EU situation should be looked at by everyone [LWN.net]

EU situation should be looked at by everyone

Posted Dec 12, 2023 23:44 UTC (Tue) by bluca (subscriber, #118303)
In reply to: EU situation should be looked at by everyone by khim
Parent article: Bottomley: Solving the Looming Developer Liability Problem

> And you want to make that one guy responsible for all the liabilities that may happen in millions lines of code which said guy got from MythTV project

Obviously not. MythTV, as a legal entity, is liable, not a random employee. How they arrange to fulfill that liability is their problem.

> This idea would just mean that the majority of EU software industry (which mostly includes tiny companies which take existing products from large US companies and open source guys and add small amount of glue code) would be wiped out.

Good! If they can't maintain secure software, they must be stopped form being in business. If you can't build a car that satisfies safety requirements, you go out of business. If you can't produce food that satisfies quality requirements, you go out of business. If you can't produce medicines that satisfy health requirements, you go out of business. Why on earth should it be any different for the electronics consumer market? It's mad that this no man's land was allowed to go on for as long as it did, and it's about time the adults stepped in and put some order in this absurd mess.

> That, by necessity implies that large open source “forges”, if, maybe, not individual contributors, would have to deal with liabilities.

This is an absurd, hallucinatory non-sequitur that has no basis in reality, laws or regulations. It's FUD of the highest order. The liability is with whoever puts the product on the market. It boggles the mind that it has to even be said.

to post comments

EU situation should be looked at by everyone

Posted Dec 13, 2023 0:13 UTC (Wed) by khim (subscriber, #9252) [Link] (9 responses)

> MythTV, as a legal entity, is liable, not a random employee.

What legal entity? I'm not sure if Isaac Richards passed rights for mythtv.org to someone, but even if he did there are lots of projects out there which work as critical part of our digital infrastructure yet are still, formally, personal projects of someone.

> If you can't build a car that satisfies safety requirements, you go out of business.

Nah, you get billions of government bailouts.

> If you can't produce food that satisfies quality requirements, you go out of business.

Only if you couldn't fix things that you are required to fix even with government subsidies.

> If you can't produce medicines that satisfy health requirements, you go out of business.

Not before you would get money to fix the issues and recommendations to follow.

> Why on earth should it be any different for the electronics consumer market?

Who said it's any different? EU does work to ensure businesses survive, electronics consumer market is not an exception. Yes, there are both stick (government makes sure there are requirements to follow) and carrot (government makes sure requirements are not too onerous and only affect the ones unwilling to follow the requirements).

Electronics consumer marker is not treated any differently.

> This is an absurd, hallucinatory non-sequitur that has no basis in reality, laws or regulations.

Right now yes. And that's what EU is fixing.

> The liability is with whoever puts the product on the market.

Yes. And EU, quite sensibly, says that these entities have well-known names: Apache Software Foundation, Linux Foundation, Debian and so on.

Significant amount of code in Debian is created by huge corporations, after all. Critical pieces, without which Debian wouldn't exist: GCC, Clang, Linux kernel and lots of other software. Which is a fact. And, according to EU, the whole scheme with “noncommercial foundation which couldn't be held responsible” is just a thinly veiled scheme to shirk responsibility. Why should it be allowed to continue?

> It boggles the mind that it has to even be said.

Lawmakers are equally baffled. I mean: does a car dealer have a liability if car have defect? Only if said dealer tinkered with it and made it unsafe, right? Why then someone who sells you Debian or PostgreSQL should be held responsible if that's not their fault?

EU situation should be looked at by everyone

Posted Dec 13, 2023 1:32 UTC (Wed) by bluca (subscriber, #118303) [Link]

> What legal entity?

The one that sells the VCRs you were talking about, obviously, they are the ones putting a product on the market.

> I'm not sure if Isaac Richards passed rights for mythtv.org to someone

I have no idea who that is, but as long as they are not selling in the single market, there's nothing for them to do

> but even if he did there are lots of projects out there which work as critical part of our digital infrastructure yet are still, formally, personal projects of someone.

Projects don't end up as "critical infrastructure" by osmosis. Somebody puts them there. A repository on Github doesn't magically end up running a power plant all by itself.

> Nah

Very much yes. Try and go sell cars with non-working seat belts and refuse to recall them and fix them, and see how far you go before you are dragged in court.

> you get billions of government bailouts.

What bailouts? What are you on about?

> Only if you couldn't fix things that you are required to fix

Yes, exactly

> even with government subsidies.

What's this obsession with "government subsidies"? Are you American by any chance?

> Not before you would get money to fix the issues and recommendations to follow.

Receive money? From whom? Can I get some too?

> Who said it's any different?

You did

> EU does work to ensure businesses survive

No, it does work to ensure the _market_ survives, which crucially includes customers. Ever heard of the GDPR? Find me one business that liked that

> electronics consumer market is not an exception.

It very much is right now, before this regulation fixes it

> Yes, there are both stick (government makes sure there are requirements to follow) and carrot (government makes sure requirements are not too onerous and only affect the ones unwilling to follow the requirements).

Sticks were notably absent, until the CRA came along

> Electronics consumer marker is not treated any differently.

It's fundamentally different right now. Try selling cars with non-working brakes and refuse to recall them to fix them, and see how you fare. Now try selling phones with known security vulnerability and refuse to fix them - no need to use your imagination, this happens daily all over the European market.

> Right now yes.

That's weapons grade nonsense

> And that's what EU is fixing.

No, the EU is fixing a fundamentally broken market where corporations take advantage of a lack of rules and regulation to push out known broken products with no liability, putting customers at risk

> Yes.

Indeed

> And EU, quite sensibly, says that these entities have well-known names: Apache Software Foundation, Linux Foundation, Debian and so on.

The EU never said any such thing

> Significant amount of code in Debian is created by huge corporations, after all.

And nobody cares, since Debian is not a product, so it could be made by green men from Mars for all that it would matter

> Critical pieces, without which Debian wouldn't exist: GCC, Clang, Linux kernel and lots of other software. Which is a fact.

It also wouldn't exist without oxygen and electricity. Which is also a fact.

> And, according to EU, the whole scheme with “noncommercial foundation which couldn't be held responsible” is just a thinly veiled scheme to shirk responsibility.

Debian is not a foundation, so I have no idea what you are talking about at this point, but I suspect that you don't either

> Why should it be allowed to continue?

Because it's not a product on the market. We've been over this already, it's not that difficult.

> Lawmakers are equally baffled.

By posts such as yours and FUD blog posts by the ASF? Probably, assuming they ever came across them, they would be I imagine, yes

> I mean: does a car dealer have a liability if car have defect?

Obviously? Why would the shop of a car company that sells to the public not be liable?

> Only if said dealer tinkered with it and made it unsafe, right?

Uh? Why would a car company seller "tinker" with a car that they got from their employer and that they are selling on their behalf?

> Why then someone who sells you Debian or PostgreSQL should be held responsible if that's not their fault?

Because they are putting a product on the market. I really don't see what's so difficult about this, it seems really straightforward.

EU situation should be looked at by everyone

Posted Dec 13, 2023 10:24 UTC (Wed) by Wol (subscriber, #4433) [Link] (7 responses)

> I mean: does a car dealer have a liability if car have defect? Only if said dealer tinkered with it and made it unsafe, right? Why then someone who sells you Debian or PostgreSQL should be held responsible if that's not their fault?

This is not right. In fact, it's so bad it's not even wrong. IT'S TOTAL GARBAGE.

Europe's entire consumer protection legislation edifice is BUILT on the premise that the guy who SELLS the product IS LIABLE.

I've just bought myself a car. A brand new Volkswagen to be precise. And let's assume the engine fell out on the way home and the car was destroyed. THIS IS NOTHING TO DO WITH VOLKSWAGEN. The law places ALL responsibility on the dealer. (We'll forget that I have a legal liability to have insurance, and that will absorb a chunk of it.) It is the DEALER'S problem - he may - should - have backup contracts / liability sharing / what-have-you with Volkswagen, but that's down to him. As the consumer, I go to the dealer, and HE HAS TO FIX IT.

I've actually used that, with that big retailer who "is never knowingly undersold". A three month old phone broke, and I took it back. The crucial point here is I bought it end-of-line in a sale ... They said to me "We can't replace it, we have a deal with the manufacturer so we can't repair it, you can have a refund". Leaving me £20 out-of-pocket if I replaced it like-for-like. I just replied "It's got a warranty. Repair or Replace. Otherwise you're charging me for a warranty repair."

It still ended up costing me £20, but that's because I got an upgraded replacement, and that was the difference between like-for-like and what I walked off with.

Which is why people like pizza should have nothing to worry about.If he's uploading to some random forge, there is no "placing on the market" to trigger liability. To the best of my knowledge, forges have nothing to worry about either, because they provide a market place, they aren't placing anything on the market either. (And I think that might actually be explicit in the legislation.) And even if pizza's doing stuff for money, all he needs is for the contract to say either (a) that pizza will undertake best efforts and his employer will warrant to fix things if they break (probably by employing pizza again), or (b) pizza will include the cost of insurance in the invoice. And if the employer doesn't like it, well he's always (with Open Source) got a third choice - do it himself!

Cheers,
Wol

EU situation should be looked at by everyone

Posted Dec 13, 2023 11:03 UTC (Wed) by khim (subscriber, #9252) [Link] (5 responses)

> As the consumer, I go to the dealer, and HE HAS TO FIX IT.

Sure, but we are not talking about that. We are talking about the next step: what happens after.

All car dealers that I have ever saw contacted manufacturer if that's their defect. Sure, if someone stole some screws while car was with dealer and manufacturer is not to blame and car dealer goes to court.

But if car dealer can prove that he haven't touched anything and goods were defective when they left the factory then it's on manufacturer, 100%.

The law applies the exact same tules to software. Why it's so hard to understand and accept?

> Which is why people like pizza should have nothing to worry about.If he's uploading to some random forge, there is no "placing on the market" to trigger liability. To the best of my knowledge, forges have nothing to worry about either, because they provide a market place, they aren't placing anything on the market either.

Sorry, but this couldn't be right. One of them have to be responsible. Like in retail: supermarket may be selling under their own name and then would be responsible, or may provide space for others to put their booth and then these others would be responsible, but someone have to be liable, or else why have the whole charade of a law if no one is responsible for anything?

> And if the employer doesn't like it, well he's always (with Open Source) got a third choice - do it himself!

And that is why the law is shaped like it's shaped. It's completely inconceivable that one guy which you can find on freelancer.org and which knows how to combine LAMP with 100 lines of his own code should be responsible for the whole thing. Someone big enough must be responsible, or else the whole scheme wouldn't work. Even if some idiotic lawmaker would try that said guy simply have no means to review and support millions lines of code in LAMP.

And yes, if that would mean that open source would disappear entirely and would be replaced by Microsoft and Oracle $$ offerings then lawmakers would accept that: in that world would always have someone who can be, reasonably, made liable for software.

EU situation should be looked at by everyone

Posted Dec 13, 2023 11:15 UTC (Wed) by farnz (subscriber, #17727) [Link] (2 responses)

Legislatively, the liability stops with the car dealer. If the manufacturer says "nope, not going to fix it, your problem", that's the car dealer's problem to deal with.

In practice, as a result, car dealers refuse to sign contracts with manufacturers that permit manufacturers to say that - they instead require manufacturers to sign up to contracts that allow the dealer to pass liability backwards down the chain to the manufacturer.

But, for example, if the car dealer you bought your car from goes bankrupt, you have no legal claim against the manufacturer, only against the car dealer's remains. Manufacturers will usually intervene in this case, for the benefit of the brand, but they are under no legal obligation to do so.

The CRA, while not perfect, is an attempt to try and fit similar rules to software - it's just that because of the nature of software, it's a lot easier for vendors to sell you just one piece of the final product (a simple piece like a start-up script), and require you to assemble the rest of the software from other places, and the CRA wants to block off that sort of shenanigans. But this is new rules for software.

EU situation should be looked at by everyone

Posted Dec 13, 2023 11:38 UTC (Wed) by khim (subscriber, #9252) [Link] (1 responses)

> Legislatively, the liability stops with the car dealer. If the manufacturer says "nope, not going to fix it, your problem", that's the car dealer's problem to deal with.

You are talking about defect fixing. I'm talking about liability. And, of course, in case of accident your car maker may be found liable and that doesn't depend just on what contract between dealer and car maker says.

Manufacturer can disclaim some liability, sure, but not everything.

> But, for example, if the car dealer you bought your car from goes bankrupt, you have no legal claim against the manufacturer, only against the car dealer's remains. Manufacturers will usually intervene in this case, for the benefit of the brand, but they are under no legal obligation to do so.

Lol. That loophole was closed years ago. I still remember times when law worked like that in Russia. Big companies just never sold anything, they created tiny dealers which sold good and then went disappeared after 3 or 6 months. And then your warranty was pretty much pointless and you companies could save money. That's a no-brainer scheme, really.

Of course these loopholes were patched up and today law doesn't work like that. Whether manufacturer would be help liable or not is determined by a large body of law, but if car design defect leads to deaths it's almost always judged to be manufacturer's fault.

Why defect in MySQL or Apache Web Server shouldn't be treated in the same way?

EU situation should be looked at by everyone

Posted Dec 13, 2023 12:07 UTC (Wed) by farnz (subscriber, #17727) [Link]

In the UK, it still works like that - the manufacturer can disclaim all liability and pass it onto the dealer. The dealer is the entity that cannot disclaim liability. A US lawyer talking about liability in the US is kinda irrelevant here - we're not (yet?) a state of the USA.

We closed the loophole differently; the liability for manufacturing defects is created at the time the sale happens, and is thus part of the company that you have to handle while you close the company down; if you've not done so, then the directors of the company that was closed down have committed a criminal offence, and can both be forced to pay out the liabilities personally (possibly making them bankrupt), and banned from ever running a UK company again. This makes the trick you describe effectively impossible - you need to find genuine directors for your new company (otherwise it's just a trading name of the manufacturer), and you will not be able to do so if you're burning through them every 3 months or so, and discarding them with huge liabilities that they agreed to.

Further, to close a company down requires you to transfer all of its assets and liabilities out - if you transfer assets out without transferring out liabilities, then the company becomes insolvent, and the asset transfers can be undone to make the company solvent again (since it's illegal to engage in any transfer that makes the company insolvent). The only way to leave liabilities behind is to go bankrupt, but in UK law, that requires you to prove that the company could not continue trading - and also opens up opportunities for the bankruptcy court to "pierce the corporate veil" and say that the company is merely a front for another entity, who thus is liable for everything the company did as-if they did it themselves. In the case of the scheme you describe, the company would be deemed (in bankruptcy) to be a front for the manufacturer, and thus the manufacturer becomes liable because they created the company purely to avoid liability.

And if you remember when it worked like this in Russia, then Russia had this problem a long time after the mechanisms I loosely describe above came into being in England & Wales; these mechanisms built up in the 18th and 19th centuries, and were fully in place by the beginning of the 20th century.

EU situation should be looked at by everyone

Posted Dec 13, 2023 13:18 UTC (Wed) by Wol (subscriber, #4433) [Link]

> Sorry, but this couldn't be right. One of them have to be responsible. Like in retail: supermarket may be selling under their own name and then would be responsible, or may provide space for others to put their booth and then these others would be responsible, but someone have to be liable, or else why have the whole charade of a law if no one is responsible for anything?

Sorry, but this is the "it's not my fault" fallacy. It's what frauds and conmen like to do - "it's your fault for falling for a scam". What if it's NOBODY'S fault? Certainly the moral position is quite clear - if you are actively benefiting, then you have to warranty what you're doing. And for the most part, the law agrees. If you're benefiting from actions that injure someone else, then you're responsible.

That's why it's "follow the contract". That's why when I purchase a car from a dealer it's the DEALER who is liable for EVERYTHING. That's why the DEALER will have a CONTRACT with Volkswagen to indemnify the dealer for faults in Volkswagen's products.

I dunno about the law where you live, but that's why, when we have a recall for faults, it's the DEALER who fixes everything. It may well be Volkswagen that actually pays for it, but that's between the dealer and Volkswagen - nothing to do with me! And that's why manufacturers don't like recalls - because it's the CONTRACT between them and the dealer that says they pay for it. How else would UK law get a German manufacturer to fix defects in cars (not in this case, but in others) made in the Far East? They push all the responsibility on the guy SELLING the PRODUCT, and expect them to cover their backs with contracts. And if those contracts are straw, then that's the dealer's tough luck.

As for your example of manufacturers setting up little dealerships and letting them go under - well we have "evasion" regulations. If the purpose of setting up the dealership is to let it go bust and evade liability, English law certainly will "pierce the veil" and say "this dealership is a fraud. For the purposes of the law it never existed and its supplier is on the hook instead". Actually invoking that may be tricky, but that's what the law says, that's how the law deals with it. The law doesn't say "the manufacturer is responsible", it says "the manufacturer is fraudulently dodging responsibility". J Random Hacker quite clearly isn't setting up legal shell distributors with the intention of evading responsibility, fraud clearly isn't on the table ... the customer is getting EXACTLY what he (didn't) paid for. (Likewise with J Random Forge - there's nothing that could remotely be described as fraudulent.)

Cheers,
Wol

EU situation should be looked at by everyone

Posted Dec 13, 2023 13:24 UTC (Wed) by Wol (subscriber, #4433) [Link]

> All car dealers that I have ever saw contacted manufacturer if that's their defect. Sure, if someone stole some screws while car was with dealer and manufacturer is not to blame and car dealer goes to court.

> But if car dealer can prove that he haven't touched anything and goods were defective when they left the factory then it's on manufacturer, 100%.

But that's down to the dealer's contract with the manufacturer. NOTHING TO DO WITH ME. If the manufacturer can't/refuses to honour their contract with the dealer, NOTHING TO DO WITH ME.

The car isn't fit for purpose. The dealer legally MUST refund me. If they can't get the money back from the manufacturer, NOT MY PROBLEM.

(Okay, in practice, I might have considerable difficulty in enforcing this - if the manufacturer refuses to bail out the dealer, the dealer may go bust and I lose my money, but that's not the law, that's the law in practice, a very different thing.) And in that case, the receiver SHOULD sue the manufacturer on my behalf, but is that ever going to happen?

Cheers,
Wol

EU situation should be looked at by everyone

Posted Dec 13, 2023 11:38 UTC (Wed) by mb (subscriber, #50428) [Link]

>I've just bought myself a car. A brand new Volkswagen to be precise. And let's assume the engine fell out on the way home and the car was destroyed. THIS IS NOTHING TO DO WITH VOLKSWAGEN.

Well, that depends on whether it's a case for "Gewährleistung" or "Produkthaftung".
In the case of "Produkthaftung", which basically means persons have been injured or *other* things have been destroyed, the dealer is only liable in a couple of special cases. (Basically, only if the dealer can't point at manufacturer)