AfterBites: Expanding Consumer Protection Laws to Software

The Story:

This has been tried before and - it should come as no surprise to anyone - the software industry has some mighty powerful lobbyists. Indeed, some of them speak out in this little tidbit. I think it would have been more honest if Business Software Alliance Senior Director of Public Policy in Europe Francisco Mingorance had said "Good luck, bwaaaahaaahaaahaaaa!" instead of hewing the ridiculous party line that the software industry has been spouting for decades. I like intellectual honesty when I encounter it.

Here's the problem: "creators of digital goods cannot predict with a high degree of certainty both the product's anticipated uses and its potential performance" utterly ignores the fact that customers buy software with an expectation that it will perform (AKA "work") at least somewhat as advertised. Nobody buys an operating system expecting that they're going to need to patch it every week. Nobody buys a file-viewer with the expectation that they'll need to periodically download new versions, rummage for a CD or a licence key, and reboot their machine. I suspect that, if people did buy software under such expectation, that they'd be willing to pay about $15.99/year for it, instead of hundreds or thousands of dollars. Most of us have a dollar amount that represents the pain-point we're willing to write off - we'll put up with a lot of nonsense from something that cost us nothing (example: Linux) - but we expect things to work if we actually spent real money (for personal users, I'd guess that's about $50, for corporate - maybe $1000) on them. Back when I was the CEO of NFR I discovered this was absolutely true: customers didn't hesitate to grab me by the collar at conferences and lecture me about every bug they'd ever found in our product. Executives at smaller companies like Tenable are reachable; we can't hide behind an EULA and we don't have professional spokesthings to protect us from the media.

There should probably be an exemption for things that are programmable, if the end user has tried to program them. You can write logic-errors in any programming language that supports if statements, while loops, or function calls. But if your product installs out of the box - like, say, an operating system, browser, image editor, database, word processor - then it ought to work, and keep working. Especially operating systems, because they're what ultimately makes everything else work. Sun's Java End User License Agreements ("EULA"s) includes:

Java technology is not fault tolerant and is not designed,  manufactured, or intended for use or resale as on-line control equipment in  hazardous environments requiring fail-safe performance, such as in the  operation of nuclear facilities, aircraft navigation or communication systems,  air traffic control, direct life support machines, or weapons systems, in  which the failure of Java technology could lead directly to death, personal  injury, or severe physical or environmental damage.

Fail-safe performance, to me, means that my telephone should work. Especially since my phone company put it in the phone without giving me a choice in the matter. If I just cut my arm with my circular saw or fell off my high horse and broke my hip, and I'm calling for help, my phone is mission critical.

The bottom line here is that the current state of affairs will not continue forever. But, obviously, software manufacturers are going to enjoy it while they can. What they don't realize is that Software-As-A-Service (SAAS) is a direct response to their EULAs and unreliability. Because customers who are looking at SAAS are looking at uptime and performance guarantees as part of their terms of service.

I give the current state of affairs under 20 years, probably closer to 15. If I'm still alive I'll link back to this blog entry and say "I told you so!" and you can all laugh at me if I'm wrong. :D

mjr.

---

PS - a special tip of the hat to (deleted) who noticed that I've been using Comic SANS as the font for my quoted SANS articles, and made the connection.