3 ms·

I was happy when I found out that my code was used in products by large companies like Disney and Hasselblad, but yet also ashamed because it was the cause of s

by zxcvgm 6y ago

I was happy when I found out that my code was used in products by large companies like Disney and Hasselblad, but yet also ashamed because it was the cause of some of their product vulnerabilities and painted their product in a bad light: - https://www.zdnet.com/article/circle-with-disney-web-filter-riddled-with-vulnerabilities/ https://www.zdnet.com/article/circle-with-disney-web-filter-... - https://threatpost.com/popular-circle-with-disney-parental-control-system-riddled-with-23-vulnerabilities/128711/ https://threatpost.com/popular-circle-with-disney-parental-c... The code in question was a primitive mDNS announcement library written in C, which I licensed under the 3-clause BSD license.

munificent 6y ago
I mean, that's clearly their fault and not yours. The license could not possibly be more clear: THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. They essentially picked up a print out of some source code they found laying on the ground in a park with a sticky note on top saying "DO NOT USE" and then threw it into their security-focused product for shits and giggles.
- bpodgursky 6y ago
  The guilt is obviously out of professional pride, not a sense of legal obligation.
- jcelerier 6y ago
  > They essentially picked up a print out of some source code they found laying on the ground in a park with a sticky note on top saying "DO NOT USE" and then threw it into their security-focused product for shits and giggles. to be fair mDNS is complex and shitty enough to use that it'd likely have been worse if they reimplemented it themselves. I mean just look at the official Apple code: - https://github.com/SteveKChiu/bonjour-embedded/blob/master/mDNSShared/dnssd_clientshim.c#L428 https://github.com/SteveKChiu/bonjour-embedded/blob/master/m... - https://github.com/SteveKChiu/bonjour-embedded/blob/master/mDNSShared/dnssd_clientshim.c#L755 https://github.com/SteveKChiu/bonjour-embedded/blob/master/m... - and the best, that 8kloc single file which implements the main logic of it https://github.com/SteveKChiu/bonjour-embedded/blob/master/mDNSCore/mDNS.c https://github.com/SteveKChiu/bonjour-embedded/blob/master/m... makes my eyes bleed every time

by zxcvgm 6y ago

munificent 6y ago

I mean, that's clearly their fault and not yours. The license could not possibly be more clear: THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. They essentially picked up a print out of some source code they found laying on the ground in a park with a sticky note on top saying "DO NOT USE" and then threw it into their security-focused product for shits and giggles.

bpodgursky 6y ago
The guilt is obviously out of professional pride, not a sense of legal obligation.
jcelerier 6y ago
> They essentially picked up a print out of some source code they found laying on the ground in a park with a sticky note on top saying "DO NOT USE" and then threw it into their security-focused product for shits and giggles. to be fair mDNS is complex and shitty enough to use that it'd likely have been worse if they reimplemented it themselves. I mean just look at the official Apple code: - https://github.com/SteveKChiu/bonjour-embedded/blob/master/mDNSShared/dnssd_clientshim.c#L428 https://github.com/SteveKChiu/bonjour-embedded/blob/master/m... - https://github.com/SteveKChiu/bonjour-embedded/blob/master/mDNSShared/dnssd_clientshim.c#L755 https://github.com/SteveKChiu/bonjour-embedded/blob/master/m... - and the best, that 8kloc single file which implements the main logic of it https://github.com/SteveKChiu/bonjour-embedded/blob/master/mDNSCore/mDNS.c https://github.com/SteveKChiu/bonjour-embedded/blob/master/m... makes my eyes bleed every time