I'm indirectly liable, in that I can lose my job, however.
If I were a contractor, I would also buy liability insurance.
If an engineer negligently (note: not knowingly) signs off on a bridge that collapses, they face fines, expulsion from their profession and jail time. At this point, every developer at Facebook should know the harm they’re causing. The most they face is job loss. That’s the problematic asymmetry.
software quality is not some kind of "force of nature" or "accident" but a direct result of cutting corners/costs.
insurance for beeing lazy will not help.
If we're going to do that, there's no good reason to give a special exclusion for not-for-profit software.
Besides, it's trivial to launder everything if you give such an out. The regulation can apply equally to everyone, or don't expect it to go anywhere at all.
Amateur programmers are not professional engineers. A profession is an activity people are compensated for. If you're not being compensated, it's not professional work. If it's not professional, you should not be held liable for it.
Someone publishing a personal project should not be held liable for anything. A professional software engineer deciding to use that project at work without thoroughly reviewing it and causing a security breach due to vulnerabilities in that software should absolutely be held liable for negligence.
> An engineer designing bridges is liable regardless of his salary, and same must apply to a programmer.
I'm not an engineer but I can draw up a bridge right now. Would it stand or collapse? Who knows. I think it looks nice though so I post it online. Then an actual engineer sees my drawing and makes an actual bridge out of it. The bridge collapses and kills thousands.
Who's liable? Me, a random guy who drew a bridge? The engineer who should have known better?
> Besides, it's trivial to launder everything if you give such an out.
That would require companies to not only refuse to compensate their programmers for their labor but to also open source their source code. Doesn't seem trivial to me.
Right, it's not the publishing but the use which is proscribed - same applies for engineering. But that would apply regardless of whether the software you're using is open-source or not, and regardless of how much you're paid.
A social-media site operated by an amateur in the bedroom being paid nothing and using only open-source software would still be liable under any sensible and realistic regulation.
>>Besides, it's trivial to launder everything if you give such an out. >That would require companies to not only refuse to compensate their programmers for their labor but to also open source their source code. Doesn't seem trivial to me.
You can compensate for code with this regulation, it's not difficult. e.g. create a non-profit, and pay the non-profit which pays the programmer. So long as the programmer is one step removed from you it's fine.
Open source isn't much of an impediment either, just have a suitably restricted licence. Or don't, it's not an impediment for many types of businesses.
Exactly.
I think there should be an exception for free and open source software though. We have lots of free software designed to be used by people. I don't think these programmers should be held liable. Many of them are amateurs and volunteers. The chilling effect would simply be too great.
I'm reminded of Greg Kroah-Hartman's talk about kernel contributors.
https://youtu.be/fMeH7wqOwXA&t=326s
> My goal, of me, as a developer and to make Linux succeed, is to help [amateurs, unknown individuals] out.
> If you're hired to do this stuff, you're on your own and you better know what you're doing.
I think he's right. At the time, roughly 20% of the kernel was done by individuals. That work is extremely valuable yet it is different from professional work. It should be treated differently. with a lot more compassion and understanding. On the other hand, it is fine to expect professionals to be disciplined.
> A social-media site operated by an amateur in the bedroom being paid nothing and using only open-source software would still be liable under any sensible and realistic regulation.
Yeah, I agree. That's not just software anymore, that's a service.
> e.g. create a non-profit, and pay the non-profit which pays the programmer. So long as the programmer is one step removed from you it's fine.
It doesn't matter how indirect it is. The important fact is the programmer is getting paid for their work. That makes it professional work.
Do kernel contributions getting paid by the Linux foundation count? What if the offending company is donating to the Linux foundation?
>I think there should be an exception for free and open source software though. We have lots of free software designed to be used by people... The chilling effect would simply be too great.
I understand distinguishing between publishing and use. But we're talking about use here. The person responsible for the use of the bad program is usually not the contributor. So there's no chilling effect here?
i don't think so because as you said:
> It's about legal responsibility and liability. Make professional programmers directly responsible for the code they get paid to write.
we urgently need liability for for-profit software in order to stop softwares race to the bottom.