<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE>RE: Compromised machines liable for damage? </TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>In the general sense, possibly, but where there are lawyers there is always discoragement.<BR>
<BR>
Suing people with no money is easy, but it does stop them from contributing in most cases. There are always a few who like getting sued. RIAA has shown companies will widescale sue so your argument is suspect, IMO..<BR>
<BR>
<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: Owen DeLong [<A HREF="mailto:owen@delong.com">mailto:owen@delong.com</A>]<BR>
Sent: Mon Dec 26 23:11:13 2005<BR>
To: Hannigan, Martin; Joseph Jackson<BR>
Cc: NANOG<BR>
Subject: RE: Compromised machines liable for damage?<BR>
<BR>
I've seen this argument time and again, and, the reality is that it is<BR>
absolutely<BR>
false.<BR>
<BR>
In fact, it will do nothing but encourage freeware. Liability for a product<BR>
generally doesn't exist until money changes hands. If you design a piece of<BR>
equipment and post the drawings in the public domain, you are not liable<BR>
if someone builds it and harms themselves. You are liable if someone pays<BR>
you for the design, because, the money changing hands creates a "duty to<BR>
care".<BR>
Outside of a "duty to care", the only opening for liability is if they<BR>
can prove that you failed to take some precaution that would be expected<BR>
of any "reasonably prudent" person.<BR>
<BR>
So, liability for bad software and the consequences it creates would be<BR>
bad for the Micr0$0ft and Oracles of the world, but, generally, very good<BR>
for the Free Software movement. It might turn out to be bad for<BR>
organizations<BR>
like Cygnus and RedHat, but, that's more of a gray area.<BR>
<BR>
As to the specific example cited...<BR>
<BR>
If no update has been released, in the case of Open Source, that's no<BR>
excuse.<BR>
You have the source, so, you don't have to wait for an update. In the case<BR>
of closed software, then, I think manufacturer liability is a good thing<BR>
for the industry in general.<BR>
<BR>
Owen<BR>
<BR>
<BR>
--On December 26, 2005 10:07:20 PM -0500 "Hannigan, Martin"<BR>
<hannigan@verisign.com> wrote:<BR>
<BR>
><BR>
><BR>
> If you want to choke off freeware(gnu, et. Al), sure, go after them. I<BR>
> doubt the licensing agreement allows it though. (IANAL).<BR>
><BR>
> I think all you'd do is encourage people to write more music about<BR>
> 'freeing the software'. I'd rather not be stricken in that fashion.<BR>
><BR>
> I think that angle is DOA.<BR>
><BR>
> Martin<BR>
><BR>
><BR>
> -----Original Message-----<BR>
> From: Joseph Jackson [<A HREF="mailto:jjackson@aninetworks.com">mailto:jjackson@aninetworks.com</A>]<BR>
> Sent: Mon Dec 26 03:13:02 2005<BR>
> To: Hannigan, Martin<BR>
> Cc: NANOG<BR>
> Subject: RE: Compromised machines liable for damage?<BR>
><BR>
> What about the coders that write the buggy software in the first place?<BR>
> Don't they hold some of the responsibility also? IE I am running some<BR>
> webserver software that a bug is found in it. Attackers use that bug in<BR>
> the<BR>
> software to generate a DOS attack against you from my machines. No update<BR>
> has been released for the software I am running and/or no warning as been<BR>
> released. You sue me I sue the coders. What a wonderful world. (I'm not<BR>
> for this but its another side of the issue.)<BR>
><BR>
><BR>
><BR>
> _____<BR>
><BR>
> From: owner-nanog@merit.edu [<A HREF="mailto:owner-nanog@merit.edu">mailto:owner-nanog@merit.edu</A>] On Behalf Of<BR>
> Hannigan, Martin<BR>
> Sent: Sunday, December 25, 2005 9:22 PM<BR>
> To: Steven M. Bellovin<BR>
> Cc: Dave Pooser; NANOG<BR>
> Subject: Re: Compromised machines liable for damage?<BR>
><BR>
><BR>
><BR>
><BR>
><BR>
> Yes, I agree. As usual, I too am 'IANAL'.<BR>
><BR>
> Marty<BR>
><BR>
><BR>
><BR>
> -----Original Message-----<BR>
> From: Steven M. Bellovin [<A HREF="mailto:smb@cs.columbia.edu">mailto:smb@cs.columbia.edu</A><BR>
> <<A HREF="mailto:smb@cs.columbia.edu">mailto:smb@cs.columbia.edu</A>> ]<BR>
> Sent: Sun Dec 25 23:52:27 2005<BR>
> To: Hannigan, Martin<BR>
> Cc: Dave Pooser; NANOG<BR>
> Subject: Re: Compromised machines liable for damage?<BR>
><BR>
> In message<BR>
> <80632326218FE74899BDD48BB836421A033001@Dul1wnexmb04.vcorp.ad.vrsn.c<BR>
> om>, "Hannigan, Martin" writes:<BR>
><BR>
>><BR>
>> Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting =<BR>
>> dichotomy.<BR>
>><BR>
><BR>
> "Wins" is too strong a word, since I don't think any have gone to<BR>
> court -- see<BR>
> <A HREF="http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html">http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html</A><BR>
> <<A HREF="http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html">http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html</A>><BR>
> as my source.<BR>
><BR>
> Besides, it's a very different situation. For my take on liability<BR>
> issues -- note that I'm not a lawyer, and note that this is from 1994<BR>
> -- see <A HREF="http://www.wilyhacker.com/1e/chap12.pdf">http://www.wilyhacker.com/1e/chap12.pdf</A><BR>
> <<A HREF="http://www.wilyhacker.com/1e/chap12.pdf">http://www.wilyhacker.com/1e/chap12.pdf</A>><BR>
><BR>
> --Steven M. Bellovin, <A HREF="http://www.cs.columbia.edu/~smb">http://www.cs.columbia.edu/~smb</A><BR>
> <<A HREF="http://www.cs.columbia.edu/~smb">http://www.cs.columbia.edu/~smb</A>><BR>
><BR>
><BR>
><BR>
><BR>
<BR>
<BR>
<BR>
--<BR>
If this message was not signed with gpg key 0FE2AA3D, it's probably<BR>
a forgery.<BR>
</FONT>
</P>
</BODY>
</HTML>