This doesn’t make sense. Why is liability tied to payment? If someone 3D prints brakes and they give them away for free, are they liable?

This is a tough problem. We want to punish negligence, not destroy lives because of honest mistakes.

If you install someone's free plastic brake pads, you're at fault for whatever happens - and if someone offers to give you something for free and you agree, they don't have to follow through. If you buy them, there's an implied contract that you will receive them. In that implied contract, our society has also inserted "and they won't kill you." The idea that every time a dollar changes hands an implied contract is made underlies US business law. Related to this idea is how rights holders will be offered money for photographs they're giving away for free - because the person who wants to use the image wants to be protected by the implied contract. In this system money is the magic spice that makes agreements real. (If someone gives you their car for free, the courts will sometimes let them take it back. Not so if they sell it for a dollar.)

That's not how liability works at all. That's an idealistic interpretation of the law that has never actually existed.

It does not matter if you charge for your service or product, nor how much you charge, you can still be found criminally negligent or reckless if it kills people and your actions played an important role. There are very few exceptions to that.

In civil terms it's far more straight forward: if your free brakes kill people, you will be sued for it (almost guaranteed). From there they will attempt to prove that you were negligent regarding the quality of the free brakes you created.

You give away thousands of free chicken sandwiches, that without your knowledge happen to contain bacteria that causes food poisoning and ends up killing several people. You did a very poor, careless job at food prep (similar to the dangerously manufactured brakes). You're almost guaranteed to be pursued criminally and civilly for the deaths.

The security levels of most electronics products connected to the Internet, be it IoT or routers, can only be described as criminal negligence. There is no financial incentive for the manufacturers to invest into proper security, and they typically just add some junk to the firmware they get from the SoC vendor and ship.

I'm not sure I agree that making the vendors liable in case of vulnerabilities is the right way. It should probably suffice to require vendors to define a guaranteed product support period, where they are obliged to provide security patches, and then hold them liable if they fail that.

When you use free software, you are tied by its license which says:

15. Disclaimer of Warranty.

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability.

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Sure and so does most nonfree software.

Written by a Fortran IV lawyer.

From the GPL:

   This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

A lot of these routers contain tons of oss libraries. Would it then depend on which component caused the bug? It‘s a rabbit hole.

No matter which component caused the bug, the device vendor that made the final product should always be responsible, unless it has a contract outsourcing the responsibility for a specific component to another entity. If the vendor simply used open source libraries, then it needs to review and take responsibility for the code, or hire a contractor to do so. This might also incentivize them to provide timely security updates, in order to minimize damages.

If they were liable there is no profit margin. These products will never exist.

No, they still would. People do amazing things under constraints.

You need to bundle mandatory, sizable insurance as a requirement for getting the license to sell/not selling illegally (i.e., treat the device as illegal as an insurance provider who is not licensed to sell insurance, not as an unlicensed medical doctor). The insurance would make the vendor fix his shit. And he can't just chicken out. Make some way for sufficiently large companies to self-insure, or they will be mad. If they don't get mad, they probably like the reduction in competition.

At the end of the day, the end consumer will pay.

Yes. But he better try to line the incentive's of those he does business with up with those you have.

> If the vendor simply used open source libraries, then it needs to review and take responsibility for the code,

I can imagine a lot of licensing hassle here. Worked for Technicolor in Edegem, not on routers / STBs but know the challenges. There are tons of libraries used by virtually every device in the field that no company will touch b/c of licensing hell.

It would also incentivize vendors to fund critical FLOSS with direct development support on safety-critical functionality.

Carmakers will not be liable if I break your brakes.

Why should your router manufacturer be liable if I break your router?

Clearly in both cases the company failed to manufacture a secure enough product.

One difference: you can repair your brakes, or replace them, without having to get a new car. Most routers do not have updates available after the first one or two patches, and you can't even install your own OS on most. Your only options are: live with it, or buy a complete new router.

You can repair your car, you can reset your router.

Neither will prevent a malicious party from breaking them.

Trade-in your old router every two years.