"If you want to see change, you need to incentivize change. For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected. Imagine how quickly Mark Zuckerberg would start smashing the delete key.
Where there is no liability, there is no accountability... and this brings us to the State. "
If this happens, it will be the end of open source and the indie web. Only large companies with large legal departments and serious liability insurance, and anonymous underground hackers, will be able to afford to make software public for commercial use or run a website.
That's one extreme extrapolation. How about, if this happens, it will be the end of commercial IP and the closed-web. Only open source with its inherent transparency and broad, distributed contributors (who would you sue? everybody at once?) and constant, real-time updates and improvements without lock-in or planned obsolescence would thrive when improved regulation gives avenues for redress and improves consumer awareness of security, as consumers flee the commercial silos in droves.
The regulations would be tailored to favor free software if the free software community had better lobbyists than the commercial silos. You can see that isn't the case.
Instead you can look at existing heavily regulated software markets to see what would happen: medical-device software, avionics software, car engine control units, cryptography before 01996, tax preparation software, PCI compliance measures. A vast wasteland of incompetence, waste, government graft, monopolies and duopolies, truly staggering profits, and easily avoidable deaths.
Consider: why aren't you wearing a Holter monitor? How about an automated electric defibrillator? Why isn't cryptographic security integrated into all the internet protocols?
One can only dream. What's likely to happen is the software industry will lobby the government and kill any law that doesn't favor their business model.
> If this happens, it will be the end of open source and the indie web
If I run over someone when driving a car, I'm responsible - not the car maker. If my customer's data is stolen, I'm responsible. Whether the makers of my software are responsible is a contractual matter - and nearly all open source licenses include a disclaimer of warranty and a limitation of liability, including the GPLv3 (see sections 15–17).
> Whether the makers of my software are responsible is a contractual matter - and nearly all open source licenses include a disclaimer of warranty and a limitation of liability, including the GPLv3 (see sections 15–17).
That was true in the US until MacPherson v. Buick in 01916 and in the UK until Donoghue v. Stevenson in 01932. Nearly all proprietary software licenses include the same disclaimer, but they are on slightly firmer ground in doing so, since typically those licenses are in fact contracts under common law, while the GPL explicitly purports not to be a contract and is very likely correct about that.
The kind of statutory imposition of liability we're discussing here would have to specifically outlaw such contract terms in order to work at all. You could imagine a statute that would specifically exempt open-source software licenses from that, but as explained comprehensively in this thread, such a statute would certainly not be the one that was passed.
If I build an unsafe boiler, and gift it to you, and then it explodes and kills you - am I not liable because it was a gift and not a sale? Can I disclaim away any liability and "fitness for purpose" when I gift you the boiler?
ETA: the first couple of Google results say that no, product liability can't be disclaimed away - particularly when there is no contract or opportunity for bargaining. I am very much not a lawyer but this sounds correct to me (i.e. this is what the law is).
Your second link mentions sellers avoiding liability by selling product (that can be inspected in stores) "as-is". It could be argued that open source falls in the same category. You have an opportunity to inspect it before using and if you don't like it or don't feel qualified to pass judgement, no one is forcing you to use it.
The second link doesn't mention "as-is", the first one does. I'll assume that's what you meant. It says,
> Though manufacturers cannot so easily escape liability, sellers can escape liability by informing the customer before the purchase that a product must be taken "as-is,” which means how the product was found when it was purchased in-store. “As-is” works because the buyer has an opportunity to inspect the product and decide whether to buy it given its condition.
On that analogy, Github and RedHat aren't liable, but the original author of the software still is.
Without a contract there was no liability in the US until MacPherson v. Buick in 01916 and in the UK until Donoghue v. Stevenson in 01932, as I just explained in the comment you are replying to.
Not if the rules are carefully targeted at SaaS and not at codebases. If the rules are targeted at SaaS, the liability is actually lower for open source because of the inherent transparency of everything open source code does.
Do you think Nancy Pelosi is going to ask Richard Stallman, the Debian Project Leader, and the Apache Foundation how the regulation should work? Or is she going to ask SalesForce, Google, Apple, and Microsoft?
Lots of people respect the FSF, Stallman, or both, and put a lot of effort into talking to them, but I have seen no evidence that any US legislator is among them.
I don't see why open source would end. Most open source software is not commercial. There's a massive and obvious difference between a person writing code and a huge obscenely rich corporation selling software to a wide audience. We expect much more from the latter.
There's also no liability associated with running a website. Simply refrain from collecting data of any kind and there should be no reason to worry.
The guy selling food on the street has liability in proportion to his profits; fifteen customers, fifteen potential food-poisoning cases. He can set his prices accordingly. Simon Tatham doesn't have any profits, but his PuTTY is installed on every developer's Windows machine. OpenSSL is installed on even more machines. How long do you think it would take your proposed regulatory regime to find that Kurt Roeckx owed several million dollars to every company that generated private keys with Debian's copy of OpenSSL? He did, after all, introduce the subtle security hole that left them wide open for years.
Maybe you could make the case that he was following best industry practices in doing so; after all, using Valgrind is a best practice, right? But you could also pretty plausibly convince a jury that he was negligent. Especially if you're IBM's senior counsel. Or, say, RSA's.
Now, is Kurt Roeckx or RSA going to be advising the US legislators who draft this candidate legislation, establishing the standards that they both must uphold?
That depends entirely on how the law is written. Legislators will ask commercial vendors how to write the law. Why would the commercial vendors choose to write it in the way you're describing?
If someone gets run down by a bicycle that a hobby repair shop failed to fix, it doesn't matter it was done for free by a guy that learned to repair bicycles during late nights.
The hobby repair shop can only be liable for a very small number of bikes, those they worked on. You cannot restrict the number of users of free source software, and you cannot restrict the user's risk profile. Like "good enough for an offline arcade game, but nothing else". Analogies have their limits.
But yes, lawmakers will decide, and given that they for instance try to de facto prohibit aftermarket OpenWRT installs, I have a guess how they would decide.
The company selling me a car is responsible to validate the security of each piece they got from a third party, and a restaurant is responsible to take care for the quality of the food it buys from the local bazar.
This is a completely unrealistic demand of software and security. I am really surprised of Snowdens arguments here.
The law makers cannot make the internet safer by one bit. Technical experts can and lawyers would dream to have leverage against them. They should be denied.
I deliver software for enterprise and there is no such thing. I even develop software for medical appliances that have an extended software validation process.
It is about minimizing risk and it is a process that acknowledges that risk cannot be removed completely. It just forces you to work carefully and eliminates neglectful practices.
No serious developer will ever commit to ship software free of bugs. On the contrary, that would give people false security, which can in turn lead to further neglect.
People like Simon Tatham and Kurt Roeckx, however fallible they may be, are doing a much better job of deciding how software security should work on the internet than Nancy Pelosi and Mitch McConnell would. The question is not how we can give more power to Nancy Pelosi, Mitch McConnell, Amazon, Google, and whoever the Trump voters vote in as the next president, to regulate Sci-Hub, BitTorrent, Bitcoin, WikiLeaks, DeCSS, Matrix, GDB, and OpenSSL; the question is how we can take that power away from them.
When the wise must obey the commands of the foolish, disaster ensues.
This makes no sense. Open source doesn't collect my personal information. (Except when it does, which is bad behavior.) Anyway, the law is capable of making reasonable distinctions where necessary.
Nearly every website that collects your personal information is running lots of open-source software. Sometimes, as with PHPSESSID and httpd logs collecting your IP, the collecting of that information is automatically done by that open-source software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Are your HTTPD logs adequately secured? Are their security measures audited monthly, in keeping with established industry best practices? Do you have comments enabled on your blog? What's your policy for expunging blog posts about people exercising their right to erasure? How did this defamatory comment spam get past your comment filter? Did you know your open-source image thumbnailing software is being used on an illegal pornography site? Why didn't your legal office respond within 8 hours when you were notified of a privacy invasion on your blog last Saturday?
What a load of FUD. Personal websites don't need anything more complicated than an out-of-the-box config for apache or nginx to serve static files out of webroot. When's the last time that kind of setup was exploited?
Sure if you add more complexity, you add more attack vectors, but there's an easy way to reduce your legal culpability there: just don't collect any PII. Even in the scenario you propose where anonymous HTTPD logs are a liability (which... yeah, is not going to happen any time soon) the solution is simple: turn off logging. If the legal precedent is established, the defaults of our software will change to match.
Clearly you've never had to be responsible for PCI compliance. PCI auditors have no patience for arguments like "When's the last time that kind of setup was exploited? If you add more complexity, you add more attack vectors!" and just want you to install the damned antivirus software like their guidelines say. Yes, even though you're running Linux. No, they don't care that there's a CVE in ClamAV every two months. They don't make the rules. And PCI DSS is written by for-profit companies that lose money when their rules don't work. Legislators only lose money when their campaign donors don't donate enough to get them re-elected and nobody will hire them for speaking engagements.
You're coming at this whole thing from the perspective that wise and sane rules would be put in place and then sanely enforced for the welfare of everybody—by the same US government that told people not to wear face masks to protect against covid, while also shipping defective covid tests from the CDC and prohibiting the use of any other covid tests. And that's a case where nobody was in a position to profit by making the rules hard to comply with.
Listen, you know and I know that you can serve a personal website perfectly well with /var/www and a stock Apache config. But the proposal we're discussing here is precisely to take that judgment call away from people like you and me and give it to people like Donald Trump, using laws written by, most likely, lobbyists from Oracle and Microsoft.
You're assuming quite a lot about me and not actually responding very directy to what I'm saying. However, reading this and some of your other responses makes it a bit more clear what the concern you're raising is.
> Listen, you know and I know that you can serve a personal website perfectly well with /var/www and a stock Apache config. But the proposal we're discussing here is precisely to take that judgment call away from people like you and me and give it to people like Donald Trump.
Let's revisit that proposal:
> 1. defining legal liability for bad code in a commercial product
> 2. making [website operators] legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected
I believe we both agree that neither of these technically apply to the personal website scenario (static hosting not collecting any PII).
So your argument as I understand it is: in order to make the above liabilities legally enforcable for scenarios where they do make sense, we will end up with regulations similar to those for handling "sensitive" data (such as financial/medical information) being imposed on _all_ software / online services (such as basic static websites). This will happen because laws will be written in an environment of near-total regulatory capture.
This argument is plausible, but it relies on a bit of a non-sequitur: expanding the scope of data collection/handling regulations will inevitably extend to regulating the publishing of software.
It might be in the interest of the current software behemoths to push for such a system, but I don't really see it. They derive too much economic value from the current "free as in lunch" open-source to shoot themselves in the feet like that. It seems more likely they would:
1. try and narrow the scope of their own liability (by heavily constraining which categories of software carry that burden)
2. try to minimize the costs to themselves (by demanding compensation from governments for the work required to meet those regulations)
3. try to offload liability to vendors (who can then demand compensation for taking on that liability).
Points 2 and 3 could be a large cash cow for free and open source software, though I doubt many will be able to successfully capitalize on it.
I wasn't responding directly to what you said because it's irrelevant. You were pointing out that in fact hosting a personal website doesn't in fact expose its visitors to a lot of risk, especially if it's a static site instead of a blog or something. But that doesn't imply that people hosting their own personal websites will find it easy to comply with a regulatory regime tailored to raising the barriers to entry for "the next Facebook". More likely they will find it infeasible.
It's true that imposing liability for publishing defective software is logically independent from imposing liability for collecting unnecessary PII that leaks. But pjmlp's quote from the article we were commenting on explicitly proposed doing both of these:
> For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected.
So my argument does not, as you say, "rely on a bit of a non-sequitur: [that] expanding the scope of data collection/handling regulations will inevitably extend to regulating the publishing of software." The proposal in question is to both regulate software publishing and also regulate data handling, so it's irrelevant whether or not the scope would thus "inevitably extend" from one to the other.
Probably it is true that the most favorable situation for the current incumbents would be to have no liability, as at present, or as minimal liability as they can get away with. But the second-most-favorable situation, and one that is definitely politically viable even if the current situation is not, would be to have a regulatory regime that raises the barriers to entry for new entrants as much as possible and prevents disruption to their markets, by enshrining in law the particular way they're doing business today: AI melody recognition for prior restraint of free speech, combined with armies of outsourced moderators to watch for terrorism and pornography, centrally-controlled app-store platforms, locked-down end-user hardware (with a grandfathered carve-out for desktops and laptops), real-name policies, fax-us-your-passport ID verification, "two-factor" authentication that turns out to be one-factor, and so on. Anything that encourages you to post stuff on your own blog or website would be a big drawback for GitHub, YouTube, and Fecebutt.
Personal website - what if someone takes over your server and does malicious stuff?
Are you going to put up with accountability that you might have misconfigured something and it allowed attackers to scam people or serve porn?
You are perfectly sure that you are going to keep your small site updated all the time and you won't forget about it?
Because that is where it is going - it is not just code that can be vulnerable - but also combination of different software, combination of configurations. If you install 2 applications they might interact in a way that makes your system vulnerable.
Software is infinitely complex we can cut down complexity but then anything that is useful and complex will cost a lot more.
> what if someone takes over your server and does malicious stuff?
What if somebody steals my kitchen knife and uses it as a murder weapon?
> Are you going to put up with accountability that you might have misconfigured something and it allowed attackers to scam people or serve porn?
Yes. This is (and always has been) the price of operating a website on adversarial public networks. We established relatively simple ways to make this possible even for individuals decades ago.
> You are perfectly sure that you are going to keep your small site updated all the time and you won't forget about it?
As I replied to the sibling comment, when was the last time there was RCE for Apache or Nginx configured to serve static files from a webroot? We are talking about personal websites here after all.
> Software is infinitely complex we can cut down complexity but then anything that is useful and complex will cost a lot more.
I think I disagree with you on where the threshold of usefulness is.
I agree that Apache and Nginx are not critical attack surfaces, especially for static web sites. I have been experimenting with running static sites on Cloudflare Pages, delegating security and infrastructure to them. This goes against my desire for decentralization, however. I usually use GCP for my web sites and it is so little effort to occasionally start a fresh VPS, a few git pulls, and copy an Nginx config file, and flipping DNS settings. Automating this process to happen frequently would avoid the problems associated with hackers taking over your servers and use them long term.
Cutting down things that are unnecessarily complex would be a good start. I.e. most websites out there could be easily replaced by static code generators. Webauthn and client certificates can be used to protect admin interfaces. Technology is here but there is no demand for it because making things less secure is way cheaper.
I disagree with Snowden here. Liability is an extremely bad approach and would not solve the problem at all. It would also fortify companies that can pay for guarantees nobody could ever give.
That we have security flaws is always inevitable. Better languages might help but are no panacea.
I agree with Snowden on a lot, but this doesn't solve anything.
The result would be software certificates. By whom? Take a guess.
Nobody can guarantee absolute safety. This is a trap you don't want to fall into.
It would end open source and any independent development. Quite surprisingly short sighted by Snowden.
The problem with iMessage wouldn't be solved by liability. It is a security flaw that cannot be removed by law.
edit: To clarify: I agree with him in the Facebook example. They collected the data for their business and should be liable. "Bad" or "insecure" code is a different matter however.
> The problem with iMessage wouldn't be solved by liability. It is a security flaw that cannot be removed by law.
If they had financial incentives to not get hacked, it would make more financial sense to port non-memory safe c and c++ code to swift and rust. (Currently way too much effort to be worth it.) It would also incentivize better security layers like sand boxing.
Only contract with companies that either have a reputation for upholding their end of the bargain without a court threatening them (ie most good companies), or only contract with companies where you have a reasonable expectation of being able to win a fair court case.
As an example of a more generalised version of the former: Amazon is pretty generous in their customer service, and you don't typically have to sue them to get them to eg give you a refund.
Reputation is a powerful asset, and companies often want to protect theirs.
(Not always, though. Amazon is less nice to sellers or employees, I think, for example.)
> talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected
> talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected
That's kinda sorta one of the goals of the GDPR. And they go farther as they're liable for any leak of personal data, not just the unnecessary personal data.
There are definitely a lot less pharmaceutical manufacturers now than there were before the Pure Food and Drug Act passed in 01906; ten companies have 40% of the whole worldwide drug market, and if you start openly making and selling drugs yourself (like Coca-Cola in 01886 and 7-Up in 01920), you will probably get arrested within a month. Almost nobody makes drugs as a hobby now.
There are certainly people who would like to make it so that the same thing happens with software and online publishing: a few companies controlling almost all of the activity, and if you release any software or host a blog without working for one of those companies, you get arrested within a month. Other people don't intend that, but advocate policies which would have that effect.
Not sure, it's hard, since we seldom have randomised controlled experiments here.
Perhaps try looking for natural experiments, eg compare between countries, or between different sectors.
(Sometimes there's also silly legislation you can exploit for statistics, like the Onion Futures Act (https://en.wikipedia.org/wiki/Onion_Futures_Act) which can help to see the impact of futures trading on commodities.
Perhaps there's some corner of the pharmaceutical market that wasn't hit or was less hit by the Pure Food and Drug Act?)
I don't think it's the same argument. Being liable for the things you actively and intentionally do to all of your customers is not the same as being liable for a risk inherent in a medical procedure that you've done your due diligence to prevent and warn about. In either case, there should be some form of accountability, but they are not at all the same thing.
Side effects are expected. Vaccines provide enormous benefit but are not without risk. Patients must receive information about risks and choose whether to accept or reject treatments.
This is not at all comparable to corporations slurping up all data they can get their hands on for marketing purposes. Modern medicine provides enormous benefit for society. Surveillance capitalism... doesn't. Certainly not enough to justify the massive abuses being perpetrated.
I agree however allowing any company regardless of its business the opportunity to escape liability of consequences is dangerous. Pharma companies have in the past and will continue to have their scandals same as any other industry. There shouldn’t be exceptions. Who gets to define what industry is important or not and therefore avoids regulation is dangerous as it’s only as reliable as the “who’s” in control.
I'm not saying pharmaceutical companies shouldn't be regulated. I objected to the notion they should be held liable for side effects. Those are known risks inherent to the treatments.
Widespread data collection on the other hand is totally unnecessary and should absolutely be a massive liability for any company that does it.
Where there is no liability, there is no accountability... and this brings us to the State. "
Yep, this definitly needs to eventually happen.