3 ms·

I don't understand why this should be illegal. The value of open source is that the code is there for anybody that wants to contribute, or fork in case people

I don't understand why this should be illegal. The value of open source is that the code is there for anybody that wants to contribute, or fork in case people find its maintenance unsuitable. And even if the project dies, the code remains there for anybody to pick it up later, in case it has value. It has happened before, it can happen again. On the other hand most open source volunteers are unpaid and have no contractual obligation. So tell me who is the criminal? The Apache Foundation? But that's silly, since this project might have been simply dumped on GitHub. The few volunteers that tried pushing some fixes since last year? Oracle for donating the project? Speak for yourself in this case, because I'd rather have companies release their stuff, instead of locking it away. This is an upsetting entitlement complex show here. If you want to contribute, then do so, otherwise GTFO.

CJefferson 9y ago
The criminality is putting a program on the internet which you know is full of security holes. It's not legal for me to set up a shop selling known faulty electronics, or even give them away for free unless I make clear I know they are faulty. I wonder if this should be extended to tech. I'm not saying they have to take the code down entirely, but they could pop a big warning on the download page at least. They are knowingly having thousands of downloads a day of software they have known is dangerously broken for over a year.
- lfam 9y ago
  Pretty much all free and open source software licenses specifically say there is no warranty at all. All non-trivial software has security bugs. To reiterate, every program you've ever heard of has had and will have serious security bugs. If no bugs have been published, then either nobody is looking or someone is keeping them secret. I agree that Apache has behaved irresponsibly.
  - votepaunchy 9y ago
    Apache has a process for retiring inactive top-level and incubator projects. It's not immediate but it does happen quite often.
    - tialaramex 9y ago
      Indeed it does. That's the process which was mooted last September. However contributors _and Apache Board Members_ chimed in to announce that Apache OpenOffice was healthy and would continue. They managed, weeks laters, to spit out a release containing almost literally just one bug fix and then nothing since. So long as Board Members pretend everything is fine the Apache process won't trigger. This has become about the ego of Board Members versus the interests of the wider community.
  - Dylan16807 9y ago
    There's a huge difference between "this has bugs, like all software" and "this has known exploitable bugs and there is no mention of this anywhere". Warranties are not the same as being misleading.

CJefferson 9y ago

The criminality is putting a program on the internet which you know is full of security holes. It's not legal for me to set up a shop selling known faulty electronics, or even give them away for free unless I make clear I know they are faulty. I wonder if this should be extended to tech. I'm not saying they have to take the code down entirely, but they could pop a big warning on the download page at least. They are knowingly having thousands of downloads a day of software they have known is dangerously broken for over a year.

lfam 9y ago
Pretty much all free and open source software licenses specifically say there is no warranty at all. All non-trivial software has security bugs. To reiterate, every program you've ever heard of has had and will have serious security bugs. If no bugs have been published, then either nobody is looking or someone is keeping them secret. I agree that Apache has behaved irresponsibly.
- votepaunchy 9y ago
  Apache has a process for retiring inactive top-level and incubator projects. It's not immediate but it does happen quite often.
  - tialaramex 9y ago
    Indeed it does. That's the process which was mooted last September. However contributors _and Apache Board Members_ chimed in to announce that Apache OpenOffice was healthy and would continue. They managed, weeks laters, to spit out a release containing almost literally just one bug fix and then nothing since. So long as Board Members pretend everything is fine the Apache process won't trigger. This has become about the ego of Board Members versus the interests of the wider community.
- Dylan16807 9y ago
  There's a huge difference between "this has bugs, like all software" and "this has known exploitable bugs and there is no mention of this anywhere". Warranties are not the same as being misleading.