NetNews Usenet Archive 1992 #30/NN_1992_30.iso/spool/comp/security/misc/2340

Internet Message Format | 1992-12-21 | 6.9 KB

Xref: sparky comp.security.misc:2340 comp.org.eff.talk:7797
Path: sparky!uunet!cs.utexas.edu!zaphod.mps.ohio-state.edu!ub!csn!teal!bhayden
From: [e-mail] (Bruce Hayden)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Stupid Licenses (YUCK!)
Message-ID: <bhayden.724690634@teal>
Date: 18 Dec 92 14:57:14 GMT
References: <[e-mail]> <[e-mail]> <bhayden.724495103@teal> <[e-mail]>
Sender: [e-mail] (news)
Organization: Colorado SuperNet, Inc.
Lines: 123
Nntp-Posting-Host: teal.csn.org

[e-mail] (Charles Geyer) writes:

>In article <bhayden.724495103@teal> [e-mail] (Bruce Hayden) writes:
>>[e-mail] (David Douthitt) writes:
>>
>>>[e-mail] (Charles Geyer) writes:
>>
>>>Thank goodness someone else noticed those warrantees.  What a load of
>>>MALARKEY ...  Thank goodness for the part that says "SOME OF THESE
>>>LIMITATIONS MAY NOT BE VALID IN SOME STATES" -- ie, some states have
>>>passed laws that actually (GASP!) force a company to be (OH MY!) RESPONSIBLE
>>>for its products... in Wisconsin, Ibetcha it's the "Lemon Law" that I've
>>>heard about...
>>
>>>Now if it was only possible to get rid of the part that says,
>>>YOU DON'T OWN THIS PRODUCT, WE DO.  YOU ONLY PURCHASED THE RIGHT TO USE IT.
>>>ANYTHING WE SAY GOES...

>No not me.  I was the "someone else" the someone else you quoted quoted.

>>Not to give legal advice, but shrink-wrap licenses were recently discussed
>>either here or on another forum. My feeling is that they are not enforceable
>>as a license. There is no consideration to support the imposition of
>>a license. (under the theory that old consideration is bad consideration).

>And we weren't talking about shrink-wrap for bitty boxes.  What we were
>talking about is that no vendor of general purpose computers of any sort
>stands behind the product as much as an auto manufacturer.  If the software
>is broken, tough shit, you lose.  Buy an upgrade, which probably breaks lots
>of things that work now.  You lose again.

Sorry - it wasn't clear to me, and I had been wrapped up in the
shrink wrap discussion.

>This has been said a lot better than I can.

>An extract from RISKS DIGEST 11.15 (21 Feb 91)

>> In RISKS 11.14 there were many responses along the lines of "If I pay
>> good money to buy software, I expect it to work as it should."
>>
>> Brace yourself -- you didn't buy it.  You have licensed it.  If you check out
>> all the fine print somewhere, you'll see that you have a limited license to
>> use the software.
>>
>> Also, if you look in that same fine print, you are probably going to find a
>> disclaimer of warranty that absolves your vendor of all liability, and that
>> explicitly disclaims any warrant of mechantability or fitness for any purpose.
>> I.e., the software may not do anything, but they aren't *legally* representing
>> it as supposed to be doing anything!
>>
>> I don't think this is a proper way to do business, but it has become standard
>> in the industry.  There have been some cases where such warranty disclaimers
>> have been struck down in courts if the software failed to even boot up, but I
>> have never heard of the provisions being struck down for something like the
>> security bug leading to this discussion.
>>
>> In general, if you were to purchase a car or TV or any other major
>> appliance, and in so doing had to sign a piece of paper that said
>> (effectively):
>>   "You are not really buying this, you are leasing it.  You can't sell
>>    it or give it away without our permission, nor are you allowed to
>>    take it apart to see how it works.  We don't promise that it does
>>    anything in particular, despite what the salesman said.  If you try
>>    to use it and it fails, we're not responsible for any damages of
>>    any kind.  If really pressed, we'll exchange the item for a pile
>>    of the raw materials we used to construct it, at no charge to you.
>>    No other warranties are in effect on this item (except what may
>>    be in your state law) no matter what the salesman says -- we
>>    disavow any promises he made beyond this statement."
>> would you buy it?  We do it with software all the time.....
>>
>> The problem has complex roots, beyond the scope of a short message
>> here: intellectual property, software specification and testing, and
>> poorly-informed consumers add to the problem.  We have cultivated a
>> professional and commercial attitude that is really like only 2 other
>> professions -- and they have state licensing imposed on them:
>>    "I'm sorry, we did everything we could to treat the infection, but
>>     he just didn't respond."
>>    "I'm sorry -- we gave it our best shot, but the jury didn't
>>     believe you."
>>    "I'm sorry -- we used state-of-the art methods, but you know how
>>     hard it is to find *every* bug."
>>
>> The bottom line: by current definition and tradition, your vendor is not
>> really obliged to provide a fix unless you have a separate maintenance
>> agreement.  Talk of a recall is "silly."  If you don't like it, you can
>> always try to find another vendor to whom you take your business.
>>
>> Before any of you get too outraged by this, check carefully:
>>   *  If you sell a computer product, what do *you* disclaim?
>>   *  If you are a consumer, how many products have you bought
>>      this way without complaint?
>>   *  When have you conveniently blamed something on "the computer"?

>If I sold software, I'd do the same I suppose, but I don't and this stuff
>really pisses me off.  The customer is really screwed because the vendors
>are all alike.  The way I figure it, the first vendor that had any real
>respect for quality would wipe out the rest like Japan wiped out Detroit.
>But apparently no one in the industry sees it that way.

Well, the problem is that it is very hard to write software that doesn't
fail (ever), especially at commercially reasonable prices. So - everyone
is worried that they will get sued for the failure. This may be because
software is inhearantly more complex than other forms of engineering
(at least in my opinion). Ask yourself - how many parts does the averege
appliance, etc. have? Not that many does it. Now - how about software?

Another problem is that the courts have yet to address the question
of the normal level of care required in a software program. Is one
bug in a 1,000 lines of code inidicative of due care? How about 10
or 100? How significant is the error? I'm here making it sound
easier than it really is. More than just software metrics is required.

I am now an expert witness in a software case. My opinion is that the
software is defective, and that due care was not used in its preparation.
I think that this case is obvious. Many others are borderline. As a
plaintiff's attorney, I would argue for a high standard of care. As
a defense attorney, I would argue for a much lower standard.

Bruce E. Hayden
[phone]
[e-mail]