6 ms·
Why would the developer of any software that comes explicitly without warranty be hold responsible for downstream breakages? It's not as if one could force peop
by esarbe 5y ago
Why would the developer of any software that comes explicitly without warranty be hold responsible for downstream breakages? It's not as if one could force people to upgrade to newer versions and they can always keep depending on the old releases.
- afiori 5y agoFrom the point of view of GH the license is irrelevant, what they see is that a project they host is in practice being use to distribute malware.
- deadbunny 5y agoPrinting strings is malware?
- shukantpal 5y agoIn an infinite loop, yes.
- CRConrad 5y agoHow did he propagate this virus? Did he send everyone an email saying "Click here for hot chicks for free!", or what?
- libraryatnight 5y agoI don't know who convinced you being deliberately obtuse was an effective rhetorical device, but it's not.
- josephcsible 5y agoIn general, warranties only relate to accidental problems and have nothing to do with intentional sabotage.
- beached_whale 5y agocode is speech, stop listening. This is no different from a person erasing their FB history and saying something someone doesn't like.
- wtallis 5y agoI'm really struggling to see how either of those two sentences fits into this conversation. "Code is speech" seems to be pointing in the direction of a spurious First Amendment argument, "stop listening" seems counterproductive, and the example of someone defacing their own Facebook page is at the very least incomplete without you saying whether or not you think Facebook would be obliged to continue hosting the defaced page.
- esarbe 5y agoHe didn't force anyone to update their dependency, right? So at most you can blame him for enabling self-sabotage.
- not2b 5y agoIn this case, the developer's behavior was malicious: they intentionally caused damage. This is very different than some good faith change that breaks stuff downstream. Sure, the license says "no warranty". But github can decide that they won't tolerate vandals on their platform. It would be within their right to revert the bad change from the git database they hold, go back to the last good change and lock the developer out.
- deadbunny 5y agoWhat damage did they cause?
- wtallis 5y agoDo you really expect anyone to believe that you're asking that in good faith?
- deadbunny 5y agoHey you're the one stating they caused damage. They printed some zaglo strings. Hard to see how that damages anything other than making a few CI jobs fail.
- shukantpal 5y agoIt isn't necessary the package was used in CI jobs only and not production servers.
- deadbunny 5y agoThen that's on them for not pinning dependencies. You know, ops 101. Play silly games, win silly prizes.
- shukantpal 5y agoThanks for stating the obvious. It isn't silly at all to publish malware and vaporize your reputation, right?; maybe it was good after all, people will become careful.
- torstenvl 5y agoThe warranty issue is a red herring. A warranty is an affirmative guarantee of quality: you are (in essential concept of not in precise detail) agreeing to be held to a "strict liability" standard. If I buy real estate and I am granted a warranty deed, and the title to the property comes into question, the seller can be brought to account to make me whole or indemnify me, regardless of who is at fault for the title defect. Without a warranty, you're not held to strict liability, but you can probably be held liable under the default legal regime. If I buy real estate and get a quit-claim deed, there is no promise that the seller has unencumbered rights to the property. However, if I can show the seller intentionally defrauded me, they can still be held civilly and criminally liable for the fraud.
- CRConrad 5y agoOK, so sue him to pay you back every dime you paid for his code.
- viro 5y ago> be hold responsible for downstream breakages he's not, He's being held responsible for intentionally pushing malware
- esarbe 5y agoI don't think he pushed malware, did he? He just broke his own project and published the broken version. That's not pushing malware. I don't get why people don't just pin versions, honestly. I'm not saying he did a good thing. But neither did he push malware nor has he any obligation to publish unbroken packages. If you're using FOSS projects without a service contract, don't whine if something breaks.
- alexwebb2 5y ago"Not pushing malware", _wink wink_. Let's say I set up a lemonade stand in my neighborhood every weekend, where I pour a bunch of cups for people to take, put up a sign that says it's free, and I set out a tip jar. After a few weeks, I get upset that people have been taking the lemonade without leaving tips, so the next time I set up the stand I add a toxin that I know will cause immediate damage to anyone who ingests it. To protect myself, I have of course been posting a sign every weekend that says the lemonade is provided as-is. So – did I do something wrong, or not? Will a court look at this situation and say, "gee, he just poisoned his _own_ lemonade and set it out for public use, it's not like he forced anybody to drink it"? This feels like 100% black-and-white criminal conduct, and I would hope anyone who pulls a malicious stunt like this would be held liable for it.
- esarbe 5y agoThis feels like 100% flawed analogy.