the whole EU establishment is always defending the incumbents. And this is imho one of the reasons the EU is falling behind, because incumbents don't react well to paradigm shifts. It's a losing strategy. For all its many faults the US seems to have realized a long time ago that you cannot protect incumbents at the cost of startups.
- whimsicalism 2y agoexactly. The EU needs to focus on fair play for all market participants urgently, it is quite literally making them poorer.
- fsckboy 2y ago>For all its many faults the US seems to have realized a long time ago that you cannot protect incumbents at the cost of startups. I think it wasn't an American realization as much as it was a success of "the American experiment" 250 years ago, a European experiment undertaken by Europeans living in North America, taking European ideas from the Enlightenment and applying them broadly, to politics, to religion, to the economy, and it flourished. The tendency to protect incumbents was harder to root out back where the incumbents were more firmly entrenched. If you want to take the "loose analogy" approach even further, consider that the Enlightenment was also the integration of Northern European ideas stemming from individual self reliance because you need to when it's cold as fuck outside, as opposed to southern European/Roman Empire successful ideas of depending on huge bureaucracies to gather and apportion more abundant resources. this is not a proof of anything, just a pointing out/noticing type set of ideas. To me it seems tied in to other intellectual trends we see in history, where the , e.g., Romantic era was a movement in music, and in art, and in literature, and in politics/social theory, seemingly unrelated areas moving in concert, a reflection of how our brains work. (probably similar ideas can be found outside the West, but it's not something I'm that educated about)
- 2y ago
- charles_f 2y agoIf this goes, we can assume that like other practices where practitioners are liable: - insurance industry will come in and be the real winner. - practitioners will be required to have some sort of license to practice (eg be professional engineers). - there will be norms, standards, certification authorities, and review committees for when something falls through. The auditing business might also come into the case. - there will appear some sort of a cast system, such as doctors/nurses/medical assistants, dentists/dental assistants/dental receptionist, lawyers/legal assistants, etc. - costs and delays will go up for the customers, by much more than the occasional payoff from a lawsuit will bring - quality, notably of compliance and security will go up, which is what's desired by that law.
- kjksf 2y agoI wonder how do you expect a high school kid or collage student to afford insurance and get "some sort of license to practice"? Say goodbye to Linux - released by college student. Say goodbye to Winamp - released by a high schooler. Say goodbye to GTK+ and GIMP - released by 2 college students. Say goodbye to web browsers - why would Tim Barners-Lee or his employer CERN release a free product not related to their core mission if they could get sued by thousands of people?
- eesmith 2y agoLinux, open source, not covered under this requirement. Wikipedia tells me 'Winamp was first released in 1997, when Justin Frankel and Dmitry Boldyrev,[6][7][8] formerly students at the University of Utah', which makes them not high-schoolers. It was released by Nullsoft, Inc. GTK+ and GIMP, open source, not covered under this requirement. CERN httpd, open source, not covered under this requirement. By 'not covered under this requirement' I mean the following text in the directive applies: > Free and open-source software, whereby the source code is openly shared and users can freely access, use, modify and redistribute the software or modified versions thereof, can contribute to research and innovation on the market. Such software is subject to licences that allow anyone the freedom to run, copy, distribute, study, change and improve the software. In order not to hamper innovation or research, this Directive should not apply to free and open-source software developed or supplied outside the course of a commercial activity, since products so developed or supplied are by definition not placed on the market.
- throw7 2y agothe “objective state of scientific and technical knowledge” snort
- molticrystal 2y ago>the producer has to provide compensation irrespectively of whether there is negligence or fault on their part. This sounds terrible, anybody gaining access to a unix based shell and running rm -rf /*. It is going to make properitery products close up even tighter so they don't have something similar to the US's "Hot Coffee" incident on GTA and reduce modding ability.
- eesmith 2y agoI provide a source license to my software. How does this affect me and my European customers? More specifically, the directive says: > Information is not, however, to be considered a product, and product liability rules should therefore not apply to the content of digital files, such as media files or e-books or the mere source code of software. All I send is a license and copy of 'the mere source code of software'. Does that mean my product is not included under this directive?
- lifeisstillgood 2y agoMy guess is that FOSS is the big winner here. I think the analogy with locks is that most locks on the market will be given away for free, and then the liability rests on the person who selects the lock - protect your bank vault with a Masterlock screwed into 2x4 and you are in trouble. Select a FOSS solution you might also be in trouble but the developers aren’t
- lifeisstillgood 2y agoI have a slightly different analogy (law it seems is made like Hollywood films “It’s like Alien but on a Cruise ship”) Software is a form of literacy - not a product. The product is the hardware. And the actions the hardware takes. So want to add two numbers together ? There is a specific set of transistors that does that. And machine code. But at some point the python code or the Haskell code is an expression of human thought - literacy. And you can choose different software to do the same adding up. One can write an article many different ways, biases, slants etc. But the publisher only chooses one And so businesses offer software products like publishers offer articles and books The publisher is liable And if your business is publishing other peoples articles and you not only have not read it but cannot even read, why is it the authors problem? I think this take on FOSS vs an article written for hire might be useful Inwoukd also suggest that there is a level of reliance on the “canon” - importing a standard library would not suggest liability for that library