Go license and fitness for purpose

[matthe...@gmail.com]

Hello,

The gccgo license has this section:

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

This seems like a common pattern in open source software. GCC files include this:

GCC is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

I’ve been using the MIT license which has this:

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

My tools are my responsibility, so I’m wondering what stops the GCC, Go, or other open source authors from including practical jokes. These license terms seem to remove all responsibility, and in certain hands that is an opportunity to cause some chaos. Why isn’t there a license section about intention of code implementation matching stated goals?

THE AUTHORS OF THIS SOFTWARE DID NOT INTENTIONALLY MAKE MISTAKES OR INCLUDE PRACTICAL JOKES.

I’m not a lawyer, but I’d feel better about these tools if there was something like that followed by the fitness disclaimer.

Matt

[Matthias B.]

On Sun, 13 May 2018 08:56:08 -0700 (PDT)
matthe...@gmail.com wrote:

> My tools are my responsibility, so I’m wondering what stops the GCC,
> Go, or other open source authors from including practical jokes.

That depends on the jurisdiction and the kind of practical joke. But
it's a fact that software has contained practical jokes in the past, in
particular in cases where the software determined that it was running
without a proper license. So this does indeed happen and I've not heard
of any developer being sued for it.

> These license terms seem to remove all responsibility, and in certain
> hands that is an opportunity to cause some chaos. Why isn’t there a
> license section about intention of code implementation matching
> stated goals?

Ask yourself: If you can choose between having NO LIABILITY and having
just a little bit of liability, which option do you choose? Why would
you assume more liability than necessary? Are you Jesus or Gandhi?

>
> THE AUTHORS OF THIS SOFTWARE DID NOT INTENTIONALLY MAKE MISTAKES OR
> INCLUDE PRACTICAL JOKES.
>
> I’m not a lawyer, but I’d feel better about these tools if there was
> something like that followed by the fitness disclaimer.

And as an open source developer who does not get paid, I feel better if
I have no liability whatsoever. Now, if you were PAYING ME for my
services, then I will be happy to provide you with assurances that make
you feel better.



MSB

--
A naked man with a can of beans can eat only one meal
but play a hundred soccer games.

[matthe...@gmail.com]

Why would you assume more liability than necessary?

My thought is the authors want to gain serious users to increase feedback quality and improve the developer market. I thought this was why Google let Go be open source besides attracting academic uses.

And as an open source developer who does not get paid, I feel better if 
I have no liability whatsoever. Now, if you were PAYING ME for my 
services, then I will be happy to provide you with assurances that make 
you feel better. 

I don't think this is the attitude behind GCC, or maybe it is. I want to write programs that do things worth money and hope to use Go or GCC to do so (including working with and on those projects for free), but if they might include unnecessary liability beyond regular bugs then that's a problem for me.

Matt

[Gerald Henriksen]

On Sun, 13 May 2018 13:01:46 -0700 (PDT), you wrote:

>I don't think this is the attitude behind GCC, or maybe it is. I want to
>write programs that do things worth money and hope to use Go or GCC to do
>so (including working with and on those projects for free), but if they
>might include unnecessary liability beyond regular bugs then that's a
>problem for me.

I suspect you are worrying too much given both the long history of
open source software and the large number of
groups/organizations/companies that rely on it.

But you aren't going to get much in the way of guarantees when you
receive and use something for free.

If you really feel you need some sort of legal guarantee then I
suggest you look into some paid options that provide Go and/or GCC,
such as Red Hat or Ubuntu, where there may be more of a legal
framework that is more to your liking.

[David Anderson]

I would point out that a complete disclaimer of liability is fairly common even in commercial relationships. Just now I downloaded my motherboard's manual, and had to click through a liability and fitness-for-purpose disclaimer. So, even someone selling you a $300 enterprise motherboard doesn't want to be responsible for ensuring you are using it in a sensible fashion.

- Dave

--
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Dan Kortschak]

Who would determine whether an mistaken action was intentional? This
seems like a very dangerous inclusion.

[Ian Lance Taylor]

On Sun, May 13, 2018 at 1:01 PM, <matthe...@gmail.com> wrote:
>> Why would you assume more liability than necessary?
>
>
> My thought is the authors want to gain serious users to increase feedback
> quality and improve the developer market. I thought this was why Google let
> Go be open source besides attracting academic uses.
>
>> And as an open source developer who does not get paid, I feel better if
>> I have no liability whatsoever. Now, if you were PAYING ME for my
>> services, then I will be happy to provide you with assurances that make
>> you feel better.
>
>
> I don't think this is the attitude behind GCC, or maybe it is. I want to
> write programs that do things worth money and hope to use Go or GCC to do so
> (including working with and on those projects for free), but if they might
> include unnecessary liability beyond regular bugs then that's a problem for
> me.

Both Go and GCC get an advantage from using widely-used and
well-understood free software licenses. Making any modification to
those licenses would force every large organization that wants to use
these tools to reanalyze the license to make sure it will be
acceptable. So the place to change this, if you think there is a need
to change it, is not with individual projects, but with an umbrella
organization like the Free Software Foundation or the Open Source
Initiative.

Ian

[matthe...@gmail.com]

I suspect you are worrying too much given both the long history of 
open source software and the large number of 
groups/organizations/companies that rely on it. 

I was reading about the ILOVEYOU Windows virus and recall hearing about it at the time. In that case the way Windows worked led to a program that corrupted files across the world and caused some institutions to turn off their Internet connection for awhile. Supposedly the person that let it out said they did so by mistake. I'm wondering if Microsoft should have been liable.

There are already major mistakes in open source software (Heartbleed in OpenSSL is a recent example) and I know that more than one computer culture involved in open source software in the United States enjoy practical jokes. I think it would look bad for many institutions if their software included a practical joke that unintentionally enabled email addresses to be stolen, but these licenses now invite such an inclusion if the person is willing to trade possible world-wide fame for loss of trust in the software world. By adding the term to the license I'd think that person is now liable instead of the users of the library.

But you aren't going to get much in the way of guarantees when you 
receive and use something for free. 

My work is not free, I want to contribute time back.

If you really feel you need some sort of legal guarantee then I 
suggest you look into some paid options that provide Go and/or GCC, 
such as Red Hat or Ubuntu, where there may be more of a legal 
framework that is more to your liking. 

That’s interesting, I may look at these kinds of companies depending on the task. But how can they guarantee Go and/or GCC don't include these things? They don't have a different license.

So, even someone selling you a $300 enterprise motherboard doesn't want to be responsible for ensuring you are using it in a sensible fashion.

I don’t think I’m asking for any extra responsibility, I assume in this case there is already an assumption based on trust and money that no intentional mistakes or practical jokes are included, unless there’s some sort of backdoor.

Who would determine whether an mistaken action was intentional? This 
seems like a very dangerous inclusion. 

I’d like lawyers to give their interpretation, I’m not a lawyer.

Both Go and GCC get an advantage from using widely-used and 
well-understood free software licenses.  Making any modification to 
those licenses would force every large organization that wants to use 
these tools to reanalyze the license to make sure it will be 
acceptable.  So the place to change this, if you think there is a need 
to change it, is not with individual projects, but with an umbrella 
organization like the Free Software Foundation or the Open Source 
Initiative. 

I’ll look at bringing this there, thanks. I did have the thought that it might give Go a competitive edge.

Thanks,

Matt

[Krzysztof Kowalczyk]

On Monday, May 14, 2018 at 7:25:03 AM UTC-7, matthe...@gmail.com wrote:

But you aren't going to get much in the way of guarantees when you 
receive and use something for free. 

My work is not free, I want to contribute time back.

It's unclear if you understand the implications.

If you were to contribute to a project that uses a license that doesn't disclaim liability, your contributions would also fall under the same terms.

In other words, if someone decided that they were harmed by your code (e.g. because you made a coding mistake which corrupted their files) they could sue you. Since you didn't disclaim liability, they could win and you would have to pay them money.

For code that you gave them for free.

I'm guessing you wouldn't want to expose yourself to such liability. Neither does anyone else.

That's why every open source license includes a disclaimer of liability.

 

[matthe...@gmail.com]

I don’t think I’m suggesting to not disclaim liability. I’m suggesting to claim that I didn’t hide anything to make a use break on purpose. It does add liability, but this is liability that is completely in the author’s control unlike regular bugs or misuse that disclaiming other liability still protects against.

I'm not a lawyer so I'm guessing what liability means.

In a collaborative project I would think the license contributors sign would certify that intentional mistakes will not be added and that the individual is liable if their contribution includes such a thing. If the project is found liable for the results of a hidden practical joke then the liability funnels to the individual and the collaborators removes their contributions.

Go uses other open source projects so adjusting the license this way would be a very large task, but I’d like top quality free software tools please.

Matt

[Matthias B.]

On Tue, 15 May 2018 06:39:40 -0700 (PDT)
matthe...@gmail.com wrote:

> I don’t think I’m suggesting to not disclaim liability. I’m
> suggesting to claim that I didn’t hide anything to make a use break
> on purpose. It does add liability, but this is liability that is
> completely in the author’s control unlike regular bugs or misuse that

That's where you are wrong.
The author has no control over WHAT OTHER PEOPLE CLAIM he did.
If he makes a statement that he didn't intentionally put bad things into
the code and bad things happen, he ends up having to prove that these
are actually bugs and not intentional. And if the developer is unlucky
enough to live in the US, this looks like this:

* a jury of 12 laypersons, with NO UNDERSTANDING OF CODE WHATSOEVER
* a very slick and convincing expert who says that he's reviewed the
code and he's 100% certain that this is intentional and not a bug
* some awkward nerd claiming it's a bug

The 12 laypeople decide who they trust more based on their "soft
skills".

It's not a coincidence that this whole EULA and total disclaimer BS was
started by US organizations. The US legal system is pure madness and US
lawyers are like mosquitoes. If you leave just a tiny bit of skin
exposed, they'll smell it and will try to land on it to suck your
blood. Whatever drawbacks you perceive from the current language in
licenses is way less bad than the alternative.

MSB

--
No man is more pitiful than the one who looks to the shadows for warmth.

[John McKown]

​I completely agree with you. My solution is the same as Shakespeare's in Henry IV (Part 2) Act 4, scene 2, line 73: "The first thing we do, let's kill all the lawyers."

ref: http://shakespeare.mit.edu/2henryvi/2henryvi.4.2.html

​

​OTOH, there are a _few_ good lawyers. One who try their best to protect the ​truly (morally) innocent and promote real justice and mercy. Or am I remembering something in a fantasy novel? I remember back in the day when lawyer's didn't advertise because it was unprofessional. Now there are "tough, smart" lawyers who can take on the "big bad company" that injured you by their own deliberate negligence, malfeasance, and greed. And, of course, there are such companies. I would like to go crosstime to the U.S. equivalent in "Probability Broach" by L. Neil Smith. 

 

MSB

--
No man is more pitiful than the one who looks to the shadows for warmth.

--

We all have skeletons in our closet.

Mine are so old, they have osteoporosis.

Maranatha! <><
John McKown

[matthe...@gmail.com]

I get that we have to work with the legal system details and that they may cause strange terms. Thanks for sharing some of those US details.

Isn’t there responsibility in putting tools out there publicly for anybody to use? Perhaps public distribution under the terms “don’t use this” is irresponsible and could be invalidated to the jury. I’m more concerned about the event that caused the court to be necessary though.

Can Sears laser engrave “this isn’t useful for anything” on their tools to avoid litigation due to poor craftsmanship? Is Sears responsible for poor craftsmanship causing injury if the Sears tool was bought second-hand at a garage sale?

Matt

[prade...@gmail.com]

If you really have legal concerns you should talk to a lawyer. Asking for anonymous opinion on a forum isn't legal advice. This should certainly not be the place to discuss legal matters such as the scope of a license. I don't think anybody who answered you is actually a lawyer. If you come upon something which you can't understand its license then don't use it.

[David Skinner]

Regarding this statement.

THE AUTHORS OF THIS SOFTWARE DID NOT INTENTIONALLY MAKE MISTAKES OR INCLUDE PRACTICAL JOKES

If you place software out in the wild, and you have a LICENSE with no warranty and indemnification and terms of service and imprint

• You are not protected from frivolous law suits.
• You are not protected if your actions were willful and malicious, or careless or negligent.
• You are not protected if you try to represent yourself pro se
• You are not protected if you are too broke to fight it in court.

If you do go to court and your attorney is computer savvy, he may demonstrate to the judge that there was a legal binding agreement that the damaged party had to have been aware of when visiting the web site or repository where the software was obtained. Most judges will seize upon such proof to dismiss a case or rule in your favor. Especially if your attorney testifies (inappropriate) that the agreement was one he drafted, or reviewed for fitness.

It is not necessary to state up front that you are not willful and malicious, or careless or negligent. Society expects that from you anyway.

This is not to be considered legal advice, it is just a personal observation.

For specific legal advice you should consult with your families attorney in your jurisdiction.

I once wrote a small program for a company on spec, it was too small for a formal contract. What I did for my own protection was to prepare a shrink wrap license that required them to scroll down and click OK before installing. When I went back a couple of weeks later to see if they like the utility program, they were very happy, until a gave them a hard copy of the license agreement. I had included a clause that if they used the program for more than one week they were obligated to provide me additional compensation in the form of lunch at my favorite restaurant. They thought it was a funny joke. I did get a fancy meal from them as we discussed the dangers of becoming obligated because of not reading the fine print.

You should be aware that if you do something as simple as putting your resume on the Internet and getting a programming assignment from Germany, you could be in for a stiff fine if you have not complied with their local regulations regarding imprint. If you have any contact with the EU and you fail to comply with their privacy laws then as a US citizen you may be considered in violation of treaty, big fine. The US is not the only place where the legal system can get oppressive.

[matthe...@gmail.com]

It is not necessary to state up front that you are not willful and malicious, or careless or negligent. Society expects that from you anyway.

I think practical jokes should be allowed under the GPL, BSD, and similar licenses.

If you really have legal concerns you should talk to a lawyer. Asking for anonymous opinion on a forum isn't legal advice. This should certainly not be the place to discuss legal matters such as the scope of a license. I don't think anybody who answered you is actually a lawyer. If you come upon something which you can't understand its license then don't use it.

I agree. I’m not a lawyer. I can’t recommend any open source license for life critical applications, which is an opinion I’ll bring to any future employer. On my own I’ve just been making art with Go and hope that the MIT license protects me from misuse liability in the general purpose libraries I’ve pulled from the art projects and put on GitHub.

I did get a fancy meal from them as we discussed the dangers of becoming obligated because of not reading the fine print.

I hope “oppressive” tends to mean “reasonable compromise”.

Matt

[Dan Kortschak]

I hope so. I provide a package (github.com/kortschak/zalgo) that I
cannot promise will not summon demons. It was written intentionally as
a joke. I disclaim all liability should use of the package bring about
meetings with demonic presences.

[matthe...@gmail.com]

I was thinking something like writing an undocumented “Happy New Year!” to standard out at the start of the year. An obvious but undocumented ‘rm -rf /‘ attempt was mentioned above.

My first program was a practical joke. On the calculator command line I said “press enter” then put the program call on the next line. The program would scroll some text forever. The command display state was preserved through being turned off, so somebody in the next class pressed enter then had their calculator lock up and I got in trouble because the teacher had to remove the batteries. I had an effect on many people because of the lost class time. I explained that there was a key to interrupt any program.

These university licenses allow newcomers to programming to make that kind of social mistake and I think it’s right to not punish them for it. I might not be a programmer if I had gotten detention for the calculator program, and things like GCC might not exist without some wild thinking. I don’t think this approach is right for industry, other serious ventures, and especially not for safety focused applications though.

It looks like the Intel corporate family thinks Intel, ARM, and Power architecture processor implementations are trustworthy enough for safety applications. There’s this OS called VxWorks said on the website to be intended for safe IoT device applications: https://www.windriver.com/products/vxworks/

It appears that WindRiver has worked with the GCC project for the VxWorks platform: https://www.windriver.com/products/product-notes/tornado2/gnu_relnote.pdf

QNX has a C/C++ toolchain for ARM and x86: http://blackberry.qnx.com/en/products/certified_os/safe-kernel

Here’s a 2011 thread about Go and RTOS: https://groups.google.com/forum/#!topic/golang-nuts/95BJqJvb7I0

There there’s a claim that the garbage collector makes Go unusable in real-time operating systems, but I think there are cases where real-time is less important than the OS being developed with reliability in mind. Maybe Go could be very useful on RTOS platforms.

My understanding is the intent for Go is to solve problems at Google. I think involving varying outside uses of Go will help Google by making a toolchain more robust than just Google applications will do, and I think the design of the Go language is ideal for a next generation of general purpose software like C was before. And I hope this thread adds value.

“No features contrary to documentation” seems like a mistake since documentation is usually not right. “No obfuscated features or obviously wrong features” seems too vague and may invite incorrect claims. “This software has no effects except for documented or obvious use”? Obviously a lawyer would have to translate it to match case results and other lawyer things, and those writing software under the license would have to be aware of the implications. I plan to email a summary of this discussion to FSF and OSI mailing lists.

Thanks,

Matt

[Michael Jones]

perhaps some context will make this clearer. no reference is being made to any actual persons or events.

1. It is the observed habit of people (plaintiff's) bring suit in court when something goes wrong. 

Ex: airplane crash, dark spot on potato chip, food is too hot, etc.

2. Plaintiff's attorneys have developed the habit of including everyone possible in the "bag guy" list; this creates a kind of mutual fund where everyone can settle for $10,000 and that, multiplied by 100 defendants, is $1M. The attorney gets 1/3 of that, so attorneys drive nice cars and fly first class.

Ex: car accident with fire.: sue the car company, the airbag company, the brake pad company, the glass company, the bumper designer, ...., the gas station, the gas transport truck, the oil refinery,...,the tire company, the person who designed the tire treads, etc.

3. After 60+ years of this, everyone who is wise to the situation sells retail products that specifically disclaim every possible dangerous use, and as many kinds of critical or life-safety misuse as can be foreseen, and wholesale products where every possible liability passes to the purchaser as a condition of sale. 

Ex: "You agree to not use the APIs for any activities where the use or failure of the APIs could lead to death, personal injury, or environmental damage (such as the operation of nuclear facilities, air traffic control, or life support systems)."

4. After 40+ years of open source having an observable footprint, open source entities, corporate contributors, and individuals have found that this style of "universal disclaimer" is an important defensive bulwark. Most people would not want to lose their house and savings as the result of contributing code to a matrix library that happens to be used in the science payload of a space project where the rocket engines explode on launch and the resulting fires and fumes cause problems for miles around resulting in a class-action suit for much of Florida. (crazy made-up example but perhaps it makes clear the idea of minimizing exposure to legal risks associated in no logical way with individual action.)

This is the context in which various excuse-laden, suitability-disclaiming, crazy-seeming license agreements arise.

As a real example, but with the name removed, I once saw in a parking lot a new pickup truck made by a well-known Japanese car manufacturer. It had a shiny chrome tubular framework rising up from the bed of the truck just behind the cab. The framework had lights attached. It have the truck a tough, off-road character. I said to my wife, "wow, that's quite the roll-bar for a little truck. Look how thick the tubes are." She said, there is a sticker on it what does it say. We looked, it read:  "decorative item not to be used off-road, in uneven terrain, or relied upon as protection in case of vehicle roll."

That is the real world of litigious people, 1/3 hungry attorneys, and juries that like to "do something" when there is a victim.

--

You received this message because you are subscribed to the Google Groups "golang-nuts" group.

To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Michael T. Jones
michae...@gmail.com

[matthe...@gmail.com]

Thanks for responding Michael.

"decorative item not to be used off-road, in uneven terrain, or relied upon as protection in case of vehicle roll."

The sticker I’ve been looking at says something like “modifying or attaching anything to this ROPS will compromise the structure and may cause injury or death” and I had a relative roll a tractor last year but is luckily ok.

I understand being conservative for the courts, but GCC and Go can make programs for computers that can do safety applications reliably. People maybe do with GCC derivatives. People do with Ada or C (and Go maybe is less mistake-prone than C at the language level).

Leveraging the work of an open or free project and contributing back improvements found in testing seems like a good idea to me for liable ventures and for the reliability of minimal liability uses that Google does with Go and maybe GCC. I don’t think these compiler projects should take on unnecessary liability, but one thing that can be done is to be sure there aren’t any intentional mistakes, backdoors, or practical jokes as allowed under the licenses. I'd like to guarantee that to liable ventures and it's a free win for general purpose computing anyway.

Matt

[Dave Cheney]

Thank you to all those who contributed to this thread. While many Go programs are written under open source licences, and many Go programmers contribute to open source in a professional or personal capability, it is now time to bring the discussion to a close as this thread has moved outside the scope of this mailing list.

Please feel free to continue this discussion in other forums.

Thanks

Dave