14 ms·

No, you can't escape legal responsibility from intentional sabotage that easily.

by jeltz 5y ago

dvhh 5y ago
Tell that to the people that removed their 'leftpad' repository. Or the ones that are taking over FOSS project to inject 'telemetry' spyware
seba_dos1 5y ago
Intentional sabotage of my own project? It doesn't take much imagination to come up with situations where one may intentionally introduce vulnerabilities in use-cases they don't care about in order to make handling of use-cases they do care about easier. Are you sure I can't "escape legal responsibility" for doing that in my own software that I share to others "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT? (emphasis not mine ;))
- cutemonster 5y ago
  Sounds as if you believe you could edit & change open source code to try to intentionally crash a car or an airplane, or just not care about that happening, and get away with it, just because "AS IS".
  - randomswede 5y ago
    If the usage terms say "do not use in any critical applications", I would've thought that the responsibility for using the code in that fashion woudl be squarely with the entity that did the integration? It'd probably be better if the usage terms would by necessity spell out that you were happy for the code to be used in life-critical situations, instead of having to opt out of it.
    - seba_dos1 5y ago
      The default usage terms are "all rights reserved, nobody can use this but me". You change this by applying licenses which regulate the terms under which you're happy for the code to be used by others. The vast majority of popular Free Software licenses allow you to use the code under no guarantees whatsoever, so if you want to use some software in critical applications and hold its authors responsible if it doesn't work as advertised, you should probably pay them and include this responsibility in their contract.
- piaste 5y ago
  Irresponsibility != malice. If your FOSS software uses plaintext passwords because you don't care about data-at-rest security for whatever reason, sure, you're not required to make all your public code super secure. Otherwise all student projects uploaded to GitHub would be crimes. If your FOSS software adds a bit of code that POSTs all inputted credit card numbers to https://seba_dos1.com https://seba_dos1.com, well, that's gonna look very different in court. It's like holding a garage sale where you give stuff away for free. Nobody can complain if your old stereo that you gave away for free doesn't work, but if you have an old propane burner that's likely to sear somebody's face off, best to just throw it away.

No, you can't escape legal responsibility from intentional sabotage that easily.

by jeltz 5y ago

No, you can't escape legal responsibility from intentional sabotage that easily.

dvhh 5y ago

Tell that to the people that removed their 'leftpad' repository. Or the ones that are taking over FOSS project to inject 'telemetry' spyware

seba_dos1 5y ago

Intentional sabotage of my own project? It doesn't take much imagination to come up with situations where one may intentionally introduce vulnerabilities in use-cases they don't care about in order to make handling of use-cases they do care about easier. Are you sure I can't "escape legal responsibility" for doing that in my own software that I share to others "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT? (emphasis not mine ;))

cutemonster 5y ago
Sounds as if you believe you could edit & change open source code to try to intentionally crash a car or an airplane, or just not care about that happening, and get away with it, just because "AS IS".
- randomswede 5y ago
  If the usage terms say "do not use in any critical applications", I would've thought that the responsibility for using the code in that fashion woudl be squarely with the entity that did the integration? It'd probably be better if the usage terms would by necessity spell out that you were happy for the code to be used in life-critical situations, instead of having to opt out of it.
  - seba_dos1 5y ago
    The default usage terms are "all rights reserved, nobody can use this but me". You change this by applying licenses which regulate the terms under which you're happy for the code to be used by others. The vast majority of popular Free Software licenses allow you to use the code under no guarantees whatsoever, so if you want to use some software in critical applications and hold its authors responsible if it doesn't work as advertised, you should probably pay them and include this responsibility in their contract.
piaste 5y ago
Irresponsibility != malice. If your FOSS software uses plaintext passwords because you don't care about data-at-rest security for whatever reason, sure, you're not required to make all your public code super secure. Otherwise all student projects uploaded to GitHub would be crimes. If your FOSS software adds a bit of code that POSTs all inputted credit card numbers to https://seba_dos1.com https://seba_dos1.com, well, that's gonna look very different in court. It's like holding a garage sale where you give stuff away for free. Nobody can complain if your old stereo that you gave away for free doesn't work, but if you have an old propane burner that's likely to sear somebody's face off, best to just throw it away.