Internet Virus: SunOS patches

[Noel Bell]

In article <12592 at steinmetz.ge.com>, davidsen at steinmetz.ge.com (William E. Davidsen Jr) writes:
> In article <580 at micropen> dave at micropen (David F. Carlson) writes:
> 
> | ...  But we must have responsible vendors ....
> 
>   I wonder if there is some legal obligation to fix known bugs in a
> piece of software you sell? Obviously if vendors were held responsible
> for unknown bugs, there would be no one selling software, or the price
> would be totally out of reach. But is there an obligation to fix a bug
> if you know about it?
> -- 
> 	bill davidsen		(wedu at ge-crd.arpa)

  Not being a lawyer and not wanting to be one, I will add a 2nd hand
  legal-type data point to the discussion anyway.

  A professor here at UT-Austin worked with a large chemical company
  to develop a process control algorithm.  Software developed by the
  professor ( read grad. student ) was installed on a test system and 
  will be installed on a full scale production unit soon.  
  This process unit has *exploded* at least once while being operated 
  with the old control system ( if it could be called that ).

  The professor had a legal document prepared and signed by the 
  necessary big shots which released him from any responsibility for
  the results of implementation of the software *except in the case
  of gross negligence*.  

  In this chemical case, I would consider failure to fix a known and 
  documented bug or potentially harmful feature to be gross negligence.  
  Even in the absence of said legal document,  I would think that gross 
  negligence would result in a civil suit if not a criminal charge. 
  ( Note: I am not advocating such a suit; but I would expect one in
          such circumstances )

  Noel Bell
  Department of Chemical Engineering
  University of Texas at Austin
  chcu275 at ut-emx