Slash Boxes
NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

All the Perl that's Practical to Extract and Report

use Perl Log In

Log In

[ Create a new account ]

Ovid (2709)

  (email not shown publicly)
AOL IM: ovidperl (Add Buddy, Send Message)

Stuff with the Perl Foundation. A couple of patches in the Perl core. A few CPAN modules. That about sums it up.

Journal of Ovid (2709)

Wednesday May 13, 2009
02:20 AM

Software Liability Protection

[ #38966 ]

Once again, I expect I'm in the minority on this, but I'm quite happy to see that the European Commission wants consumer protection laws extended to software.

Before you reach for the pitchforks and run me out of town, hear me out. The BSA, representing Microsoft, IBM and Apple, don't want this because they feel that it would stifle development and that software is a fundamentally different thing from a toaster. While I agree that we're not producing toasters and our liability should be different from manufacturers of such, I don't believe this would stifle development. I believe it would fundamentally alter it. Instead of rushing to see how fast we could get our products to market, more time in software testing, penetration testing, fuzz testing, etc. More research into developing secure systems would take place and developers would actually know what OWASP stands for. Plus, this would fix one of the biggest issues with security: companies don't want to pay for security because those costs rarely generate revenue or losses great enough to justify said costs. It makes no economic sense for companies to care about security (remember: economics doesn't care a fig for ethics).

One complaint is that there might be less software interoperability. This is probably true and it's a sad price to pay, but if we care about our craft, sometimes sacrifices have to be made. And that, my friends, is the crux of the problem. I don't believe most software developers want to develop bad code, but they'd rather develop bad code than be told they can't play. While I'm sure many would deny this, watching the juvenile interactions that are the best many developers can maintain, I stand firm by my statement.

So the EC wants consumer safety laws and business/developers don't. Perhaps, just perhaps, we should find out what those laws are first? To whom do they apply and how? What are the penalties? Obviously it would be idiotic if we're talking about jail time; if it's merely the cost of the software, this might be too lean. If, instead, we had a reasonable indemnification for "good faith" efforts and modest penalties, I think this would be a good start. In fact, I would argue that "good faith" efforts should probably lean in favor of the businesses/developers to stop frivolous suits. Of course, how does one demonstrate "good faith" efforts in closed-source software?

I expect that most software develops would still prefer to say "no" rather than entertain even a shred of compromise, but like bankers receiving fat bonuses with bailout money, maybe, just maybe, the general public is tired of our justifications.

Update: there is one reason I would strongly object to consumer protections: if EC gets around to write said laws. I know that sounds paradoxical, but given some of the computer laws (and attempts) coming out of Europe, I don't really trust people who don't understand computers to regulate them.

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
More | Login | Reply
Loading... please wait.
  • I believe it would fundamentally alter it. Instead of rushing to see how fast we could get our products to market, more time in software testing, penetration testing, fuzz testing, etc.

    Do you have any evidence on which to base this belief? Would the natural response not instead be to divert more money to lawyers and compliance officers?

    Does this mean you would no longer be able to post code to Github, Sourceforge etc. without first performing security audits and CYA?

    -- Ed Avis
    • There is a fundamental issue well-known to economists that when a good has negative externalities [] (e.g., pollution), then the forcing those generating the externalities to internalize those costs is widely considered the fairest way to deal with them. The problem is really trying to assess what those costs actually are and which manufacturers are responsible for which portion of the costs (the devil is always in the details). Since software manufacturers clearly generate a product with negative externalit

      • A product does not have negative externalities merely because it harms its owner. If you want to pour diesel in your own fish tank, so be it; only pouring it into the local river is an externality. So just saying that software makers have a shoddy product is not enough to put them in the same category as noisy concerts, polluting factories, and view-blocking skyscrapers.

        Of course, there are negative effects to society as a whole from the existence of botnets, but that is true for almost any product: a c

        -- Ed Avis
      • A product does not have negative externalities merely because it harms its owner. You can pour diesel in your own fish tank; only when you pour it in the river does it become an externality.

        Of course there is harm to society as a whole from the existence of botnets. But some negative effect or another exists for any product from cars to telephones to books. There are many positive effects on society from the use of software, but makers don't get a special subsidy because of them. The quality of the pr

        -- Ed Avis
  • It will never fly. An interest group will quickly come to say, "while we in the EU are heaping on large costs to comply with the governments' rules on quality, the software makers in Brazil and the USA and whatnot are cheaper and quicker, and the consumers naturally go for them".

    How about this: like with organic/non-genetically-modified food, let the authorities issue a stamp of quality. Those who want or need high quality software will go for it. So this is a wholly volunteer thing and the market regulat

    • As for software from other countries, they may be cheaper and quicker, but we still have liability laws for non-software products from them. If a small shop in Texas sells their software in Europe via the Internet and they hurt people, you could still bring suit. For shrink-wrapped software, Europe could simply ban the software from being shipped here if they didn't comply. Granted you might not get anywhere suing software manufacturers from other companies, but that's the way it would work for smaller c

      • Microsoft will release more secure software and they'll probably be hurt by this because they've been going on too long without security.

        Why do you believe this? Microsoft is not in the habit of complying with regulations it considers annoying or onerous. I'm sure Microsoft is also very capable of demonstrating irreparable harm to its business (and if you want to talk about negative externalities, consider the cost to customers) by breaking all existing software.

        Maybe the government should also run a To

  • The only thing I want, and what I think is the original idea behind this proposal, is a money back guarantee, if you find the software doesn't do what you wanted it to do.

    Currently, software vendors hide behind a "no promise of fitness for any particular purpose" clause in the EULA, and I'd like to see this clause wiped out of existence.

    • That might be enough to satisfy me. However, what's to stop someone from buying the software, installing it, then returning it for a money-back guarantee and still using it? That would be problematic, I think. Still, this would go a long way towards mitigating some of the issues involved.

      • What's to stop someone downloading the same software via BitTorrent? I think that's really an argument about piracy rather than the issue at hand (and most medium to large companies don't pirate - at least on a large scale - because they can be audited).

        I agree with bart... a money-back guarantee - while it wouldn't solve every problem - would at least give consumers some protection (while crucially leaving "free as in beer" alone). Anything more (as much as I'd love to see MS et al suffer for their shoddy

      • The penalty needs to be only payable once actual harm or misrepresentation has been demonstrated, (thus preventing your hypothetical) and needs to be a large multiple of the price. That price including any consultancy fees, maintenance contracts and so on, not just the purchase price. This would make people who just release their software for free immune (a large multiple * 0 == 0), but those who run businesses around free software liable.
        • Free software is one thing, but what about open source? If someone releases free software that has a nasty security hole exposing your credit card data to others, then I would argue that there's a liability issue. If it's also open source, I think that would be a mitigating factor in liability.

    • It would be nice to use that guarantee to get my money back whenever I was forced to accept a copy of Windows along with the hardware that was all I really wanted to get.
  • I was writing a comment to agree with you Ovid, but it got too long and turned into a whole blog post: []

    In short, software engineers for safety-critical systems should be licensed and certified in the same way that practitioners of other engineering disciplines are. Far from harming those other industries, regulations, licenses, and certifications have had a real business benefit to them.

    Andrew Whitworth