On the road to Bandol

As of today, when your software stops working, or when a blatant security hole in a product puts your personal data in the hands of an ill-intentioned pirate, there is nothing you can do: software comes without any real warranty, and you are just stuck with it and its problems.

This is of course absolutely unfair, as customers should expect some level of warranty when they purchase a product. The European Commission’s customer commissioners seem to feel that this unfairness needs to disappear, and that, just like any other product, software should offer a warranty. Naturally, software publishers don’t agree, and the BSA’s director of public policy has stated:

Digital content is not a tangible good and should not be subject to the same liability rules as toasters.

Reading this makes me shivers. Software can be reliable, and there is a lot of reliable software running today in our planes, cars, power plants, and other high-security environments. It seems that software publishers are a band of amateurs rather than an industry, and that they are just plain irresponsible. Now, is that the right thing to do?

Naturally, software does not come in a single flavor, and this is one of the difficulties that we face here. Let’s look at a few examples:

• A small mobile game. Here, we are talking about a 0.79€ application on an application store, with limited functionality, and a limited price. In many cases, these are actually amateur works, so what should we expect? I can’t speak for everybody else, but I like applications that don’t crash, and that of course, that cannot be defined in any way as malware.
• A professional PC application, costing for instance 1000€ from a small vendor. Now, what should we expect? From a small vendor, perfection may be hard to ask; niche vendors allow us to have software that addresses our specific problems, at an acceptable cost (compared to the complexity of the problem). In such a case, I like applications that don’t waste my work (i.e., that doesn’t crash, or that crashes properly), and for which an efficient support can be provided. Such vertical applications often come as a combination of license and support, and the support should offer more than a yearly release.
• A common application from a major vendor (for instance, Microsoft Word). Since I am not a power user, I expect to have absolutely no bugs, and a good speed in the security updates, if any. Basically, I don’t expect any problems.
• A common (and complex) open-source application. Basically, my expectations are the same than for a major vendor. I expect these very common applications to work, that’s it.

If we look at the means available to the vendors, there is quite a large variety:

• Testing. Testing is great, but its complexity is usually not even linear, which makes it very difficult for large applications. Testing is crucial for small vendors.
• Static analysis. It can be very useful in some situations, for instance if you want to prove that an application satisfies a preset quality/security policy, expressed as a set of rules. Static analysis can be very useful for mobile applications, making sure that they don’t crash and they don’t engage in dangerous behavior.
• User feedback. This is crucial for the common applications, because of the size of their user base. It can work even better for open source application, because some of the users may feel compelled to report a bug if they encounter one.
• User pressure. Any software distributed in an application store or another way in which users can give their feeling gets a lot of user pressure. This is very useful, because it forces developers to apply sufficient testing.

So, what is my feeling? Providing strong guarantees is not always easy, but all software vendors should assume some level of responsibility, depending on many factors, including the price of the software and the number of copies circulating.

And finally, is this really important? Just like everything else, software is evolving these days, and we are expecting many changes in the near future. Software is moving away from our computers, as we use more online services; the boundaries of different pieces of software are blurring as mashups become more common; and with the “cloud”, we are not even sure where the code runs. So, how can we enforce such rules?

Nevertheless, I still believe that irresponsibility is not a viable basic rule, and that the European Commission is right to put the topic on the table. At least, they are starting an interesting debate on the topic.