Bottomley: Solving the Looming Developer Liability Problem [LWN.net]

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 10:03 UTC (Tue) by dvrabel (guest, #9500)
Parent article: Bottomley: Solving the Looming Developer Liability Problem

A structural engineer can't stick fine print on a bridge that says "cross at own risk".

You can't sell a toaster that could electrocute the user.

Why do software developers think they should be able to produce something that causes harm to their users and accept no responsibility for this?

to post comments

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 10:26 UTC (Tue) by b7j0c (guest, #27559) [Link] (7 responses)

And yet every real estate contract includes a waiver on contingencies...at some point the buyer agrees to accept risks known and unknown.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 11:04 UTC (Tue) by farnz (subscriber, #17727) [Link] (6 responses)

In many jurisdictions, though, that waiver is unenforceable if the vendor does not make the buyer aware of a deficiency that the vendor knew about, or should reasonably have known about. So you can disclaim a defect in the foundations that's developed since the house was built, but not a defect in the furnace that should have been visible the last time you had the furnace serviced.

And, as with other forms of liability, this form travels along a chain; if the vendor had the furnace serviced by a contractor who didn't report the defect to the vendor, then the contractor's liable to the vendor for the liability the vendor has to the buyer, plus the vendor's reasonable costs in handling that liability.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 14:09 UTC (Tue) by Wol (subscriber, #4433) [Link] (3 responses)

The main exception to this is where something is explicitly sold "as is". This is a massive red flag, and should set most buyers running for the hills, unless they are consciously willing to write off their money if they get a lemon.

Cheers,
Wol

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 14:47 UTC (Tue) by farnz (subscriber, #17727) [Link]

Even sold "as is" isn't enough to escape liability in my jurisdiction (England & Wales); to make an "as is" sale, you must accurately represent the state of the product, including the issues you know about, or should reasonably have known about. In addition, if you're selling as a business (and not as a private individual), you must also list any issues that would affect my decision to buy the product, even if you don't yet know about them.

However, you're allowed to get it wrong in my favour; for example, you can sell a car as "non-running, engine possibly failed, all parts possibly broken, only suitable for use as scrap metal" when the only thing that's wrong with it is that you haven't put fuel in the tank. If I then buy it, and determine that the only fault is lack of fuel, well, that's me in luck. If, on the other hand, it's rusted through and is just so much scrap metal, well, that's what you promised me, so it's fine.

Private sellers, on the other hand, just have to list what they know about, and what they reasonably should know about - but importantly don't have to tell me about things that might affect my decision otherwise. So a private seller can sell me the same car as "doesn't start", and not have to warn me about other things, unless it's unreasonable for them to not know about them - e.g. they might have to say "timing belt last changed at 135,000 miles, car now at 220,000 miles", since that's a reasonable thing to know about, but not tell me that the metal under the seats is beginning to rust, because who lifts the carpets to check?

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 15:00 UTC (Tue) by b7j0c (guest, #27559) [Link] (1 responses)

Most homes in high-demand areas sell "as-is". If you don't want to buy it, the next person will. The buyer of our last home waived contingencies on the first offer before ever stepping inside the property. This is pretty common.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 15:19 UTC (Tue) by farnz (subscriber, #17727) [Link]

Waiving contingencies is not the same as "as-is"; it says that as the buyer, I am willing to first show that you had actual knowledge of, or should reasonably have known about, a problem I find before I can hold you liable for any part of it. This makes the sale simpler for the vendor, since in most cases, you don't have problems that you don't know about but reasonably should know about, so it limits the complexity of your disclosure requirements down to "what problems do I have with the house that I know about but haven't yet fixed?"

If you genuinely were selling the house "as-is", you wouldn't need to disclose anything other than the extent of the plot of land, and everything else is simply "as is", and not something you describe in the sale contract.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 14:50 UTC (Tue) by b7j0c (guest, #27559) [Link] (1 responses)

Of course "Failure To Disclose" means a breach of contract from the seller's side...it would be akin to publishing stolen commercial code as MIT licensed.

My point still stands imho...in the US there is a longstanding precedent for "caveat emptor" ("as-is" carries meaning).

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 14:55 UTC (Tue) by farnz (subscriber, #17727) [Link]

In many jurisdictions, however, "as-is" does not carry the meaning you're describing - it means "I have told you everything I know about, and everything that's reasonable for me to know about, and I'm not taking responsibility further", and not "caveat emptor", where even if I should know about a problem, it's still your problem when you buy something from me.

In general, you can't, even in the US, say simply "caveat emptor"; you have to first make a good-faith effort to disclose what you know about the product. The only thing that you can do is be wrong in the buyer's favour - you can say "I believe this lock is trivial for a lock picking expert to open" when in fact it's hard for an expert to open, or "I believe a thief could break this safe open in under 30 seconds" when it'd take them 30 minutes to break it open.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 10:27 UTC (Tue) by snajpa (subscriber, #73467) [Link] (7 responses)

The structural engineer in your example is earning a living by designing bridges. Consider if a hobbyist drew up a bridge completely on their own free time and then published the result "AS IS". Who is going to be liable when that bridge falls after being constructed? I'd love to see an argumentation that makes the hobbyist "designer" liable.

IMHO, the license stated the software was provided "AS IS" and if you still put it in your product and it blows up due to a bug in the code you pulled, it is you who is liable for the mess, not the person who made the mistake in the code. They didn't force you to pull the code that says it comes without any guarantees. You could have written your own, for example :)

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 10:33 UTC (Tue) by snajpa (subscriber, #73467) [Link]

... it of course turns into a completely different debate when the "AS IS" is included in a commercial software license. Or when there is a support contract on top of the FOSS "AS IS" clauses. But I'd say that is pretty irrelevant for the FOSS world as such, that problem is of the commercial actors in the software market as whole to deal with :-D

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 11:55 UTC (Tue) by Lennie (subscriber, #49641) [Link] (2 responses)

Pretty certain in a lot of jurisdictions they will take down the bridge if you open it for the general public.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 12:40 UTC (Tue) by snajpa (subscriber, #73467) [Link] (1 responses)

I was thinking about a situation when the plans for the bridge are picked up by a party completely unrelated to the hobbyist engineer, perhaps even without their knowledge at all. Imagine if someone decided to build that bridge and it'd have passed through the whole process with all the checks and get built. That is IMHO in the same league as FOSS + "AS IS" in the licences. I'd say there is a hard boundary and the problem has started when the free plans were picked up to build an actual product that was monetized, rather than the moment when the plans with the flaw were published free of charge (and "AS IS").

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 12:45 UTC (Tue) by snajpa (subscriber, #73467) [Link]

To extend that line of thing a little further: we should IMHO be warning hobbyist developers about the looming support contracts boom, not the "looming developer liability problem", so that they don't get burned by conditions too unfavorable to them. Profit-makers are going to try to shift the blame in the cheapest ways they can. So contracting that original enthusiast and shifting the blame to them is a no brainer. IMHO there should be a place where turn to for legal support/advice when that comes.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 21:53 UTC (Tue) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

> Who is going to be liable when that bridge falls after being constructed?

For the bridge to be constructed, a licensed civil engineer has to sign off on the design, usually in exchange for a hefty sum of money. And they would be responsible if it falls. It fits perfectly into the proposed European framework.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 22:05 UTC (Tue) by snajpa (subscriber, #73467) [Link] (1 responses)

Awesome observation. Also pretty relevant in how is the framework going to be interpreted across the European courts on various levels. I think reaching for similar examples would be exactly what would our courts do here. Some other, way more far-reaching, legislation would have to come into existence - explicitly putting "random bystanders" on the hook - in way more industries than just IT, for FOSS to be affected as much as some are trying to scare us it will be.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 13, 2023 10:29 UTC (Wed) by Wol (subscriber, #4433) [Link]

As I said above, the ENTIRE European consumer rights edifice is built on the premise that the SELLER is responsible to their CUSTOMER.

On that basis, J Random Developer of Nebraska does not have any CUSTOMERs.

(Of course, it's more complicated in that it's meant to catch people who *pretend* not to have customers, but for J Random, it's pretty clear cut.)

Cheers,
Wol