EC wants software makers held liable for code
Software companies could be held responsible for the security and efficacy of their products, if a new European Commission consumer protection proposal becomes law.
Commissioners Viviane Reding and Meglena Kuneva have proposed that EU consumer protections for physical products be extended to software. The suggested change in the law is part of an EU action agenda put forward by the commissioners after identifying gaps in EU consumer protection rules.
A priority area for possible EU action is "extending the principles of consumer protection rules to cover licensing agreements of products like software downloaded for virus protection, games, or other licensed content," according to the commissioners' agenda. "Licensing should guarantee consumers the same basic rights as when they purchase a good: the right to get a product that works with fair commercial conditions."
EU consumer commissioner Kuneva said that more accountability for software makers, and for companies providing digital services, would lead to greater consumer choice.
"If we want consumers to shop around and exploit the potential of digital communications, then we need to give them confidence that their rights are guaranteed," Kuneva said. "That means putting in place and enforcing clear consumer rights that meet the high standards already existing in the main street. (The) Internet has everything to offer consumers, but we need to build trust so that people can shop around with peace of mind."
The Business Software Alliance (BSA), which represents the interests of software makers including Apple, IBM, and Microsoft, criticized the proposals.
"Digital content is not a tangible good and should not be subject to the same liability rules as toasters," Francisco Mingorance, BSA director of public policy told ZDNet UK on Thursday. "Unlike tangible goods, creators of digital content cannot predict with a high degree of certainty both the product's anticipated uses and its potential performance."
Mingorance said the performance of a piece of software depends on the environment it operates in, how the code is updated, whether it is possible to adapt and modify the software, and whether the code is attacked.
According to Mingorance, the proposed regulatory extension would cover all software, including beta products, and would cover both proprietary and open-source software.
Right now, under the current EU Sales and Guarantees Directive, physical products are expected to carry a guarantee of two years. Extending those terms to software would have the effect of limiting customer choice, as contract terms would have to be extended to a minimum of two years, Mingorance added.
"Extending the scope would force the businesses to maintain update services for such contracts beyond the contractual term and ultimately limit the choice of offers," the BSA director said. "It is like renting your house for a summer month and being then obliged to extend the rent for another 23 months."
In addition, Mingorance said that extending consumer regulation to software could lead to less interoperability between software products, as manufacturers might decide to limit how far third-party developers could access their code.
Software companies have long argued against accepting responsibility for the security and efficiency of their code. Linux kernel developer Alan Cox in 2007 told a House of Lords Committee that neither proprietary nor open-source developers should be held accountable for their code.
Tom Espiner of ZDNet UK reported from London.
This is the type of thing that somebody says without thinking of all of the downstream affects. Effectively you'd be limiting software to be able to be developed by only the most well funded so basically we're back to a world where it woudl be MS/Oracle/IBM and now Google as well...
Sometimes the EU needs to think before they speak.
I think thats his point.
> I thought the article was about software licensing agreements,
> you know the ones with the fine print that basically take away all
> of the consumer rights.
Pretty much *all* software carries a license, even free software (things like the GNU, BSD and other licensing models). So, the EU is essentially looking to make all software production and distribution move offshore. I know for a fact that, were I to be held individually or jointly liable for code I contributed in good faith to OSS projects, I'd stop contributing.
No, the tangible good is the CD (i.e. the medium on which the program is distributed), and possibly the box it is in. The software is still intangible and still doesn't fall under the Consumer Protection Act.
So the Consumer Protection Act can be invoked if the CD is itself defective in some way, but not if there is a bug in the software you bought.
I bet you wouldn't cry about a defective toaster burning down a house.
If this goes through, expect a good deal less software available in the EU, and significant increases in price in the medium term.
Mrs Reding ought to spend some time educating herself on the realities of software engineering.
"What can you expect though from some gray hairs that grew up in the 50's and 60's though."
Um, you're talking about me, right? Hair's not grey yet, lots of salt in my beard. Though I'd say it's more silver than gray. Born January 1957.
I'd say that the EU commission definitely has no clue. Require to adhere to license terms, yes. Improve license terms, yes. But software isn't hardware, well, NickH has the right of it.
So what CAN you expect from a gray-hair from the '60s? Oh, pretty much the same as any other group: from each depending on his level of ignorance.
It is possible to produce quality, reliable software.
The obvious difference being that if an author of a book makes a grammatical error it doesn't run the risk of burning another page out of the book, or that of a different book on your bookshelf, or crash your bookshelf to the floor, or unlock your front door so a thief can sneak in and read through your library... ;)
Put another way, if your software contains a bug, then however difficult it is to trigger it you will get someone e-mailing or phoning you up to tell you that it's appalling that you shipped it with a bug and that you should have caught it during your testing (ignoring the fact that you may have to dance naked around a maple tree on a full moon while chanting the words to Hallelujah backwards in Greek in order to trigger it; this may sound like an exaggeration but software quite often has bugs that can only be triggered by events just as random or stupid).
It is, I think, generally right that developers should make a reasonable effort to put right any defects (and I think most do), but I think you have to be realistic about (a) how often customers are likely to encounter it, (b) whether the developer can in fact reproduce the problem, and (c) the amount of effort required to fix it. None of these things are necessarily obvious to a layman, which is one very good reason that politicians (who are not also programmers) shouldn't be legislating about this without taking advice from people in the industry.
If you think otherwise you're really arguing that software should be *much* more expensive than it currently is, because we'll all have to write our code the way the safety critical people do, which is no fun at all (so no indie developers), takes aeons and costs a small fortune. In that world, all software is written by boring men in grey suits, and while it's 100% reliable, they won't be able to implement half the features you want because of time constraints and because it's impossible to prove that some of them work.
"Of course any exploit caused by the stupidity of the user would be not be ruled for."
Hah. Courts love to stick it to the big, bad corporations these days, no matter who is actually at fault. Chances are they'd find for the user on the grounds that the software should have anticipated the action and prevented it.
I'm serious.
"If they can't get common bugs during testing that a normal consumer may run into, then they should be sued and pay for it."
What's a "common bug"? Define, please, and be unequivocal. That means there can be no doubt whether a specific bug is "common". Like, say, in court., which is where you want this to go.
And... betas? The whole IDEA of a beta is to find problems by letting people play with it who will likely try things you never thought of. This commission has the cart before the horse.
Until that time the only promise you can make is that once you know of a flaw you'll do your best to fix it. Problem is fixing one bug usually leads to introducing a new bug. They don't know how to stop that from happening either. If anyone figures out how please let me know.
You mean other than raising costs and putting an end to amateur and smaller scale development? Not to mention the difficulty of find bugs in non-trivial software and the extensive use of third party libraries.
"it would give software developers more credibility perhaps even consider it an actual profession."
Your apparent lack of understand does not negate software engineering and development as a legitimate profession. This wouldn't create credibility just increase cost (try debugging a non-trivial program). You might also want to familiarize your self with the definition of profession http://dictionary.reference.com/dic?q=profession&search=search
***?
Amateurs should not be writing software. Period. Many "professional" programmers are amateurs as well.
But then again, that's just like every other software program. Use at your risk, don't like it GO AWAY and get it from someone else.
However, I also guarantee that once I find or am made aware of such bugs I'll work quickly to patch them up as long as it is within my power. That's the only guarantee I'll ever make.
If they had any idea about how programs are written (which they obviously don't), they would immediately drop this unenforceable proposal.
It's possible to verify bugs without the source code.
Process of elimination and there are debuggers that can be attached to programs. They allow you to examine the decompiled code and see the content of the process memory space, parsing out variables etc. I wasn't talking about the average user, just responding to your general statement that source code is need to confirm bugs.
Actually, a debugger will only show you assembly code, if it's from a compiled language. Without the source and symbol files, you won't see variables, or intended logic (since the machine code output is the compiler's interpretation of my source) with a debugger. The problem with that obviously is, I can argue that the compiler could have introduced a bug. Will the prosecution test the compiler to see if it's the source of the error?
I'm not saying logically you couldn't point to the application as being faulty. I'm saying legally speaking, you couldn't prove it because observable fact isn't really fact, and can be countered with reasonable doubt (ie. something else could have caused the problem) without examination of source.
Read the End-User Licensing Agreement (EULA) and found out why the clauses are overwhelmingly unfair.
I knew few ever read it (Yeah, right).
Read the dlsclaimer section. THIS SECTION IS ALL WRITTEN IN BOLD, JUST LIKE THIS. THIS SECTION IS INVALID. COMMERCIAL "PRODUCTS" SHOULD BE HELD LIABLE FOR THEIR DEFECTS.
Why? If the softwares are to be used to handle health records, financial informations, judicial records, government records, personal records or other vital informations that has direct connection with people's lives, properties and fames, you will expect your records to be kept safe and free of errors. What happened if you have no criminal records, and software defects caused the records to show improper entries that may endanger your job search, relationship, or reputations? You can't say softwares are not liable for their defects. They can't simply walk away with your money and claimed no responsibilities.
"They can't simply walk away with your money and claimed no responsibilities."
You're right, but they can just walk away. Nobody can make promises like that. Software doesn't work like that. That means you no longer have software to to handle health records, financial informations, judicial records, government records, personal records or other vital information because honest software developers will simply refuse to write it because they cannot make those promises to you.
The only software you would have is from people that lie. Ask yourself, who do you want to buy your software from? Someone who's honest and says look man, we have some of the smartest developers in world. We'll try as hard as we can, but we can't promise anything because as smart as we are, we're just not that smart yet. Or do you want to buy software from someone who lies and tells you their stuff is secure when they know it isn't?
Look, we don't know how to build software like that, just like we don't know how to build time machines. Liken it to a time machine. That's what you're asking for here. It would be like a company selling you a time machine. You and I know nobody knows how to make a time machine so who would you give your money to? A guy that is trying to sell you a time machine or a guy that says look man, I'll help you anyway I can, but I have no friggin clue how to build a time machine. Which would you trust?
They enjoyed the rights, and so do the responsiblities.
Imagine the toaster developers argued:
"Since we can't predict that under what condition and circumstance the consumer uses our toasters,
we have to disclaim all responsiblities."
And book authors already are held accountable for what they write----Slander and Libel.
Software developers are no exceptions.
Only a toaster is about fifty million times simpler than many of the bits of software you use every day. It's both possible and reasonable to test every function of a toaster.
If you think this is reasonable for software, I suggest you grab a copy of the Unicode book and have a read. The Unicode spec deals with the business of encoding human language and information, and with the algorithms you need to process it. You will find that it is a very big specification, and probably that you won't understand most of it.
Once you have been impressed by the complexity and volume of the specification, consider that Unicode is just a tiny part of the implementation of a modern wordprocessor. There is font rendering (very complicated), paragraph layout and page layout (complicated), graphics of various sorts (ranges from simple to very complicated), printing (which is a whole can of worms in and of itself, because there is often now a second rasteriser involved and your document and fonts may need to be turned into some other format in order to control that), colour management (highly mathematical but perhaps not that complicated; still I guarantee you wouldn't understand it without at least a few days' dedicated study), editing (much more complicated than it looks)? the list goes on and on.
Consumers (and that includes politicians) usually fail to understand just how incredibly complicated software is. Often that's because we developers have slogged our guts out trying to make it easy to use, coming up with all kinds of clever things that you will either never see or never appreciate, though they make your life much easier than it would otherwise be. And that is why non-experts should not be legislating in this area without expert advice, and it's why non-experts should *take* that advice rather than snubbing it.
It's not quite the same. In fact, I'll bet you $1000 you couldn't write a single line of code without a bug in it and that would function properly in all situations. Not one line of code. Software contains millions of lines of code. It just can't be done.
"According to Mingorance, the proposed regulatory extension would cover all software, including beta products, and would cover both proprietary and open-source software."
This software is guaranteed free of defected under the condition that said software is installed on a system meeting the requirements of; Core2Duo extreme Q6850, 4GB DDR3 Ram, HD4870 1GB, and an ASUS P5E64 WS EVO running Windows Vista 64 Bit with default drivers from the factory as of 5-9-09. no other third party software may be installed or run with or along side of said software. failure to meet these requirements waives any guarantee that said software will run free of bug or defect.
Essentially If thats the system i run and if i develop software on it and it runs great for me then you can run it too, with a 2yr backing ill fix any issues, as long as you run on it that exact system. enjoy the new EULA, EC.
http://www.cpsc.gov/cpscpub/pubs/thrift/thrguid.pdf
Regulations are often "sold" as protection for the public. But it usually doesn't take very long for those same regulations to become restrictions ON the public. The typical outcome is that compliance becomes so difficult and expensive, that amateurs and small-time players find something else to do -- or else they just flout the law and do their best to avoid getting caught. Big-time players take every opportunity to limit the functionality of their products (including their ability to function with or during the simultaneous operation of other products) to whatever seems to be the least "actionable" feature set.
If passed, the proposed EC laws will be a bonanza for makers of "software lifecycle" systems, automated test harnesses, "malpractice insurance" companies and, of course, lawyers. While some purveyors of shoddy goods may be chased away, I doubt that the good done by these "consumer protection" laws will outweigh the bad that happens because of them.
- by Altotus May 10, 2009 2:06 AM PDT
- I suspect the EU is as serous as a heart attack. The EULA is the source of this a backlash the consumer has been harshly treated given the economic conditions I would not think so lightly on this. The software people are generously protected by copyright and patents costing fortunes for governments around the world to assess record and enforce. The consumer gets a bug ware complete with failures and worse thats after your ID has been stolen (the fault not of software but goverment and corporate stupidity in using socal security numbers to track its citizens) and has to use The Geek Squad (you are aware the cost is targeted at $200+ dollars per visit for those black and white Bugs and vans) sooo right now the people (cash cows) are in danger of becoming political and things like the gov crack down on copyright protection (largely political show but it has unfortunate legal complications and kind of real bad press) has focused public attention. To keep this blunt and straight forward the people elect the legislators the lobby (like RIAA) provides the money but in this a voter can turn the industry cash to trash unless the industry is willing to spend geometric progression of funds whose amount will eventually bankrupt the lobby and leave the legislators demanding much much more. If I am mixing apples and oranges it wont matter because its all cash crop like the RIAA and etc it tastes good so good and you cant just walk away now buddy its always election time. Now its necessary to balance the scale quid pro quo. Now rooms and buildings and cities of lawyers are saying what no liability, thats what we pay our bills with (do you know what kind of debt a student runs up I bet you do). So there thinking just watch what a few words on paper can do! Thats the way I see it I put it to you crude and rude but I am not a lawyer or politician. Stay with me here now as i gaze into the crystal ball (yes sarcastic humor) software will now be risky this requires underwriters ie big expensive Insurance contracts (entire cities full of lawyers will be supported). Actually wow what a plan taken all the cash out of big software and make its profits part of the insurance industry. I guess that will go a long way to recovery required by all that toxic asset mess big money is embarrassed about. Well what do you know I guess consumers aren't the only cash cows out there.
- Like this Reply to this comment
-
-
- by bigpicture May 10, 2009 10:39 AM PDT
- You are mixing up politics, business, and consumer rights here a bit. Also the US joke political system, with the European political system. The disconnect being that the US politicians are voted in by the electorate, but actually represent the interests that pays for them to be elected, (such as the RIAA, MS etc.) and the electorate are too "uneducated" to see that. They get bamboozled by the big "change" propaganda when it is the same old system in a new costume.
- Like this
-
- by unknown unknown May 10, 2009 5:15 PM PDT
- more euro whining.
- Like this
-
Showing 1 of 3 pages (92 Comments)Is that what the big picture looks like?
That the EU might actually represent the interests of the electorate and not big business, is a alien concept in the US. The US "for the people by the people" is only a window dressing joke and they think that the rest of the world can't see through that. Can you not make the connection between this and who owns the media? It probably would not have even been an issue at all in places where the US business interests does not own the media. Do you think that this made it into MSM in China? Why do you think that China is trying so hard to shake off the US dollar as a world currency, because you don't want the selfish, greedy and corrupt to be in control of the money. The same kind of legal system that allows the EULAs. The EU is basically saying get rid of this unfair US alien crap, the same as a whole lot of the rest of the world is doing. Deregulation works so well in the US, that they should export it to the rest of the world? LOL.