4 ms·

The author has a hard time understanding whether the CRA applies because he is thinking like a software engineer and not a lawyer. It would be very clear to a

by hnfong 2y ago

The author has a hard time understanding whether the CRA applies because he is thinking like a software engineer and not a lawyer. It would be very clear to a lawyer what "in the course of a commercial activity" means. And accepting open source contributions from a business entity normally isn't considered "in the course of a commercial activity". (It's like buying apples from the supermarket is not a engaging in commercial activity on the part of the customer, even if the supermarket is.) No disrespect to the author, but even consulting with a law student would clear up the issue. Maybe better access to law would be nice, but if the OSS community is really concerned with this issue some lawyer would have clarified this already. IANAL of course, and this is not legal advice.

dataflow 2y ago
If you give out apples for free and one of them turns out to hurt someone, are you liable? Edit: I'm not talking about deliberate poisoning or any other malicious intent. (Apparently this wasn't obvious?)
- s1artibartfast 2y ago
  IANAL, I expect it would depend on how you represented them and any negligence or malicious intent. You certainly cant hand out poison apples for free without liability.
  - deleted 2y ago
    [deleted]
  - hnfong 2y ago
    (This is what I learned in school, for common-law-ish jurisdictions.) What you said is true, if there's negligence or malicious intent you're generally liable. In tort. (Edit: also criminally liable as well but that's far off topic) However, whether you sold it or gave it out for free does matter, because for sales of goods, there's also contract law involved, there's usually additional implied warranties about the product being "merchantable" (you see this word in OSS disclaimers as well), and generally you can't disclaim your liability if you sold the product for money. If there's no money and no other considerations involved when you give away the apple, then there's no contract, so only the tort part applies. Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time. Again, IANAL and not legal advice.
    - eh_why_not 2y ago
      > In tort. New word for me. A tort is a civil wrong, other than breach of contract, that causes a claimant to suffer loss or harm, resulting in legal liability for the person who commits the tortious act. Tort law can be contrasted with criminal law, which deals with criminal wrongs that are punishable by the state. While criminal law aims to punish individuals who commit crimes, tort law aims to compensate individuals who suffer harm as a result of the actions of others https://en.wikipedia.org/wiki/Tort https://en.wikipedia.org/wiki/Tort
    - s1artibartfast 2y ago
      Perhaps it gets into a legal area that considers "reasonable expectations and behavior". You can absolutely sell buggy, non-functional, and even dangerous code. You just need to go to greater length too ensure that the buyer is informed about what they will be getting. >Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time.l I think it is more about the law attempting to mirror social expectations than having high-minded objectives itself.
- gradientsrneat 2y ago
  In the United States you have limited liability if you donate the apples to a food bank or a nonprofit feeding the hungry. Not sure about the case where you give away apples directly to random people on the street. https://www.usda.gov/about-usda/news/blog/good-samaritan-act-provides-liability-protection-food-donations https://www.usda.gov/about-usda/news/blog/good-samaritan-act...
tripletao 2y ago
It's probably fine; but it's not perfectly unambiguously fine, which means the first defendant may face years of uncertainty and millions of dollars of legal fees before they win. Maybe the other party would be ordered to pay some of that, and maybe they'd manage to collect. Against the €0 they've been paid, that's still a pretty bad bet. That's the good outcome, where they win. They probably won't lose, but if they do then it's potentially catastrophic. Perhaps you could find a law student who didn't appreciate those second-order consequences, but no one who's ever had involvement with a real nontrivial proceeding would. I think whatever training you've received has given you some false confidence here. A real lawyer's answer to almost any question is stereotypically "it depends", and that's for good reason. Even the smallest points of uncertainty can get expensive fast, both in legal fees and in expected value when a small probability gets multiplied by a very large worst-case loss. The EU has created a new such point here. That's probably more from sloppy drafting than from any intent, but it's unfortunate.
- hnfong 2y ago
  I get your point, but realistically you're talking about a minuscule chance of being sued as first defendant given the thousands of OSS devs in the region. Is a rational person supposed to be worried about the < 0.1% chance of financial ruin? To the extent they have to take draconian measures to protect themselves while working on OSS? "It depends" is correct but totally useless advice. Sure, a lawyer should probably remind the client that people sue others for unsubstantiated reasons as well so there's always some legal risk in new legislation where there's more uncertainty as to what the words mean... but as I said I'm not a lawyer and I'm certainly not the OP's lawyer or your lawyer. As in, I'd probably cover my ass a bit more if I were, but the fact is that the legislation wasn't intended to impose strict liability on OSS devs and unlikely will have that effect.
  - tripletao 2y ago
    If the EU passed legislation to randomly select three people under its jurisdiction and bankrupt them, then I think that (a) my personal risk would be too low to be actionable, as you say; but (b) that's pretty bad legislation. I think they've constructed roughly that effect here. I believe that's worth complaining about, both in principle and to the extent that same demonstrated carelessness might create more serious practical problems in future. That's especially true since as far as I can tell, this would have been an easy fix, just better drafting with no intended policy change. Of course that's different from what a lawyer considering only their client's current personal interests should care about. There I think most developers would take no action (and I don't plan to myself), though the lawyer would probably consider that a business decision and leave it for their client to make in the context of their legal advice. I might take action if I worked on a high-risk (e.g. cryptocurrency per below) project, to use a pseudonym, minimize assets in the EU, etc.

by hnfong 2y ago

dataflow 2y ago

If you give out apples for free and one of them turns out to hurt someone, are you liable? Edit: I'm not talking about deliberate poisoning or any other malicious intent. (Apparently this wasn't obvious?)

s1artibartfast 2y ago
IANAL, I expect it would depend on how you represented them and any negligence or malicious intent. You certainly cant hand out poison apples for free without liability.
- deleted 2y ago
  [deleted]
- hnfong 2y ago
  (This is what I learned in school, for common-law-ish jurisdictions.) What you said is true, if there's negligence or malicious intent you're generally liable. In tort. (Edit: also criminally liable as well but that's far off topic) However, whether you sold it or gave it out for free does matter, because for sales of goods, there's also contract law involved, there's usually additional implied warranties about the product being "merchantable" (you see this word in OSS disclaimers as well), and generally you can't disclaim your liability if you sold the product for money. If there's no money and no other considerations involved when you give away the apple, then there's no contract, so only the tort part applies. Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time. Again, IANAL and not legal advice.
  - eh_why_not 2y ago
    > In tort. New word for me. A tort is a civil wrong, other than breach of contract, that causes a claimant to suffer loss or harm, resulting in legal liability for the person who commits the tortious act. Tort law can be contrasted with criminal law, which deals with criminal wrongs that are punishable by the state. While criminal law aims to punish individuals who commit crimes, tort law aims to compensate individuals who suffer harm as a result of the actions of others https://en.wikipedia.org/wiki/Tort https://en.wikipedia.org/wiki/Tort
  - s1artibartfast 2y ago
    Perhaps it gets into a legal area that considers "reasonable expectations and behavior". You can absolutely sell buggy, non-functional, and even dangerous code. You just need to go to greater length too ensure that the buyer is informed about what they will be getting. >Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time.l I think it is more about the law attempting to mirror social expectations than having high-minded objectives itself.
gradientsrneat 2y ago
In the United States you have limited liability if you donate the apples to a food bank or a nonprofit feeding the hungry. Not sure about the case where you give away apples directly to random people on the street. https://www.usda.gov/about-usda/news/blog/good-samaritan-act-provides-liability-protection-food-donations https://www.usda.gov/about-usda/news/blog/good-samaritan-act...

tripletao 2y ago

It's probably fine; but it's not perfectly unambiguously fine, which means the first defendant may face years of uncertainty and millions of dollars of legal fees before they win. Maybe the other party would be ordered to pay some of that, and maybe they'd manage to collect. Against the €0 they've been paid, that's still a pretty bad bet. That's the good outcome, where they win. They probably won't lose, but if they do then it's potentially catastrophic. Perhaps you could find a law student who didn't appreciate those second-order consequences, but no one who's ever had involvement with a real nontrivial proceeding would. I think whatever training you've received has given you some false confidence here. A real lawyer's answer to almost any question is stereotypically "it depends", and that's for good reason. Even the smallest points of uncertainty can get expensive fast, both in legal fees and in expected value when a small probability gets multiplied by a very large worst-case loss. The EU has created a new such point here. That's probably more from sloppy drafting than from any intent, but it's unfortunate.

hnfong 2y ago
I get your point, but realistically you're talking about a minuscule chance of being sued as first defendant given the thousands of OSS devs in the region. Is a rational person supposed to be worried about the < 0.1% chance of financial ruin? To the extent they have to take draconian measures to protect themselves while working on OSS? "It depends" is correct but totally useless advice. Sure, a lawyer should probably remind the client that people sue others for unsubstantiated reasons as well so there's always some legal risk in new legislation where there's more uncertainty as to what the words mean... but as I said I'm not a lawyer and I'm certainly not the OP's lawyer or your lawyer. As in, I'd probably cover my ass a bit more if I were, but the fact is that the legislation wasn't intended to impose strict liability on OSS devs and unlikely will have that effect.
- tripletao 2y ago
  If the EU passed legislation to randomly select three people under its jurisdiction and bankrupt them, then I think that (a) my personal risk would be too low to be actionable, as you say; but (b) that's pretty bad legislation. I think they've constructed roughly that effect here. I believe that's worth complaining about, both in principle and to the extent that same demonstrated carelessness might create more serious practical problems in future. That's especially true since as far as I can tell, this would have been an easy fix, just better drafting with no intended policy change. Of course that's different from what a lawyer considering only their client's current personal interests should care about. There I think most developers would take no action (and I don't plan to myself), though the lawyer would probably consider that a business decision and leave it for their client to make in the context of their legal advice. I might take action if I worked on a high-risk (e.g. cryptocurrency per below) project, to use a pseudonym, minimize assets in the EU, etc.