Comment by gjsman-1000

> Who do I sue, and who has insurance, if something goes wrong?

You sue the Red Hat-like support company with whom you ostensibly signed a contract.

If your question is who does the Red Hat-like support company sue if they want accountability for the code they are leveraging, I guess I don't understand the question or its relevance. E.g., with regard to proprietary code, who does Microsoft microsoft when Microsoft microsofts Microsoft? (Fun to write, but I don't think that sentence really makes sense.)

Do you think a small mom-and-pop dentist can win a lawsuit against Google?

There's absolutely no way that dentist will have a well-negotiated contract with SLA's and damage compensation with Google. The extent of their business relationship is that the dentist clicked a checkbox and put in their credit card details. Google does not even know they exist.

If Gmail loses all your email and accidentally kills your entire business, the absolute best outcome is a refund of your $10/month business subscription fee. The idea that they could in any way be held responsible is ludicrous.

> The problem open-source [...] has never overcome is accountability.

There are lots of organizations that provide a throat-to-choke-as-a-service, e.g. Red Hat.

> just pay Gmail, don’t spend the required amount of time to self host

Are you seriously suggesting a business put their contacts in the hands of Google, who has reportedly been totally capricious with account actions in the past and is notoriously difficult to contact when problems arise?

> and open-source is stuck at being hobbyists if there is no corporate sponsorship

Corpo sponsorship required for success? I guess I better tell all the open-source projects being used by millions that they're just hobbyists now.

> The problem [...] everything digital [...] Who do I sue, and who has insurance, if something goes wrong?

I have heard of analog world nostalgia, but you refer to the pre-digital age as if you didn't live through it. It's easier to locate someone today than ever before.

I'd say if you take software that doesn't cost you anything, either

(1) you carry the risk or

(2) find someone that operates the software for you (on premise or SaaS) and they may also carry the risk for the premium you pay them.

This isn't a problem with open source. For many of us with startups that have low stakes (worst we can do is have no users) a lack of support is fine, we can do it ourselves and save the money.

And there's plenty of consultancies which will support OSS and give you support if you need it and be your scapegoat. Red Hat, Suse, IBM come to mind and there's many others...

You're being downvoted but yes, this is about risk mitigation. The IT department at a health care organization has to balance matching the requirements of payers, admins and clinical staff, do so in a way that fits inside the allocated budget, and de-risk the unknowns as much as possible.

Even if the vendors are only half accurate about the solution they offer, by being paid suppliers, they are on the hook (to varying degrees). These systems are highly customized and serious headaches arise from interoperability and security. If some of that can be shifted to a vendor, it's a net positive insofar as the IT department and the compliance departments are concerned.

Some healthcare organization have invested in the technology side and become leaders in innovation but those are the exception.

The person implementing the system for the hospital is accountable. I don’t see why this is difficult because it would be the same if that person built their own product from scratch.

There’s no vendor here that they can sue if they were paying for a product and deploying that, but that’s a different situation and the hospital, frankly, won’t care about that. Who their supplier subsequently sues isn’t their problem.

You sue the developers. It’s how it works in general. So basically you’d comb the commit history for the project and name everyone in the lawsuit that you could.