4 ms·

I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply: > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT

by ginko 7y ago

I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply: > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

disintegore 7y ago
IANAL but I'm fairly certain this protects you against legal action and not negativity on the internet. Furthermore, if we're to interpret this clause as "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large.
- jasonlotito 7y ago
  From the grand parent: "If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project." The reply: "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ... FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT." Furthermore, from the GP: "No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them." Nothing in the license implies any such guarantee. > "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large. I mean, that's what the license says. If you want assurances, get it in writing. Otherwise, when you use code, it's on you to make that guarantee of the code you are using. Entitlement. Gimme gimme gimme. It's a shame.
  - disintegore 7y ago
    I didn't think it could be so difficult to separate legal contracts from social ones. If you have voluntarily assumed the role of maintaining an open source project, it's perfectly reasonable for people to expect you to address merge requests and issues on the issue tracker. It's reasonable to expect a maintainer to process technical arguments and justify their technical decisions. The maintainer of course has no legal or moral obligation to perform any of these tasks. If he should ignore these assumed responsibilities, the users of the software can react in multiple ways. They can fork the project or use something else. In both cases they are also completely and utterly within their right to put into question the reliability and credibility of the aforementioned maintainer. Especially where it concerns software that people rely on for critical processes. All the "as is" clause means for security concerns (apart from its legal implications) is that the burden of making these guarantees lies on the community, and not the emitter of the software. It does not mean you should have no expectations of it at all and to suggest so is, frankly, nonsense. Lastly, I think if anyone is "entitled" to anything, it's respect. If the developer of actix truly felt like he was not getting the respect he deserved then his reaction is completely justified.
    - sneak 7y ago
      Legal statements aren't special. They are also plain old social statements, which I think was his point. It's not solely a "don't sue me".
      - ssokolow 7y ago
        However, that disclaimer exists in all major open-source licenses, including all such software explicitly marketed such that a Reasonable Person (in the legal sense) would interpret it as a statement of fitness for purpose. Thus, the disclaimer in the license cannot double as a disclaimer in the social arena.
ekianjo 7y ago
> I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply This is a really bad answer because the most reliable and robust free software projects out there all use this same boilerplate license warnings. This is just for legal protection.
- kube-system 7y ago
  I think it is a fine answer, albeit incomplete. Many of those robust projects you mention are supported by contracts which do guarantee some work is being done. If you’d like some guarantees of quality, you are free to negotiate a contract with the maintainers for those guarantees. Think of MIT’s warranty disclaimer as the “free tier” of service.
- watwut 7y ago
  No, that is actual scope of warranty and assurance those developers intend to promiss. Everything else is beyond and above. I pretty much guarantee you that if the "clearly mark your project as toy project" thing would become something people actually are expected to use, it would be everywhere too. As if now it is nowhere, not on very clear toy projects and not on serious looking projects thay are sparsely maintained. The ones with license are all clear on limited warranty.
jimbokun 7y ago
Sure, so in the case of actix-web, the decision of many has been to stop using the project because it wasn't safe. I didn't see any discussion of legal liability, just a community deciding to stop using and supporting this library. (Just going by Klabnik's article, I knew nothing about this library before reading it. There may be more context of which I'm not aware.)
- steveklabnik 7y ago
  I am not aware of anyone bringing legal liability into this situation, in any form.
  - jimbokun 7y ago
    I am replying to a comment citing legal liability language from a license?
    - steveklabnik 7y ago
      I was trying to address your "There may be more context of which I'm not aware," and all I was trying to say is that nobody was making claims that somehow the author was violating some sort of license duty or whatever.
pjc50 7y ago
We're not expecting a warranty and we're not asking for damages. It's not really surprising that the Rust community is made out of people who've chosen to take extra effort in security, and that they wouldn't tolerate a cavalier attitude to it. It's disappointing that this was expressed in an unconstructive way.
4bpp 7y ago
A similar disclaimer is contained in the GPLv2 and therefore applies to the Linux kernel. Does that mean we can not impose any expectations regarding security on its maintainers either? Why can't we have legal disclaimers like this so that the legal system with its tech-oblivious case law and multi-million-dollar penalties is prevented from interfering while also retaining softer sanctions such as the threat of community ostracism/obnoxious messages to incentivise some degree of quality?
- AlexandrB 7y ago
  > Does that mean we can not impose any expectations regarding security on its maintainers either? Yes. If you want a secure version of Linux, pay a vendor like Red Hat who’s willing to provide those assurances.
tolmasky 7y ago
OpenSSL's license (Apache v2), also has the "AS IS" clause. I guess we should just wholesale dump any concept of security since the very basic technique of protecting oneself from litigation on the possibility of something going wrong should instead now be interpreted to mean "this is a toy project with zero guarantees". There is a difference between "Hey, this is a silly side project so definitely use at your own risk, as far as I'm concerned its a place for me to learn and should be treated as a toy" and "Hey, I think this is worth your time, you should use this in your production stack, and obviously I've set up legal protections so you can't sue me if something goes wrong, but I am trying to push this as something lots of people should use and trust". If someone walks into my house and tries cookies I'm clearly learning how to make and then throws up, that's very different than me putting up a big "FREE AMAZING BETTER COOKIES" sign on the sidewalk and handing them out and having people throw up. In both scenarios, the cookies are free! What are you blaming me for! How entitled! In the first, I think that position is more defendable. In the second, ehhh..... For the record -- I'm not super familiar with this project, but I think that a lot of people don't consider the ramifications of being successful sometimes: your project could be used by a big company and lead to people's information getting hacked (and those people had nothing to do with any of these decisions). The only thing asked is to be upfront that this is not intended for that, as opposed to the temptation of calling your thing the best and telling everyone to use it. In the run up of a project, I think it's easy to forget that and get really hyped on showing how your thing is better than some incumbent for example. Just something to keep in mind.
- kelnos 7y ago
  > OpenSSL's license (Apache v2), also has the "AS IS" clause. I guess we should just wholesale dump any concept of security since the very basic technique of protecting oneself from litigation on the possibility of something going wrong should instead now be interpreted to mean "this is a toy project with zero guarantees". Essentially: yes. If you want any guarantees beyond that, you have to pay for them, or trust that others have paid for them. Absent that, you have to make your own judgment as to whether or not the maintainers will run the project in a way you feel comfortable with. If they do; great. If not, move on (or contribute, or fork it), because you have no right to tell them how to maintain their project.

by ginko 7y ago

disintegore 7y ago

IANAL but I'm fairly certain this protects you against legal action and not negativity on the internet. Furthermore, if we're to interpret this clause as "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large.

jasonlotito 7y ago
From the grand parent: "If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project." The reply: "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ... FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT." Furthermore, from the GP: "No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them." Nothing in the license implies any such guarantee. > "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large. I mean, that's what the license says. If you want assurances, get it in writing. Otherwise, when you use code, it's on you to make that guarantee of the code you are using. Entitlement. Gimme gimme gimme. It's a shame.
- disintegore 7y ago
  I didn't think it could be so difficult to separate legal contracts from social ones. If you have voluntarily assumed the role of maintaining an open source project, it's perfectly reasonable for people to expect you to address merge requests and issues on the issue tracker. It's reasonable to expect a maintainer to process technical arguments and justify their technical decisions. The maintainer of course has no legal or moral obligation to perform any of these tasks. If he should ignore these assumed responsibilities, the users of the software can react in multiple ways. They can fork the project or use something else. In both cases they are also completely and utterly within their right to put into question the reliability and credibility of the aforementioned maintainer. Especially where it concerns software that people rely on for critical processes. All the "as is" clause means for security concerns (apart from its legal implications) is that the burden of making these guarantees lies on the community, and not the emitter of the software. It does not mean you should have no expectations of it at all and to suggest so is, frankly, nonsense. Lastly, I think if anyone is "entitled" to anything, it's respect. If the developer of actix truly felt like he was not getting the respect he deserved then his reaction is completely justified.
  - sneak 7y ago
    Legal statements aren't special. They are also plain old social statements, which I think was his point. It's not solely a "don't sue me".
    - ssokolow 7y ago
      However, that disclaimer exists in all major open-source licenses, including all such software explicitly marketed such that a Reasonable Person (in the legal sense) would interpret it as a statement of fitness for purpose. Thus, the disclaimer in the license cannot double as a disclaimer in the social arena.

ekianjo 7y ago

> I'm not sure which license was used by actix-web, but let me quote the last section of the MIT license as a reply This is a really bad answer because the most reliable and robust free software projects out there all use this same boilerplate license warnings. This is just for legal protection.

kube-system 7y ago
I think it is a fine answer, albeit incomplete. Many of those robust projects you mention are supported by contracts which do guarantee some work is being done. If you’d like some guarantees of quality, you are free to negotiate a contract with the maintainers for those guarantees. Think of MIT’s warranty disclaimer as the “free tier” of service.
watwut 7y ago
No, that is actual scope of warranty and assurance those developers intend to promiss. Everything else is beyond and above. I pretty much guarantee you that if the "clearly mark your project as toy project" thing would become something people actually are expected to use, it would be everywhere too. As if now it is nowhere, not on very clear toy projects and not on serious looking projects thay are sparsely maintained. The ones with license are all clear on limited warranty.

jimbokun 7y ago

Sure, so in the case of actix-web, the decision of many has been to stop using the project because it wasn't safe. I didn't see any discussion of legal liability, just a community deciding to stop using and supporting this library. (Just going by Klabnik's article, I knew nothing about this library before reading it. There may be more context of which I'm not aware.)

steveklabnik 7y ago
I am not aware of anyone bringing legal liability into this situation, in any form.
- jimbokun 7y ago
  I am replying to a comment citing legal liability language from a license?
  - steveklabnik 7y ago
    I was trying to address your "There may be more context of which I'm not aware," and all I was trying to say is that nobody was making claims that somehow the author was violating some sort of license duty or whatever.

pjc50 7y ago

We're not expecting a warranty and we're not asking for damages. It's not really surprising that the Rust community is made out of people who've chosen to take extra effort in security, and that they wouldn't tolerate a cavalier attitude to it. It's disappointing that this was expressed in an unconstructive way.

4bpp 7y ago

A similar disclaimer is contained in the GPLv2 and therefore applies to the Linux kernel. Does that mean we can not impose any expectations regarding security on its maintainers either? Why can't we have legal disclaimers like this so that the legal system with its tech-oblivious case law and multi-million-dollar penalties is prevented from interfering while also retaining softer sanctions such as the threat of community ostracism/obnoxious messages to incentivise some degree of quality?

AlexandrB 7y ago
> Does that mean we can not impose any expectations regarding security on its maintainers either? Yes. If you want a secure version of Linux, pay a vendor like Red Hat who’s willing to provide those assurances.

tolmasky 7y ago

OpenSSL's license (Apache v2), also has the "AS IS" clause. I guess we should just wholesale dump any concept of security since the very basic technique of protecting oneself from litigation on the possibility of something going wrong should instead now be interpreted to mean "this is a toy project with zero guarantees". There is a difference between "Hey, this is a silly side project so definitely use at your own risk, as far as I'm concerned its a place for me to learn and should be treated as a toy" and "Hey, I think this is worth your time, you should use this in your production stack, and obviously I've set up legal protections so you can't sue me if something goes wrong, but I am trying to push this as something lots of people should use and trust". If someone walks into my house and tries cookies I'm clearly learning how to make and then throws up, that's very different than me putting up a big "FREE AMAZING BETTER COOKIES" sign on the sidewalk and handing them out and having people throw up. In both scenarios, the cookies are free! What are you blaming me for! How entitled! In the first, I think that position is more defendable. In the second, ehhh..... For the record -- I'm not super familiar with this project, but I think that a lot of people don't consider the ramifications of being successful sometimes: your project could be used by a big company and lead to people's information getting hacked (and those people had nothing to do with any of these decisions). The only thing asked is to be upfront that this is not intended for that, as opposed to the temptation of calling your thing the best and telling everyone to use it. In the run up of a project, I think it's easy to forget that and get really hyped on showing how your thing is better than some incumbent for example. Just something to keep in mind.

kelnos 7y ago
> OpenSSL's license (Apache v2), also has the "AS IS" clause. I guess we should just wholesale dump any concept of security since the very basic technique of protecting oneself from litigation on the possibility of something going wrong should instead now be interpreted to mean "this is a toy project with zero guarantees". Essentially: yes. If you want any guarantees beyond that, you have to pay for them, or trust that others have paid for them. Absent that, you have to make your own judgment as to whether or not the maintainers will run the project in a way you feel comfortable with. If they do; great. If not, move on (or contribute, or fork it), because you have no right to tell them how to maintain their project.