I'm taking the middle ground here. I do not think software manufacturers should be blanket-protected from liability, nor do I think they should always be liable. I think these details should live in the contract. I do not see any other way in which unscrupulous vendors can be held accountable while at the same time allowing open source efforts to progress without fear of lawsuits. It makes me grimace, but taking either exteme I think would be worse.

There is lots of case law out there for widget manufacturers, lots of laws regarding false advertising and fraud, among other things. For whatever reason, markets seem more willing to accept ridiculous terms for software. Perhaps this is because the real risks remain pretty obscure for average people to discern when it comes to software.

Having your systems compromised can be very expensive. But what other options are there? How many companies are in a position to demand a different licensing agreement? Just because software is open source doesn't mean it's superior than closed source. So where does that leave you?

I agree it can be expensive; you and I know this. Average non-technical Joe does not neccessarily know this. These risks remain obscure. I advocate education over legislation, or at least heavy-handed legislation that penalizes, say, open source in the iterests of corporations, or corporations in favor of open source. Existing laws on false advertising should be employed: a company advertising their product as "secure" bundled with a EULA saying "you're on your own and you can't sue us" strikes me as disingenuous. Like any product, software should be required to work as advertised.

Where does this leave us?

There is still a role here for consulting firms to fill the gap with auditing and hardening services. This sort of assurance is expensive, but security does cost money. This role will remain marginalized so long as people aren't educated about risks involving software; with education the pendulum can swing back towards tolerating a little inconvenience for the sake of security. Legislating the tides to halt is not the answer.

Matt

In reply to Re(5): OT: Software & Liability by mojotoad
in thread OT: Software & Liability by cjf

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.