EU situation should be looked at by everyone [LWN.net]

EU situation should be looked at by everyone

Posted Dec 13, 2023 11:46 UTC (Wed) by khim (subscriber, #9252)
In reply to: EU situation should be looked at by everyone by mb
Parent article: Bottomley: Solving the Looming Developer Liability Problem

Thanks for being constructive and offering concrete evidence and not just your ideas about how world should work and not about how it works.

Yes, if dealer imports something from abroad and court couldn't reach an actual manufacturer then importer may be held fully responsible, which makes perfect sense: court would love to make the actual guy who does “bad things” responsible, but if they are out of read… importer would have to shoulder that responsibility. Makes sense.

I guess that idea would be applied to software, too. Hmm.

This would mean that if forges would just leave EU they may avoid all the blame.

I wonder what would be the next step, though. Make use of Debian or Gentoo, directly downloaded from outside of EU illegal? We'll see, I guess.

to post comments

EU situation should be looked at by everyone

Posted Dec 13, 2023 13:01 UTC (Wed) by bluca (subscriber, #118303) [Link] (12 responses)

For the millionth time: in the EU, it's the seller that is responsible to its customers, period. Sellers need private, mutually agreed contracts with their suppliers to share or offload customer liability. Debian and Gentoo are not sellers, and do not have any such contracts. Downloading is not buying a product or signing a contract. This has been explained to you by at least 3 or 4 people already, independently. Yet you still insist with this nonsense. What's the part that you are struggling to grasp, precisely?

EU situation should be looked at by everyone

Posted Dec 13, 2023 14:01 UTC (Wed) by farnz (subscriber, #17727) [Link] (11 responses)

The difficulty is that Debian can be both a component supplier and a seller to consumers itself; for the purposes of the CRA, me downloading a binary ISO for personal use from debian.org can count as a sale of a product (this being how the CRA intends to prevent - for example - free trials of a proprietary product, or advertising-supported products that are also free at point of distribution from being exempt from the CRA). Whether or not it counts depends on the details of the CRA.

Now, me acting as an employee and downloading Debian is not guaranteed to be a purchase of a product for the purposes of the CRA, because my employer is not a private individual, and thus for business-to-business transactions like that, the contract terms matter.

EU situation should be looked at by everyone

Posted Dec 13, 2023 14:55 UTC (Wed) by Wol (subscriber, #4433) [Link] (9 responses)

> Whether or not it counts depends on the details of the CRA.

And any attempt to make Debian, or Gentoo, or Sourceforge ... liable to J Random Downloader will make a complete mockery of contract law. It's not going to happen.

Absent SOME sort of contractual relationship between the user of the software and developer or download site, nothing will be able to stick. All this angst about liability will only come to pass if there is some sort of fraud, or deception, or otherwise attempt to benefit without taking responsibility.

Writing software for pleasure and giving it away cannot in any way be construed as malicious, fraudulent, deceptive practice, or whatnot. Absent that, a contract is an absolute minimum for transfer of liability. Absent both of those, you're untouchable (well, maybe not, anybody can sue for anything, but European courts are far more likely to call that for what it is - a malicious plaintiff, and then they're not facing the wrath of their victim, they're facing the wrath of the court, which is NOT a nice place to be!)

Cheers,
Wol

EU situation should be looked at by everyone

Posted Dec 13, 2023 14:59 UTC (Wed) by farnz (subscriber, #17727) [Link] (8 responses)

Offering a download to all comers is a contractual relationship, as to do so you need to grant permissions under copyright law. It's not a very strong relationship, but it exists - else by downloading it, you're breaking copyright law, and the offerer has acted to incite you to breach copyright.

EU situation should be looked at by everyone

Posted Dec 13, 2023 16:06 UTC (Wed) by Wol (subscriber, #4433) [Link] (7 responses)

But it's not "placing on the EU market". Yes it's a bare contract, a licence, but absent a MUTUAL exchange of consideration, there can be no sale, no market, yada yada.

"Offering for download" is NOT "mutual consideration".

Cheers,
Wol

EU situation should be looked at by everyone

Posted Dec 13, 2023 16:07 UTC (Wed) by farnz (subscriber, #17727) [Link] (6 responses)

There is a mutual exchange of consideration; Debian offers you a copyright licence, and you agree to be bound by its terms. It's not a big exchange, but it is an exchange of consideration, and enough to establish a contract.

EU situation should be looked at by everyone

Posted Dec 13, 2023 16:36 UTC (Wed) by bluca (subscriber, #118303) [Link] (3 responses)

Debian doesn't own the copyright of any software included in an image, so it can't give you a custom copyright license - it can only copy verbatim the original licenses of anything that is included, which cannot be changed as per terms of the various copyleft licenses like GPL and friends.

EU situation should be looked at by everyone

Posted Dec 13, 2023 16:42 UTC (Wed) by farnz (subscriber, #17727) [Link] (2 responses)

It owns a copyright on the aggregation of the software into a single ISO image (the editorial choices about what to include and omit) - it can give you a licence to that. It can't give you a custom licence on the code inside the aggregation, though. And it's a licence for that aggregation that it's offering, in return for you accepting Debian's terms.

EU situation should be looked at by everyone

Posted Dec 13, 2023 17:17 UTC (Wed) by bluca (subscriber, #118303) [Link] (1 responses)

I don't think even that is really the case though. Images are put together by volunteers, and there is no copyright assignment (how could there be? there's no legal entity to assign it to), so the copyright and license belongs to those authors. Given there is no trace of a commercial activity anywhere tied to any of this, I am extremely skeptical this can possibly constitute as marketing a product under any interpretation of the single market regulations.

EU situation should be looked at by everyone

Posted Dec 14, 2023 11:57 UTC (Thu) by paulj (subscriber, #341) [Link]

Well therein lies the rub. You have one opinion, others have another. The definition of "to bring to market" apparently differs between member states according to other comments in this thread, with it claimed that Germany has a very wide ranging definition of such.

Without a clear and explicitly worded exception for things like Debian the CRA we may end up having to wait for cases to arise in a few member states. We do know the likes of ASF believe the CRA is /designed/ to apply to foundations like them, as they have directly engaged with relevant EU legislators on the issue. In the worst case, we may need to wait till a case goes to the ECJ to get clarity.

EU situation should be looked at by everyone

Posted Dec 13, 2023 21:00 UTC (Wed) by xtifr (guest, #143) [Link] (1 responses)

Debian offers you a copyright licence, and you agree to be bound by its terms.

No. All Open Source licenses (or licenses which comply with the Debian Free Software Guidelines) are distributor licenses, not user licenses! The licenses grant Debian the right to give you the programs, but you are under no obligation to accept or comply with those licenses!

Of course, without the permission granted by those licenses, you cannot make copies for others (or in the case of the AGPL, run the code on a public-facing server), but unless you want to make copies for others, that's a non-issue, and you can ignore the licenses rather than accept them. The GPL even explicitly states that you need not accept it and can instead choose to be bound by normal copyright law--which means no making copies.

And if you do choose to accept the license terms and distribute the code, that's between you and the copyright holders! Aside from code Debian actually wrote (apt, dpkg, etc.), Debian didn't offer you any licenses! They merely passed along the license offers. There is no agreement between you and Debian regarding the kernel or the shell or python or X or anything. Debian merely exercised their rights under the license to give you a copy; their involvement basically ended when the download finished!

EU situation should be looked at by everyone

Posted Dec 13, 2023 21:24 UTC (Wed) by farnz (subscriber, #17727) [Link]

But Debian aren't just offering me the software; they're also offering me their arrangement of that software into a compilation, which itself has a form of copyright applying to it. The licence I accept from Debian may well be implied, rather than explicit, but I need some form of permission to allow me to copy that arrangement.

In EU law, there's certain licences that are granted automatically as a matter of law, but they're still enough to function in terms of the offer, consideration, acceptance set required to form a contract - Debian, in this case, is offering me a licence (which it presumably has permission to do) that permits me to download the installer image.

EU situation should be looked at by everyone

Posted Dec 13, 2023 16:21 UTC (Wed) by bluca (subscriber, #118303) [Link]

> The difficulty is that Debian can be both a component supplier and a seller to consumers itself; for the purposes of the CRA, me downloading a binary ISO for personal use from debian.org can count as a sale of a product (this being how the CRA intends to prevent - for example - free trials of a proprietary product, or advertising-supported products that are also free at point of distribution from being exempt from the CRA). Whether or not it counts depends on the details of the CRA.

Those clauses are clearly and explicitly defined to catch freeware/lite/ad-free/platform/base versions given out in the course of a business venture. So it does not apply at all to Debian: there is no "full" or "ad-free" version of Debian that you can get if you sign a contract, there is no business to the side that benefits from giving away the images, there's nothing at all, it's all just there. It very clearly does not fall into that category.
Debian would have to start selling access to Debian++ "now built with -O4 for extra speed!!11" and using the "slow" version to entice new customers to fall afoul of those rules.