zlacker

[parent] [thread] 23 comments
1. omnico+(OP)[view] [source] 2023-12-29 18:46:10
The article is misleading unless you read the whole thing and the reactions are standard knee-jerk ones from HN users that didn't need to read past "EU" to assume the worst possible misinterpretation.
replies(4): >>within+g1 >>sevagh+A1 >>notfed+e2 >>tracer+k4
2. within+g1[view] [source] 2023-12-29 18:51:36
>>omnico+(OP)
I read the article, but it was quite ambiguous, at least to me. It isn't very well written / clear on what is actually going on.
replies(1): >>omnico+W1
3. sevagh+A1[view] [source] 2023-12-29 18:53:00
>>omnico+(OP)
Yes, the author of the article is all over the place

>But what if you’re just part of a collaborative open source project, give away your app, or if there’s open source code in the product you put on the market? Who gets blamed when open source might be the heart of the problem?

Every other sentence is dripping in "sympathy for open-source creators", but buried in the subtext is "sympathy for the innocent commercial vendors who decided to rely on open-source projects."

>So, how is open-source software implicated? If a commercial software product causes harm, whoever put the software on the market will soon be strictly liable.

Good!

>You will need to prove that your code wasn’t to blame to escape the costs. But what if you’ve embedded open-source code, used open-source tools, or called open-source APIs? Under the pending rules, you’d be liable for any errors in those sources as well, regardless of whether you directly contributed or not.

Better! Now a big evil company _can't_ pass the buck to the unpaid hobby project creator!

replies(2): >>curt15+Ub >>MaxBar+jf
◧◩
4. omnico+W1[view] [source] [discussion] 2023-12-29 18:55:04
>>within+g1
I agree it's very ambiguous, but if you read the whole thing it's clear that when dev A releases code under an open source license and it's included in a commercial product by company B that then harms person C, the liability will be on company B. Most of the hot-under-the-collar responses here are assuming it will fall on dev A, which is a misinterpretation the article's author did not do much to discourage.
replies(2): >>sevagh+T2 >>Mauran+e4
5. notfed+e2[view] [source] 2023-12-29 18:56:21
>>omnico+(OP)
Are we reading the same article? The final paragraph even says:

> My prediction, for what it’s worth, is that open source’s days outside academia and hobbyists are numbered.

◧◩◪
6. sevagh+T2[view] [source] [discussion] 2023-12-29 18:59:09
>>omnico+W1
Actually, I may have missed buried lede in this case where there is no company B, and citizen C is harmed by dev A's github project.

That is actually kinda concerning, if my MIT license of "no guarantee" won't protect me.

Other commenters who got it:

>>38808821

>>38808756

replies(1): >>fipar+o5
◧◩◪
7. Mauran+e4[view] [source] [discussion] 2023-12-29 19:06:45
>>omnico+W1
That completely ignores the second half of the article. I agree that it's confusing why the article goes into so much depth on "companies are now liable, similar to how everyone expects" in the first half when the main talking point is/should be "open source devs are now liable if consumers use their software directly" (as discussed in the second half).
replies(1): >>tesdin+F52
8. tracer+k4[view] [source] 2023-12-29 19:07:25
>>omnico+(OP)
The article literally ends in bold with "Someone, or some entity, will need to accept financial and legal responsibility for what the project does in consumer hands. No license can insulate them from that. " If people are having a fearful reaction to the article it's the authors fault.
◧◩◪◨
9. fipar+o5[view] [source] [discussion] 2023-12-29 19:13:19
>>sevagh+T2
That is concerning, but I think the author’s interpretation of the upcoming regulation may be wrong.

See here for example: https://www.euractiv.com/section/digital/news/eu-updates-pro...

Specifically: “The Directive will not apply to free and open-source software developed or supplied outside a commercial activity. The liability rules apply when the software is supplied in exchange for a price or personal data used for anything other than improving the software’s security or compatibility.”

IMHO the original article is either wrong or trying to spread FUD.

My take is, if this law passes, I’m an EU citizen, and I use your MIT software without paying you and without engaging with it through some service of yours (e.g. sevaghbook.com) then you’re not liable if I get damaged.

replies(2): >>dqv+fd >>trepri+8x
◧◩
10. curt15+Ub[view] [source] [discussion] 2023-12-29 19:50:09
>>sevagh+A1
So can we expect popular yet understaffed open source software -- like OpenSSL -- to get a lot of paid code review or patches?
replies(1): >>mistri+rt
◧◩◪◨⬒
11. dqv+fd[view] [source] [discussion] 2023-12-29 19:58:10
>>fipar+o5
Why none of these articles (neither TFA nor the one you're linking) link to the actual directive is beyond me.

But here it is:

https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/7393...

> With the aim of not hampering innovation: (i) free and open-source software developed or supplied outside the course of commercial activity, as well as (ii) the source code of software, should be excluded from the definition of products covered under the proposal.

replies(2): >>fipar+MA >>eggsbo+SD
◧◩
12. MaxBar+jf[view] [source] [discussion] 2023-12-29 20:10:47
>>sevagh+A1
The end of that paragraph continues in the same line:

> Worse still, how will you in turn identify or sue the collaborator or collaboration that actually wrote the faulty open-source code to recoup your costs? In that case, the license you signed likely insulates your open-source partners from your claims.

I sincerely hope this will never become a possibility. The chilling effect would presumably be catastrophic for Free and Open Source software in the relevant legal jurisdiction. Why would anyone voluntarily release their code as FOSS if it opens them up to lawsuits?

◧◩◪
13. mistri+rt[view] [source] [discussion] 2023-12-29 21:36:48
>>curt15+Ub
expect new, certified companies with security and finance, to become the officially required caretakers along with many fees; expect new monetized systems to distribute security patches passed through new bureaucracies, with logging of the government ID of all recipients; expect the restriction of new security patches to authorized users only.
◧◩◪◨⬒
14. trepri+8x[view] [source] [discussion] 2023-12-29 21:58:08
>>fipar+o5
Basically EU will treat open source devs as idiots by preventing them from making living off it. And you feel that's fine?
replies(2): >>warkda+lA >>fipar+oA
◧◩◪◨⬒⬓
15. warkda+lA[view] [source] [discussion] 2023-12-29 22:18:24
>>trepri+8x
If open source devs make a living off it by charging users for money (or PII), the devs should be liable for the code they are selling. It does not matter if it is open source. Whoever makes a commercial offering based on that software must be liable.
◧◩◪◨⬒⬓
16. fipar+oA[view] [source] [discussion] 2023-12-29 22:18:50
>>trepri+8x
I have no idea how you interpret it this way.

How does being liable for damages caused by software or services you sell equate to being an idiot? I just see it as the normal way to do business, and the reason why limited liability (the way I’ve been doing business for more than 2 decades) exists.

replies(1): >>trepri+yS
◧◩◪◨⬒⬓
17. fipar+MA[view] [source] [discussion] 2023-12-29 22:21:53
>>dqv+fd
Thanks for linking to the actual directive!

In light of it, I think the article I found didn’t link to it out of sloppiness, because their summary seems reasonably accurate to me, and the fine article didn’t link to it because they want to spread FUD, as the text you quoted directly contradicts some of the fear mongering in the original article.

◧◩◪◨⬒⬓
18. eggsbo+SD[view] [source] [discussion] 2023-12-29 22:48:14
>>dqv+fd
Still not clear for me. What about a company open sourcing some libraries used in its product. Will it be liable? Or would this be 'supplied outside the course of commercial activity'
replies(1): >>dqv+x41
◧◩◪◨⬒⬓⬔
19. trepri+yS[view] [source] [discussion] 2023-12-30 01:20:52
>>fipar+oA
Example: I will make a library controlling some integrated circuit as open source and charge money for commercial use. My software has a little bug that occasionally causes misreading of the IC values. A military software company uses my open source library in their nuke platform. My library misreads values on one nuke that goes off. Are you telling me I am going to be liable for that? Let's say independent multi-pass root cause analysis pinpointed the problem to my library and only to my library.
replies(2): >>mark_u+YY >>fipar+0Z
◧◩◪◨⬒⬓⬔⧯
20. mark_u+YY[view] [source] [discussion] 2023-12-30 02:45:31
>>trepri+yS
My take would be that if the military company paid you for the commercial use right, then you have "sold" the software and yes you would be liable. If they used it in an open source compatible way (no actual license is stated), and did not pay you for it then no, you would not be liable.
replies(1): >>trepri+601
◧◩◪◨⬒⬓⬔⧯
21. fipar+0Z[view] [source] [discussion] 2023-12-30 02:45:44
>>trepri+yS
If you did not sell the library to the military software company then no, it’s them whom are liable (assuming they did sell their software, that uses your library, to whomever had the nuke that went off) and not you.

IANAL but it seems clear cut to me: if you asked for money in exchange for your software (or to access to your software through an API or similar), or if you asked for personal information (in exchange for your software) then you’re liable, otherwise, you’re not.

◧◩◪◨⬒⬓⬔⧯▣
22. trepri+601[view] [source] [discussion] 2023-12-30 02:59:41
>>mark_u+YY
So basically I have no say about how my library is going to be used once I sell a license to a company, and if its use by a 3rd party leads to e.g. a mass-casualty event due to a bug in my code, I am liable?
◧◩◪◨⬒⬓⬔
23. dqv+x41[view] [source] [discussion] 2023-12-30 04:18:04
>>eggsbo+SD
Take OpenSSL. Their open source product would be free of liability. Their commercial support offering of that same product would not be.
◧◩◪◨
24. tesdin+F52[view] [source] [discussion] 2023-12-30 17:00:30
>>Mauran+e4
Most commenters here only read the first half it seems, I expected more of the hn audience.
[go to top]