madison

EC wants software makers held liable for code

Tom Espiner ZDNet.co.uk | May 11, 2009 4:45 AM PDT

Summary

Software companies could be held responsible for the security and efficacy of their products, if a new European Commission consumer protection proposal becomes law.
Software companies could be held responsible for the security and efficacy of their products, if a new European Commission consumer protection proposal becomes law.

Commissioners Viviane Reding and Meglena Kuneva have proposed that EU consumer protections for physical products be extended to software. The suggested change in the law is part of an EU action agenda put forward by the commissioners after identifying gaps in EU consumer protection rules.

A priority area for possible EU action is "extending the principles of consumer protection rules to cover licensing agreements of products like software downloaded for virus protection, games or other licensed content", according to the commissioners' agenda. "Licensing should guarantee consumers the same basic rights as when they purchase a good: the right to get a product that works with fair commercial conditions."

EU consumer commissioner Kuneva said that more accountability for software makers, and for companies providing digital services, would lead to greater consumer choice.

"If we want consumers to shop around and exploit the potential of digital communications, then we need to give them confidence that their rights are guaranteed," said Kuneva. "That means putting in place and enforcing clear consumer rights that meet the high standards already existing in the main street. [The] internet has everything to offer consumers, but we need to build trust so that people can shop around with peace of mind."

The Business Software Alliance (BSA), which represents the interests of software makers including Apple, IBM and Microsoft, criticized the proposals.

"Digital content is not a tangible good and should not be subject to the same liability rules as toasters," BSA director of public policy Francisco Mingorance told ZDNet UK on Thursday. "Unlike tangible goods, creators of digital content cannot predict with a high degree of certainty both the product's anticipated uses and its potential performance."

Mingorance said the performance of a piece of software depends on the environment it operates in, how the code is updated, whether it is possible to adapt and modify the software, and whether the code is attacked.

According to Mingorance, the proposed regulatory extension would cover all software, including beta products, and would cover both proprietary and open-source software.

Right now, under the current EU Sales and Guarantees Directive, physical products are expected to carry a guarantee of two years. Extending those terms to software would have the effect of limiting customer choice, as contract terms would have to be extended to a minimum of two years, Mingorance added.

"Extending the scope would force the businesses to maintain update services for such contracts beyond the contractual term and ultimately limit the choice of offers," the BSA director said. "It is like renting your house for a summer month and being then obliged to extend the rent for another 23 months."

In addition, Mingorance said that extending consumer regulation to software could lead to less interoperability between software products, as manufacturers might decide to limit how far third-party developers could access their code.

Software companies have long argued against accepting responsibility for the security and efficiency of their code. Linux kernel developer Alan Cox in 2007 told a House of Lords Committee that neither proprietary nor open-source developers should be held accountable for their code.

This article was originally posted on ZDNet UK.

Talkback Most Recent of 150 Talkback(s)

  • ABOUT TIME!!!!
    This goes for everyone...

    Only in software can you find a known defect and
    then have to pay for the "upgrade" to fix the
    bug.
    ZDNet Gravatar
    itguy08
    11th May 2009
  • What products are you buying?
    I have never had to pay for an upgrade to fix a bug in any software I have owned or managed. Not sure what you are buying, but thats not right at all and I would not buy from them again. I think this is too dependent on situations outside of the software makers control to be a successful program. Maybe if you were selling software to only people that had great computing practices, but we all know that is not the case by far. In theory its a great idea, but in reality is not at all.
    ZDNet Gravatar
    OhTheHumanity
    11th May 2009
  • Any Microsoft OS for one...
    There are numerous bugs, holes, etc in, say NT,
    98, etc that will never be fixed.

    There are many bugs, issues, etc in Office that
    go unfixed only to be fixed "in the next
    version".

    Heck, you can even look at Apple, SAP, etc. for
    evidence of this.
    ZDNet Gravatar
    itguy08
    11th May 2009
  • So just admit it....
    Your post was a shot at microsoft and then you try to cover it up with even evidence of this from Apple and SAP. You could probably make your statement for just about any software in the world. My main concern is if the product is doing what I need it to do. Every product has a bug at sometime, I don't care what it is, but I never had a bug that wasn't fixed stand in my way of doing what I needed the software to do. I never had to go buy the upgraded product to get the fix and I am sure many others out there have the same exact experience? But thats just my experience.
    ZDNet Gravatar
    OhTheHumanity
    11th May 2009
  • Not at all.
    I don't have to patch the computer in my car -
    it starts each and every time.

    I don't have to patch my DVD player - it works.

    Software should be the same thing....
    ZDNet Gravatar
    itguy08
    11th May 2009
  • Ummm, you want to try again?
    You should present things in the correct context. That woiuld be for Cars, you should talk about maintenance. If you didn't change the oil and do regular maintenance, it will not continue to start "Every time"


    But furthermore, and more importantly, allow me a simple example of how misleading and actually just plain wrong your argument is.


    I bought a Honda Accord in 1995 and I think it's safe to say they are known for quality, the CD player had to be replaced immediately after I found out it didn't work. Even more distressing was that I had to bring the thing in for about a dozen recall items over the first few years, that in some cases were BUGS that could cause the car to EXPLODE, shutdown or cause a fire, if not repaired.


    Want to try again?
    ZDNet Gravatar
    xuniL_z
    11th May 2009
  • I think what itguy08 means is that...
    Often a piece of software will have a known bug and the company will
    issue a "workaround". Basically, it's just a series of steps that allow you
    to get around the bug. The company hasn't fixed the bug, but they've
    forced you to work around the bug. Adobe and Macromedia come to
    mind, but Apple and Microsoft do engage in this sort of thing as well.
    Oftentimes, but not always, the next paid upgrade will fix the bug, but
    you have to pay for that. I've seen this many times so I don't think any
    specific examples are required to make the case.
    ZDNet Gravatar
    jack@...
    11th May 2009
  • Stop it...
    So because you had a problem with car in 1995, this guys post is wrong. You, my friend, are arrogant and conceited. His point could have been easily made about cd players or dvd players or microwave ovens of any hardware that requires control software or an OS. How about not being so 'clever' and showing people a little bit of respect.
    ZDNet Gravatar
    SimonUK2
    12th May 2009
  • Jack. I understood his point...and his earlier posts too...
    where he, of course, throws the main dig at MS.


    Sorry but doesn't even the MS haters club get tired of that?

    Anyway, this is not just a software phenomenon. There have been thousands of suits against manufacturers for defective parts that are non computer related. It's too subjective to claim whether they were on purpose or not.

    The car analogy is still a bad one. And I'm just pointing this out, unlike what "Bored" had to say, that car recalls are very very common. Perhaps bored has never owned a new car, or he's really special and has never had one with a recall. Recalls have been issued for everything from autos to toys. Someone is liable.

    This would be like calling for all engineering to be responsible for every product ever manufactured on this earth that required engineering. That is my point and singling out software developers is asinine. The EU has shown how asinine government can be many times in the past though, so it's not a surprise.
    ZDNet Gravatar
    xuniL_z
    12th May 2009
  • @bored. could you please try to have some level of...
    civility in your posts. The OP had a string of posts. He dings MS, as I said to Jack, and it's tiring.


    But my point was no aimed at being "clever" and I don't ever even consider the idea of being "clever" when I post. Nor do I try to be offensive or hurtful or hate filled or radical or religiously fervent.
    You are talking about the I hate MS club when that level of emotion and hate and anger are contained in a post. Try telling them off. (like you would).


    I'll repeat my point. All products, software or not, have defects. Recalls are VERY common, even if you've not had a car that was recalled. That was one example. every car we've owned has had at least one recall. Most all new cars do in the first 2 or 3 years...or more. You are trying to say I was purposely being "clever" with that?

    You need to get out. Do you have a job and a car? Never a recall? Never owned a product or heard of products with recalls? There are toys being recalled all of the time and not just those made in china.

    AGain, my point is if software makers are to be punished for bugs, then every product maker should be punished. And if it's the developers as the scapegoats for software, then it's the engineers are architects for other "hard" goods when they fail. Why not?


    It's the same damn thing.

    The EU displays a lack of common sense far too often IMHO.
    ZDNet Gravatar
    xuniL_z
    12th May 2009
  • Appliences as apposed to general purpose computers
    Your DVD player and engine managemnt computer are dedicated appliances. Closed systems that are tasked with doing specific jobs. They don't also have to route your mail, run your webserver, talk to an Oracle database, defrag large multiterrabyte disks, mount small 2MB flashdrives, play .aac .m4a .mp3 .ogg .avi .mov .qt files in what ever player you choose. It doesn't have to secure your banking, provide protection to other software running in the car, manage the network, provide a rich complex GUI etc.

    ZDNet Gravatar
    chromeronin
    11th May 2009
  • Re: Not at all
    Are you referring to your thinking. Not everyone's car or DVD player starts every time. Also, if someone smashes your car or dvd player it may stop working. This proposal must come from an inexperienced person or an idiot. This could lead to software manufacturers having to take strict controls on how you use their software in oder to ensure proper operation. Ah, you were surfing dangerous areas. No longer covered. no more updates.
    ZDNet Gravatar
    Col Mustard
    12th May 2009
  • I had to patch both of those
    I my car I had O2 Sensor that kept failing. I took it in and the sensor was fine but the chip wasn't registering it right. So they flashed the chip with newer version of the software.

    An older DVD player I had to download patch, burn it CD then run it in my DVD player. This was to fix a problem with some commercial DVDs that the player couldn't read.
    ZDNet Gravatar
    voska1
    13th May 2009
  • Sounds good in theory
    No so much in practice.

    Using the toaster analogy, would you expect the toaster to work underwater? How about a US toaster taken to Europe or Japan? Oh, and what do you mean this toaster can't handle bagels? It's a toaster, innit?

    Oh, some SOB used a *toaster* to smash open my car window! Quick, sue General Electric for making a dangerous product! I bet that thing could *kill* somebody if you hit them with it...

    Most significant software starts at a line count of at least 100,000 lines of code. Now lets say there's a law that says developers are responsible for software security flaws.

    I create a new program and market it, using best security practices. It's immune to every known security hack.

    Then a week after it goes on sale some twisted genius comes up with a bizarre *new* attack nobody ever heard of. It's brilliant, and cuts through most security like swiss cheese.

    Should I be responsible because I didn't forsee a mad genius's new hack? According to this proposed law I would be.

    How's that fair again? Of course such a law would favor big corporations, who could afford the massive testing you'll need to comply. Guess who's now screwed?

    Open source, for one. The little mom and pop shops for another. Individual programmers who can't possibly afford the efforts required.

    Oh, and innovation? Forget it. Everybody's too busy locking things down, pulling *out* features that are too hard to secure.

    Best practice, security wise. If a feature's *NOT* there you can't attack it. Make developers responsible for security breaches and that's exactly what they'll do. It's what *I* would do, and I'm a developer.

    Of course, programs will be *very* secure. They'll cost 5 times as much, be delivered in 10 years as opposed to 6 months, and not do a whole lot--but by God you won't be able to break them with a sledgehammer!

    That the software landscape you want?
    ZDNet Gravatar
    wolf_z
    11th May 2009
  • it is good
    Guess who's now screwed?

    Open source, for one. The little mom and pop shops for another. Individual programmers who can't possibly afford the efforts required.

    Nope, FOSS can not be technically held accountable because you got a free product and the contributors can't control how their software will be used and reused.
    It is the proprietary companies that have to lose a lot.
    ZDNet Gravatar
    Linux Geek
    11th May 2009

Talkback - Tell Us What You Think

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity