Schneier on free software and liability

I think Schnier is wrong on this, and thought so for a long time. We 
don't need vendor liability for any kind of software. Furthermore "free 
software" and "gratis software" are hard to properly define. Would Red 
Hat Enterprise Linux be considered as software under liability.

I'd rather see more activity by users and open source developers on 
finding bugs in software, improving its quality, adding tests, and 
updating the system (a la Debian's apt-get) than enforcing software 
liability by law, which is likely to kill the software world as we know 
it, including the FOSS ecosystem.

I am not sure that Schneier is right here, although he is certainly in the top percentile of
cluefulness in the computing community about such issues. I am however certain that we do need
some sort of liability for insecure software.

Currently, a pay-big-bucks software vendor can sell something insecure as hell, to users that
won't perform security upgrades, letting bad guys compromise a bunch of systems and use them
for antisocial purposes.

In the status-quo, the liability lies with whoever is performing the antisocial activity. But
the job of bad guys is greatly facilitated by the carelessness of the rest of the society. In
effect, insecure software vendors and users are polluters. They pollute the internet with
exploitable systems.

The current situation is a case of tragedy of the commons. The only way to fix tragedies of
the commons is to turn externalized costs into internalized costs. In the context of software,
that means making either the users or the vendors liable for insecure software.

Please prove me wrong.

My preferred approach ends up pretty much the same place Schneier does, 
but gets there differently.  I'd simply make the EULA bit about 
disclaiming liability entirely unenforceable (they can't disclaim it) if 
the code wasn't available to examine or to have a trusted representative 
(for those who don't read code themselves) examine.  If it's a black-box, 
they don't get to disclaim responsibility for what's in it.  If it's a 
transparent box, the code is available to examine without fear of being 
sued for using the same ideas (even if it's not entirely free to 
copy/modify), then and only then could they disclaim liability.

The effect would be not to /ban/ code without source available, but to 
drive up the cost and provide a strong incentive to make the sources 
available for examination, at a minimum.  If they didn't, they'd simply 
have to provide liability coverage, which someone like MS might afford on 
its own (we'd soon see how much they believed their own security talk and 
later how practical it was, by how much they upped the price in ordered to 
cover that liability), but which most proprietaryware companies would have 
to buy, with the insurance companies exercising due diligence before 
agreeing to cover it, and charging accordingly.

I've not thought a whole lot about where gratis but non-libre software 
would fit, but Schneier's contract idea might work there, allowing gratis 
but non-libre software to still exist (at least as long as there wasn't a 
EULA, which might be seen as a contract anyway, even for gratis 
software... and then there's the whole adware and etc thing to worry 
about) -- if the provider could justify it economically, either as a hobby 
or as a loss-leader, of course.

In any case, I now choose not to agree to EULAs as it is, gratis or not, 
for two reasons.  If they don't respect my rights, not only will I not 
sign them away, but I don't trust their word on the black-box they are 
providing either, and certainly won't take on myself liability for what 
they are disclaiming.  Thus, effectively, I don't and can't install 
proprietaryware, even if I might otherwise want to.  So regardless of 
whether such a thing ever comes to pass by law, it's already effective if 
they're dealing with me.  If they don't respect my rights including the 
four software freedoms, I don't trust them enough to run their software.  
Simple as that.

Duncan