Bottomley: Solving the Looming Developer Liability Problem [LWN.net]

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 12, 2023 23:50 UTC (Tue) by karim (subscriber, #114)
In reply to: Bottomley: Solving the Looming Developer Liability Problem by khim
Parent article: Bottomley: Solving the Looming Developer Liability Problem

Here's what you'd find on the copyright page of an O'Reilly book from 20+ years ago:
"While every precaution has been taken in the preparation of this book, the publisher and author assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein."

No different that opening a legal discussion by saying that "I'm not a lawyer and this isn't legal advice" or a medical discussion by saying "this is my personal experience, speak to a doctor to get professional advice." etc.

In other words, documentation that's worth doing anything meaningful has always benefited from the proper disclaimer. And, honestly, I don't buy the nefarious example you're mentioning. 99.9% of open source documentation goes nowhere near that sort of territory and I'm not reading that the legislator views code for the conduct of business operations on the same footing as something that can easily be misused to intentionally cause harm.

You *may* have a point about distribution of binaries or hosting a free service. But then, even if you're right, the disclaimer of liability belongs on that binary or free service, not the sources. Distribution of those binaries and services are a separate act from contributing code. And for those distributing such binaries/services then the liability disclaimer could be easily affixed to the "end product/service", with possibly even required explicit ack'ing for download/use, with zero repercussion on the developers that wrote the code. That's with a big IF on the courts viewing someone making a Linux distro as part of community effort on the same footing as, say, a bank offering online service to its for-charge users.

to post comments

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 13, 2023 0:30 UTC (Wed) by khim (subscriber, #9252) [Link] (1 responses)

> Distribution of those binaries and services are a separate act from contributing code.

Not in today's world. Only tiny number of projects only distribute sources and send you to look for the binaries in some other place.

Heck, modern forges are designed to make it easy for the developers to publish binaries — and very often it's not that easy to even find sources of many Python packages.

> That's with a big IF on the courts viewing someone making a Linux distro as part of community effort on the same footing as, say, a bank offering online service to its for-charge users.

Since legislators explicitly say that it's the goal… that would happen, sooner or later.

And yes, I agree that if, eventually, most open-source projects would stop publishing binaries directly and it would stop being possible to just blindly add millions of lines of code to your project from npmjs.org… in that world developers would be out of danger.

But we far from being in that world.

The companies that pull millions of lines of code from npmjs.org assume it's not their responsibility to review all that code: they haven't touched it, thus, naturally, someone else would be held responsible is something would go wrong. Just like it would happen if car dealer would sell you defective car.

And open source developers are blissfully unware about what happens with what they have developed, because hey, they are not selling anything, how can they be held liable?

In a world where no one may be held liable… bad things happen.

Who exactly would be held responsible, in the end, would be interesting to know. But you may be 100% sure that idea that if I take few millions of freely available lines of code in the form of Debian and npmjs.org and then add 1000 lines script on freelancer.com, then I, suddenly, is responsible not just for my 1000 lines but also for all these millions of code that I downloaded… that idea wouldn't fly.

Someone else would be held responsible. Who and how? That remains to be seen.

Bottomley: Solving the Looming Developer Liability Problem

Posted Dec 13, 2023 0:39 UTC (Wed) by bluca (subscriber, #118303) [Link]

Legislators said no such things, enough with the FUD. Responsibility is with who puts products on the market, as it should be.