Insuring open source
I was hoping to do this with an expert, but the expert was busy so here goes.
The headline is Lloyd's of London is writing policies of up to $10 million for losses incurred using open source software. This is supposed to indemnify people fo the "risks" of someone coming up claiming patent or copyright infringement.
Is this big news? Yes and no. It's nice to see the policy, but there are questions you should ask before buying one:
- How does this potential pay-out compare to your real risks? A $10 million limit is actually pretty low.
- What specific risks are being dealt with, and which risks are excluded?
- What actions must you perform to maintain your coverage?
- What's the price?
Just saying "we can write that" doesn't really tell you anything. Insurance is a contract, backed by capital, a bet placed by the insurer that the covered risk won't happen. They take your $1,000 and assume you won't have that $100,000 car accident this year. One thing I often remind friends is that insurance buildings are like casinos, in that they weren't built from the money of winners, only those who didn't get a pay-out.
That car accident risk is pretty easy to write. There's a lot of history, both general and specific. A carrier knowing your car model, age and sex can be confident that the odds are in their favor.
A contract like this isn't like that. It's a new risk which requires guesses in its evaluation. So from that standpoint it is news -- good news -- that the contract is being offered.
But should you buy it? Should anyone? Is the risk being covered real? What's the fine print say?
Personally I think so-called "open source risks" are imaginary. I suspect Lloyd's agrees with me. But if you don't agree with us, hey, spend a few bucks. Try your luck.
If SCO wins, you win.