Hacker News Reader

Comment by hnfong | Hacker News Reader

The author has a hard time understanding whether the CRA applies because he is thinking like a software engineer and not a lawyer.

It would be very clear to a lawyer what "in the course of a commercial activity" means. And accepting open source contributions from a business entity normally isn't considered "in the course of a commercial activity". (It's like buying apples from the supermarket is not a engaging in commercial activity on the part of the customer, even if the supermarket is.)

No disrespect to the author, but even consulting with a law student would clear up the issue. Maybe better access to law would be nice, but if the OSS community is really concerned with this issue some lawyer would have clarified this already.

IANAL of course, and this is not legal advice.

View on HN

It's probably fine; but it's not perfectly unambiguously fine, which means the first defendant may face years of uncertainty and millions of dollars of legal fees before they win. Maybe the other party would be ordered to pay some of that, and maybe they'd manage to collect. Against the €0 they've been paid, that's still a pretty bad bet. That's the good outcome, where they win. They probably won't lose, but if they do then it's potentially catastrophic.

Perhaps you could find a law student who didn't appreciate those second-order consequences, but no one who's ever had involvement with a real nontrivial proceeding would. I think whatever training you've received has given you some false confidence here.

A real lawyer's answer to almost any question is stereotypically "it depends", and that's for good reason. Even the smallest points of uncertainty can get expensive fast, both in legal fees and in expected value when a small probability gets multiplied by a very large worst-case loss. The EU has created a new such point here. That's probably more from sloppy drafting than from any intent, but it's unfortunate.

I get your point, but realistically you're talking about a minuscule chance of being sued as first defendant given the thousands of OSS devs in the region.

Is a rational person supposed to be worried about the < 0.1% chance of financial ruin? To the extent they have to take draconian measures to protect themselves while working on OSS?

"It depends" is correct but totally useless advice. Sure, a lawyer should probably remind the client that people sue others for unsubstantiated reasons as well so there's always some legal risk in new legislation where there's more uncertainty as to what the words mean... but as I said I'm not a lawyer and I'm certainly not the OP's lawyer or your lawyer. As in, I'd probably cover my ass a bit more if I were, but the fact is that the legislation wasn't intended to impose strict liability on OSS devs and unlikely will have that effect.

If the EU passed legislation to randomly select three people under its jurisdiction and bankrupt them, then I think that (a) my personal risk would be too low to be actionable, as you say; but (b) that's pretty bad legislation.

I think they've constructed roughly that effect here. I believe that's worth complaining about, both in principle and to the extent that same demonstrated carelessness might create more serious practical problems in future. That's especially true since as far as I can tell, this would have been an easy fix, just better drafting with no intended policy change.

Of course that's different from what a lawyer considering only their client's current personal interests should care about. There I think most developers would take no action (and I don't plan to myself), though the lawyer would probably consider that a business decision and leave it for their client to make in the context of their legal advice. I might take action if I worked on a high-risk (e.g. cryptocurrency per below) project, to use a pseudonym, minimize assets in the EU, etc.

> I get your point, but realistically you're talking about a minuscule chance of being sued as first defendant given the thousands of OSS devs in the region

There's that, and and there's also the fact there's no point in suing people with little money.

An aggrieved company isn't going to go after a random open source dev, because that cost more than it is worth. They will find an actual commercial vendor to sue.

That's true, but only if the thing they want is money. For example, a commercial software developer might fund lawsuits against its open-source competitor even with no hope of recovering significant cash, because the goal is simply to destroy that competitor.

Probably they'd lose eventually. The effect on the defendant would be big regardless though, and that's the point. A lawsuit doesn't have to win to be a useful economic weapon, just to survive long enough to inflict the intended pain on your opponent.

If you give out apples for free and one of them turns out to hurt someone, are you liable?

Edit: I'm not talking about deliberate poisoning or any other malicious intent. (Apparently this wasn't obvious?)

IANAL, I expect it would depend on how you represented them and any negligence or malicious intent.

You certainly cant hand out poison apples for free without liability.

(This is what I learned in school, for common-law-ish jurisdictions.)

What you said is true, if there's negligence or malicious intent you're generally liable. In tort. (Edit: also criminally liable as well but that's far off topic)

However, whether you sold it or gave it out for free does matter, because for sales of goods, there's also contract law involved, there's usually additional implied warranties about the product being "merchantable" (you see this word in OSS disclaimers as well), and generally you can't disclaim your liability if you sold the product for money.

If there's no money and no other considerations involved when you give away the apple, then there's no contract, so only the tort part applies.

Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time.

Again, IANAL and not legal advice.

> In tort.

New word for me.

A tort is a civil wrong, other than breach of contract, that causes a claimant to suffer loss or harm, resulting in legal liability for the person who commits the tortious act. Tort law can be contrasted with criminal law, which deals with criminal wrongs that are punishable by the state. While criminal law aims to punish individuals who commit crimes, tort law aims to compensate individuals who suffer harm as a result of the actions of others

https://en.wikipedia.org/wiki/Tort

Perhaps it gets into a legal area that considers "reasonable expectations and behavior". You can absolutely sell buggy, non-functional, and even dangerous code. You just need to go to greater length too ensure that the buyer is informed about what they will be getting.

>Generally the idea of holding the seller of a product liable for harms caused by the product is that the law (or society at large) don't like businesses profiting from selling stuff yet shifting risks to the consumer at the same time.l

I think it is more about the law attempting to mirror social expectations than having high-minded objectives itself.

In the United States you have limited liability if you donate the apples to a food bank or a nonprofit feeding the hungry. Not sure about the case where you give away apples directly to random people on the street.

https://www.usda.gov/about-usda/news/blog/good-samaritan-act...

Reply on news.ycombinator.com