Hacker News Reader

Comment by bdamm | Hacker News Reader

The need is certainly clear. The call this blog post makes urges action and provides useful guidance on how to get that action moving. However, without legislative forcing, no such action will occur, and we will remain in the current regime where market forces such as reputational tarnish remains the most powerful driver for security choices. In some markets there are customers that must comply with regulations in their respective market, thus causing software vendors to provide more security assurance, but this is a special case and not the general case that the post here is looking for.

> The software industry must not kick the can down the road another decade through inaction.

The software industry most assuredly will, unless legislatively forced or otherwise compelled by the industrial environment.

View on HN

Increased liability/lawsuit-exposure seems like an efficient way to do it (certainly better than regulations with very specific criteria around how people should write software)

This liability is already non-zero. I wonder if the penalty fees are too low, or if there's some kind of legal shield that reduces the risk

Another one is higher insurance fees when using unsafe tooling, just like in other industries when hazardous substances are used, or there are higher accident rates.

Is liability insurance viable?

Software can be installed on billions of devices. Even a low liability could be financially ruinous...

Especially for open source.

I could see underwriting a sealed appliance, but it doesn’t seem feasible for anyone to underwrite a general-purpose computer with varying components and many programs interacting under a power user’s commands.

Liability will kill all free software. I am not going to write a line of code that makes me personally liable.

You already have the liability, you just don't realize it because nobody has tried to sue you over anything. Laws will provide specific behaviors that constitute liability, rather than the "anything we can prove was damaging."

At least a legal framework will tell you what you should and shouldn't be doing.

Today the disclaimers in most software and the non commercial nature generally insulates you from liability unless they can demonstrate some extreme situation like maliciousness. A regulatory framework that doesn’t carve giant holes in liability for open source will stifle it, as it will erode the giant hole being used today. In the context of the topic (memory safety and other issues in software used widely) you can’t divorce that from open source and just hold commercial software culpable for their compliance. By introducing some sort of regulatory structure around software quality you necessarily either exempt open source, leaving a huge surface area untouched, or you essentially kill non commercial contribution.

Most of those disclaimers don't hold in court in many jurisdictions.

Also outside computing industry everyone is liable on the eyes of the law, even if doing charity.

Any references to case law? AFAIK none really exists because it’s generally assumed that non commercial open source licenses with disclaimers are pretty legally resilient so haven’t been tested. But my scope is US only.

For example EULAs are not valid in many European countries, because you haven't signed any contract when paying for the product.

If the user has accepted such provision before making the binding acquisition of the said product, then it is another matter.

Reply on news.ycombinator.com