Re: Support (was: Democracy and organisation) - Mailing list pgsql-advocacy

On Thu, Jun 27, 2002 at 12:41:26AM -0600, Tim Hart wrote:

> If a catastrophic software failure results in a high percentage of lost
> revenue, a corporation might be able to seek monetary compensation from
> a commercial vendor. They could even be taken to court - depending upon
> licensing, product descriptions, promises made in product literature,
> etc. For cases like open source projects, like PostgreSQL, there is no
> legal recourse available.

That is only sort of true.  IANAL, though, so you should still get a
legal opinion.

First, read the EULA of the commercial packages.  I've never seen one
that didn't have something very similar to the following, which is
taken verbatim from the PostgreSQL license:

THE UNIVERSITY OF CALIFORNIA SPECIFICALLY DISCLAIMS ANY WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE
PROVIDED HEREUNDER IS ON AN "AS IS" BASIS, AND THE UNIVERSITY OF
CALIFORNIA HAS NO OBLIGATIONS TO PROVIDE MAINTENANCE, SUPPORT,
UPDATES, ENHANCEMENTS, OR MODIFICATIONS.

Every company puts that in their warranties, precisely to head off
such lawsuits in the first place.

The problem is that (a) in some states or other locales, such
disclaimers are illegal, and (b) disclaiming an implied warranty of
fitness is tricky if employees of your company have made explicit
promises that a system will do such-and-thus (in casual parlance,
such promises are called "sales calls").

So you're right that it is sometimes possible to try to sue the
licensor of the software for damages.  Whether you have a hope of
winning, or (more importantly) winning anything other than a Pyhrric
victory, is another question.  I suspect that imagining one might sue
a software vendor is silly not because it is impossible, but because
it would almost always be totally impractical.  IBM fought the
Justice Department for 30 years.  Microsoft has been doing the same
for at least 10.  And they'd have _way more_ interest in fighting any
attempt to make them liable for flaws in their programs, and would be
being sued by people with much shallower pockets than the DoJ.

It's also true that several bits of legislation (UCITA most
obviously) have attempted to protect software publishers from
_explicit malfeasance_, not just incompetence.  There is currently a
move afoot by some of the security community to make it possible to
hold companies legally liable for consequential damages of their
software's behaviour.  Both of these items suggest that a lawsuit
would have next to no chance of winning.

Finally, I note that, in spite of the suggestions of a lawyer back
when Great Bridge was starting up (see
<http://archives.postgresql.org/pgsql-general/2000-07/msg00024.php>),
the "exculpatory language" of the PostgreSQL license never was
extended to the PostgreSQL Global Development Group.  Therefore, it
strikes me that PostgreSQL developers could still be sued under the
current license, but I haven't read through that whole thread again
(I remember when it happened the first time, and I've little wish to
re-read all the UCITA arguments again), so maybe there was some
conclusion that the exculpatory language was extended by implication.

A

--
----
Andrew Sullivan                               87 Mowat Avenue
Liberty RMS                           Toronto, Ontario Canada
<andrew@libertyrms.info>                              M6K 3E3
                                         +1 416 646 3304 x110