5 ms·

No good deed goes unpunished: can we now be sued over software we give away?

62 points by ingve 2y ago

greenavocado 2y ago
Stopped reading when I learned this was about the UK. That whole country is headed towards oblivion through mismanagement and draconian punishment of its own people.
- mike_hearn 2y ago
  It's not about the UK, which you'd know if you hadn't stopped reading ;) Last paragraph of the article: > "Of course, here in the UK we aren’t subject to the EU CRA. I’m hoping that, by the time we get our own version, it will be clearer how the law will work." The current British government is, of course, not very high quality and may well make very similar mistakes in the drafting of its own law. But that isn't clear because it isn't written yet. This article is purely about the EU.
Terr_ 2y ago
> It’s notable, I think, that you’re not absolved from operating “in the course of a commercial activity” just because you’re supplying software free-of-charge. I can see why someone would have added this provision, if you think in terms of what loophole would exist without it. Imagine a company that sells you a router, and they declare that the necessary software is provided "free of charge", and as an extra convenience they've pre-installed it for you. Sure, maybe the device won't work with any other software, and maybe the software can't be installed on any other device, but anybody can download a copy from their website, so it is free...
- RiverCrochet 2y ago
  > Imagine a company that sells you a router, and they declare that the necessary software is provided "free of charge", and as an extra convenience they've pre-installed it for you. If this meant that routers booted off of swappable SD cards then that'd be awesome.
card_zero 2y ago
> I’m unsure whether the CRA would allow me to distribute ready-to-run binaries along with source code. Why?
- x0x0 2y ago
  Because that makes Kevin a manufacturer and thus subject to liability for a product that he gives away for free, which is a ludicrous proposition. And would lead anyone rational to ban all UK downloads, because you can't put your personal finances at risk to give someone free software.
  - card_zero 2y ago
    Oh right. I had the opposite uncertainty, in that I presumed distributing source code counts as manufacturing with no distinction between the two. So you have to put it through a compiler to make it go, so what, same difference. (And what about bytecode and JIT and other gray areas?)
hnfong 2y ago
The author has a hard time understanding whether the CRA applies because he is thinking like a software engineer and not a lawyer. It would be very clear to a lawyer what "in the course of a commercial activity" means. And accepting open source contributions from a business entity normally isn't considered "in the course of a commercial activity". (It's like buying apples from the supermarket is not a engaging in commercial activity on the part of the customer, even if the supermarket is.) No disrespect to the author, but even consulting with a law student would clear up the issue. Maybe better access to law would be nice, but if the OSS community is really concerned with this issue some lawyer would have clarified this already. IANAL of course, and this is not legal advice.
- dataflow 2y ago
  If you give out apples for free and one of them turns out to hurt someone, are you liable? Edit: I'm not talking about deliberate poisoning or any other malicious intent. (Apparently this wasn't obvious?)
  - s1artibartfast 2y ago
    IANAL, I expect it would depend on how you represented them and any negligence or malicious intent. You certainly cant hand out poison apples for free without liability.
    - deleted 2y ago
      [deleted]
    - hnfong 2y ago
      (This is what I learned in school, for common-law-ish jurisdictions.) What you said is true, if there's negligence or malicious intent you're generally liable. In tort. (Edit: also criminally liable as well but that's far off topic) However, whether you sold it or gave it out for free does matter, because for sales of goods, there's also contract law involved, there's usually additional implied warranties about the product being "merchantable" (you see this word in OSS disclaimers as well), and generally you can't disclaim your liability if you sold the product for money. If there's no money and no other considerations involved when you give away the apple, then there's no contract, so only the tort part applies. Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time. Again, IANAL and not legal advice.
captainbland 2y ago
It does seem like they have explicit provisions to exempt those distributing non-commercial OS/FOSS from these requirements. This is in keeping with the EU's promotion/funding of public benefit software.
- fred_is_fred 2y ago
  If a company uses free software in building their product, how does the law apply here. Does the liability fall on the commercial use or the original provider? Or what if the open source library itself is provided by a company. Let’s say Intel’s IPMI library has a vulnerability that affects Dell servers and causes a breach at a bank in Paris.
  - orwin 2y ago
    It's on the commercial user. Basically if you don't pay for support you're liable for the issues, at least in my only experience: a company I worked for decided to stop paying for Atos/Bullion support because of how shitty/useless it was, and the only reason the CEO agreed was that we could instead use Redhat software and support to take on part of the liability.
  - immibis 2y ago
    AFAIK if you take open source software, provided without liability, and use it commercially then you take the liability for that product, since you can't shift it to the creator, since they're volunteering for free. Which seems like common sense to me. It's good when the law mirrors common sense.
    - x0x0 2y ago
      > AFAIK if you take open source software, provided without liability, and use it commercially then you take the liability for that product, since you can't shift it to the creator, since they're volunteering for free. That is incorrect per my understanding. If that open source org offers eg paid support, they likely have liability, at least in the EU. Now they're probably, practically speaking, judgement proof. But they do have liability. see [1] [1] https://ubuntu.com/blog/the-cyber-resilience-act-what-it-means-for-open-source https://ubuntu.com/blog/the-cyber-resilience-act-what-it-mea...
thrtythreeforty 2y ago
Would it be possible to provide software under a license which is only valid if the manufacturer cannot be held liable for defects? That is, just turn the problematic scenario into copyright infringement. Seems to me this would be perfectly enforceable in the US, but EU laws often feel like they'd rather force software authors to take on liability and not be able to opt out of the whole problem. I'm unfamiliar with this area of law. I'm unsure if this modification would still qualify as Free software (as defined by FSF)... It would seem to interfere with Freedom 0 in a way that isn't really obvious. The legal environment would constrain what the software could be used for, because the license would terminate in case the author would be liable for defects.
- bad_user 2y ago
  One can argue that this is implicit in FOSS licenses, including the GPL. If the author can be held liable for any defects, then they can't really share their contributions, and FOSS contributions would only be possible by entities with well-paid lawyers. This is against the spirit of both Open Source and Free Software. Furthermore, similar clauses have existed for patents. E.g., if you use an Apache licensed library, but sue one of the contributors for patent infringement having to do with the library in question, then any grants of the Apache license terminate, so you can then be countersued. The way you framed your text, this would qualify as an interference with Freedom 0, as you can't eat your cake and have it too. Lest we forget, here's what the MIT license, one of the most permissive ones, have to say: "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." So the MIT license already says what you think is against Freedom 0.
  - thrtythreeforty 2y ago
    Agreed so far, but in the US that clause is enforceable and doesn't affect the ability to use or run the software, only the ability to receive support for it. My understanding is that any such disclaimer by businesses in the EU is not enforceable due to this new law. As someone who wouldn't want to accidentally be on the hook, I'd want a license which precludes uses where the law would kick in - but that is a restriction on use.
spacemanspiff01 2y ago
So, on the plus side, assuming that the absurd aspects get ironed out, couldn't this be a good thing. Businesses that rely on open source software will either have to accept liability for defects, or contract out to a third party who accepts liability. That seems like it might encourage open-source business models that encourage selling support, even just for the liability protection. Or am I being too hopeful?
nullc 2y ago
In ~2022 myself and a dozen other former and current volunteer Bitcoin contributors were sued in the UK by a shell company controlled by a fraudster/imposter. The plaintiff alleged that they had 'lost' (through no fault or negligence of ours) in a 'hack' the private keys to some $4 billion dollars in Bitcoins and that we owed them tortuous and/or fiduciary duties to aid them in "recovering" these assets. Our position was that there wasn't anything we could do to help, that even if there were we had no obligation to do so, owing to the fact the software we published was MIT licensed with a forceful disclaimer of liability which the plaintiff had accepted and without which we wouldn't have allowed the plaintiff to use or redistribute the software we wrote and the fact that normally no one has an active duty to save another (e.g. a police officer can stand holding a life preserver as you drown, and finally that their claim of ownership was obviously fraudulent. (plaintiff's position was that we could help by publishing backdoored software, we were never able to pin them down how how we were supposed to force anyone to adopt it in order to give it any effect at all, among other issues) We originally succeeded at getting the case tossed as having no reasonable prospect of success, but the dismissal was overturned by the appeals court. Fortunately (???) the fraudster behind the claim brought an additional spurious claim against us (this time demanding hundreds of billions in damages) during the brief window before the initial dismissal was overturned. Owing to a spectacular tactical blunder by our opponent the new case was joined in with other cases involving him which were more advanced in their development, and we were able to factually destroy all of the evidence that his initial case used to show his ownership as a collateral effect. All in all our litigation cost millions of dollars, tens of millions in for all parties across all the related cases. Fortunately good actors in the Bitcoin space stood up to pay our costs or otherwise we would have been personally ruined long before successfully winning the case on its merits, which was presumably his strategy. -- this is a thing often missed in these discussions: that it doesn't matter so much if you would ultimately win when if you can't immediately get a summary dismissal the legal costs will ruin you long before you get that opportunity. Not every project has supporters as wealthy as ours. Unfortunately, we had essentially no support from the free software legal or online rights world. I hope we avoided the precedent created by the initial reversal trashing things up for the future, time will tell. I was disappointed by parties who denied us support out of ick at anything cryptocurrency... when it comes to defending civil liberties you can't necessarily pick who you defend. There is a lot of good free speech law in the US thanks to the deplorable people at the Westboro Baptist Church. Our case was in the UK even though none of the defendants were there and many were in the US, because that's where the plaintiff brought it. Unfortunately when you write software that's used world wide you're potentially exposed to the systems of other countries, at least ones your own country will domesticate judgements from, regardless of your desires. (and perhaps an absence of choice of venue clauses is a defect in popular licenses...)
ameixaseca 2y ago
The word "product" has been used in all citations, though the author did not provide the definition of "product". In my opinion, this would likely clarify the intent behind the text.
precommunicator 2y ago
Could you just claim that "this software is intentionally defective and full of security vulnerabilities, was made as a training software for pentesting", so that (and good luck proving that) only if it's proven safe you can call it "defective"?
hcfman 2y ago
Does the UK variety have the 15 million penalty as well ?
mike_hearn 2y ago
Although the implications for independent open source developers in the EU are pretty bad, the real problem here is actually the impact it will have on European software companies, or in fact, any company that wants to sell software in the EU, even if they are foreign. The EU already suffers from a severe lack of tech industry given its size, and the author just casually brushes off the fact that this will make it much much harder. Most likely it will mean that European software suppliers must pay for very expensive outsourcing of liability protection or liability insurance, yielding higher prices for European customers, and many other companies will simply give up on selling their software in the EU at all. The fact that shipping faulty software is a strict liability crime there means that you can't even solve the problem by using high quality processes and standards, which is presumably the goal, because it literally doesn't matter how much effort you made in good faith to reduce the fault rate. This changes the economic equation for selling software in Europe quite considerably. Hopefully, the UK does not make the same problems when it attempts to draft a similar law, or better, it simply doesn't draft such a law at all. It says a lot about the cultural problems in Europe, and I say that as someone who is born and lives there, that the author simply blows this problem off as only affecting "mega corporations".
- Doxin 2y ago
  I don't think not liking and not wanting "mega corporations" is a cultural defect. It's a valid stance to have. Whether the end result of that stance is a good thing is of course debatable. Personally I'd say I'd rather have a dozen companies providing some service to choose from than one or two gigantic ones.

62 points by ingve 2y ago

Stopped reading when I learned this was about the UK. That whole country is headed towards oblivion through mismanagement and draconian punishment of its own people.

mike_hearn 2y ago
It's not about the UK, which you'd know if you hadn't stopped reading ;) Last paragraph of the article: > "Of course, here in the UK we aren’t subject to the EU CRA. I’m hoping that, by the time we get our own version, it will be clearer how the law will work." The current British government is, of course, not very high quality and may well make very similar mistakes in the drafting of its own law. But that isn't clear because it isn't written yet. This article is purely about the EU.

Terr_ 2y ago

> It’s notable, I think, that you’re not absolved from operating “in the course of a commercial activity” just because you’re supplying software free-of-charge. I can see why someone would have added this provision, if you think in terms of what loophole would exist without it. Imagine a company that sells you a router, and they declare that the necessary software is provided "free of charge", and as an extra convenience they've pre-installed it for you. Sure, maybe the device won't work with any other software, and maybe the software can't be installed on any other device, but anybody can download a copy from their website, so it is free...

RiverCrochet 2y ago
> Imagine a company that sells you a router, and they declare that the necessary software is provided "free of charge", and as an extra convenience they've pre-installed it for you. If this meant that routers booted off of swappable SD cards then that'd be awesome.

card_zero 2y ago

> I’m unsure whether the CRA would allow me to distribute ready-to-run binaries along with source code. Why?

x0x0 2y ago
Because that makes Kevin a manufacturer and thus subject to liability for a product that he gives away for free, which is a ludicrous proposition. And would lead anyone rational to ban all UK downloads, because you can't put your personal finances at risk to give someone free software.
- card_zero 2y ago
  Oh right. I had the opposite uncertainty, in that I presumed distributing source code counts as manufacturing with no distinction between the two. So you have to put it through a compiler to make it go, so what, same difference. (And what about bytecode and JIT and other gray areas?)

hnfong 2y ago

The author has a hard time understanding whether the CRA applies because he is thinking like a software engineer and not a lawyer. It would be very clear to a lawyer what "in the course of a commercial activity" means. And accepting open source contributions from a business entity normally isn't considered "in the course of a commercial activity". (It's like buying apples from the supermarket is not a engaging in commercial activity on the part of the customer, even if the supermarket is.) No disrespect to the author, but even consulting with a law student would clear up the issue. Maybe better access to law would be nice, but if the OSS community is really concerned with this issue some lawyer would have clarified this already. IANAL of course, and this is not legal advice.

dataflow 2y ago
If you give out apples for free and one of them turns out to hurt someone, are you liable? Edit: I'm not talking about deliberate poisoning or any other malicious intent. (Apparently this wasn't obvious?)
- s1artibartfast 2y ago
  IANAL, I expect it would depend on how you represented them and any negligence or malicious intent. You certainly cant hand out poison apples for free without liability.
  - deleted 2y ago
    [deleted]
  - hnfong 2y ago
    (This is what I learned in school, for common-law-ish jurisdictions.) What you said is true, if there's negligence or malicious intent you're generally liable. In tort. (Edit: also criminally liable as well but that's far off topic) However, whether you sold it or gave it out for free does matter, because for sales of goods, there's also contract law involved, there's usually additional implied warranties about the product being "merchantable" (you see this word in OSS disclaimers as well), and generally you can't disclaim your liability if you sold the product for money. If there's no money and no other considerations involved when you give away the apple, then there's no contract, so only the tort part applies. Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time. Again, IANAL and not legal advice.

captainbland 2y ago

It does seem like they have explicit provisions to exempt those distributing non-commercial OS/FOSS from these requirements. This is in keeping with the EU's promotion/funding of public benefit software.

fred_is_fred 2y ago
If a company uses free software in building their product, how does the law apply here. Does the liability fall on the commercial use or the original provider? Or what if the open source library itself is provided by a company. Let’s say Intel’s IPMI library has a vulnerability that affects Dell servers and causes a breach at a bank in Paris.
- orwin 2y ago
  It's on the commercial user. Basically if you don't pay for support you're liable for the issues, at least in my only experience: a company I worked for decided to stop paying for Atos/Bullion support because of how shitty/useless it was, and the only reason the CEO agreed was that we could instead use Redhat software and support to take on part of the liability.
- immibis 2y ago
  AFAIK if you take open source software, provided without liability, and use it commercially then you take the liability for that product, since you can't shift it to the creator, since they're volunteering for free. Which seems like common sense to me. It's good when the law mirrors common sense.
  - x0x0 2y ago
    > AFAIK if you take open source software, provided without liability, and use it commercially then you take the liability for that product, since you can't shift it to the creator, since they're volunteering for free. That is incorrect per my understanding. If that open source org offers eg paid support, they likely have liability, at least in the EU. Now they're probably, practically speaking, judgement proof. But they do have liability. see [1] [1] https://ubuntu.com/blog/the-cyber-resilience-act-what-it-means-for-open-source https://ubuntu.com/blog/the-cyber-resilience-act-what-it-mea...

thrtythreeforty 2y ago

Would it be possible to provide software under a license which is only valid if the manufacturer cannot be held liable for defects? That is, just turn the problematic scenario into copyright infringement. Seems to me this would be perfectly enforceable in the US, but EU laws often feel like they'd rather force software authors to take on liability and not be able to opt out of the whole problem. I'm unfamiliar with this area of law. I'm unsure if this modification would still qualify as Free software (as defined by FSF)... It would seem to interfere with Freedom 0 in a way that isn't really obvious. The legal environment would constrain what the software could be used for, because the license would terminate in case the author would be liable for defects.

bad_user 2y ago
One can argue that this is implicit in FOSS licenses, including the GPL. If the author can be held liable for any defects, then they can't really share their contributions, and FOSS contributions would only be possible by entities with well-paid lawyers. This is against the spirit of both Open Source and Free Software. Furthermore, similar clauses have existed for patents. E.g., if you use an Apache licensed library, but sue one of the contributors for patent infringement having to do with the library in question, then any grants of the Apache license terminate, so you can then be countersued. The way you framed your text, this would qualify as an interference with Freedom 0, as you can't eat your cake and have it too. Lest we forget, here's what the MIT license, one of the most permissive ones, have to say: "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." So the MIT license already says what you think is against Freedom 0.
- thrtythreeforty 2y ago
  Agreed so far, but in the US that clause is enforceable and doesn't affect the ability to use or run the software, only the ability to receive support for it. My understanding is that any such disclaimer by businesses in the EU is not enforceable due to this new law. As someone who wouldn't want to accidentally be on the hook, I'd want a license which precludes uses where the law would kick in - but that is a restriction on use.

spacemanspiff01 2y ago

So, on the plus side, assuming that the absurd aspects get ironed out, couldn't this be a good thing. Businesses that rely on open source software will either have to accept liability for defects, or contract out to a third party who accepts liability. That seems like it might encourage open-source business models that encourage selling support, even just for the liability protection. Or am I being too hopeful?

nullc 2y ago

In ~2022 myself and a dozen other former and current volunteer Bitcoin contributors were sued in the UK by a shell company controlled by a fraudster/imposter. The plaintiff alleged that they had 'lost' (through no fault or negligence of ours) in a 'hack' the private keys to some $4 billion dollars in Bitcoins and that we owed them tortuous and/or fiduciary duties to aid them in "recovering" these assets. Our position was that there wasn't anything we could do to help, that even if there were we had no obligation to do so, owing to the fact the software we published was MIT licensed with a forceful disclaimer of liability which the plaintiff had accepted and without which we wouldn't have allowed the plaintiff to use or redistribute the software we wrote and the fact that normally no one has an active duty to save another (e.g. a police officer can stand holding a life preserver as you drown, and finally that their claim of ownership was obviously fraudulent. (plaintiff's position was that we could help by publishing backdoored software, we were never able to pin them down how how we were supposed to force anyone to adopt it in order to give it any effect at all, among other issues) We originally succeeded at getting the case tossed as having no reasonable prospect of success, but the dismissal was overturned by the appeals court. Fortunately (???) the fraudster behind the claim brought an additional spurious claim against us (this time demanding hundreds of billions in damages) during the brief window before the initial dismissal was overturned. Owing to a spectacular tactical blunder by our opponent the new case was joined in with other cases involving him which were more advanced in their development, and we were able to factually destroy all of the evidence that his initial case used to show his ownership as a collateral effect. All in all our litigation cost millions of dollars, tens of millions in for all parties across all the related cases. Fortunately good actors in the Bitcoin space stood up to pay our costs or otherwise we would have been personally ruined long before successfully winning the case on its merits, which was presumably his strategy. -- this is a thing often missed in these discussions: that it doesn't matter so much if you would ultimately win when if you can't immediately get a summary dismissal the legal costs will ruin you long before you get that opportunity. Not every project has supporters as wealthy as ours. Unfortunately, we had essentially no support from the free software legal or online rights world. I hope we avoided the precedent created by the initial reversal trashing things up for the future, time will tell. I was disappointed by parties who denied us support out of ick at anything cryptocurrency... when it comes to defending civil liberties you can't necessarily pick who you defend. There is a lot of good free speech law in the US thanks to the deplorable people at the Westboro Baptist Church. Our case was in the UK even though none of the defendants were there and many were in the US, because that's where the plaintiff brought it. Unfortunately when you write software that's used world wide you're potentially exposed to the systems of other countries, at least ones your own country will domesticate judgements from, regardless of your desires. (and perhaps an absence of choice of venue clauses is a defect in popular licenses...)

ameixaseca 2y ago

The word "product" has been used in all citations, though the author did not provide the definition of "product". In my opinion, this would likely clarify the intent behind the text.

precommunicator 2y ago

Could you just claim that "this software is intentionally defective and full of security vulnerabilities, was made as a training software for pentesting", so that (and good luck proving that) only if it's proven safe you can call it "defective"?

hcfman 2y ago

Does the UK variety have the 15 million penalty as well ?

mike_hearn 2y ago

Although the implications for independent open source developers in the EU are pretty bad, the real problem here is actually the impact it will have on European software companies, or in fact, any company that wants to sell software in the EU, even if they are foreign. The EU already suffers from a severe lack of tech industry given its size, and the author just casually brushes off the fact that this will make it much much harder. Most likely it will mean that European software suppliers must pay for very expensive outsourcing of liability protection or liability insurance, yielding higher prices for European customers, and many other companies will simply give up on selling their software in the EU at all. The fact that shipping faulty software is a strict liability crime there means that you can't even solve the problem by using high quality processes and standards, which is presumably the goal, because it literally doesn't matter how much effort you made in good faith to reduce the fault rate. This changes the economic equation for selling software in Europe quite considerably. Hopefully, the UK does not make the same problems when it attempts to draft a similar law, or better, it simply doesn't draft such a law at all. It says a lot about the cultural problems in Europe, and I say that as someone who is born and lives there, that the author simply blows this problem off as only affecting "mega corporations".

Doxin 2y ago
I don't think not liking and not wanting "mega corporations" is a cultural defect. It's a valid stance to have. Whether the end result of that stance is a good thing is of course debatable. Personally I'd say I'd rather have a dozen companies providing some service to choose from than one or two gigantic ones.