Re: Do we need to hide packages in NEW queue
Marc Haber <mh+debian-devel@zugschlus.de> writes:
> Even if a lawyer says A, it doesn't buy us anything if J Robert DD gets
> sued and the judge says B, or "not A".
Yes, a legal opinion cannot fully resolve the question, unfortunately,
since it's a risk judgment. Copyright law is murky enough that it's
unlikely that any lawyer will be willing to guarantee that we won't lose a
lawsuit, and of course no one can guarantee that we won't be sued.
What a lawyer can do is give us a better risk analysis. How *likely* is
it that we would be sued over such a thing, and if we were, what would
happen then? How much would it cost us to dispose of the resulting
lawsuit?
I think it's useful to view this as a price. We're paying a quite
substantial price right now to implement pre-screening. If we increase
the risk that we may temporarily distribute something that we shouldn't
until we discover that and fix it, that comes with some corresponding
increased risk of a legal cost. But in the meantime we'd be saving a
substantial pre-screening cost.
A lawyer cannot make that risk trade-off decision for us. We'll have to
make it as a project. But my hope would be that they could help put a
number on the likely legal cost in the worst-case scenario and provide
some input into the likelihood of that scenario, and some context in terms
of what other organizations do and what risks it's common to accept and
mediate if it becomes a problem.
My personal guess is that, given how completely casual or even openly
contemptuous most companies are about copyright licensing and how insanely
difficult it's been to get them to face any legal consequences whatsoever,
it seems unlikely that dealing with some licensing issues more reactively
would be a substantial legal risk. By dealing with them *at all*, and we
would of course continue to hold ourselves to the same high standard that
we always have, we're already doing far better than the industry norm.
But a lawyer would have much more concrete experience and would be able to
provide a far better analysis.
--
Russ Allbery (rra@debian.org) <https://www.eyrie.org/~eagle/>
Reply to: