5 ms·

It can't be illegal if the software is provided as-is without any warranty as most OSS licenses do.

rsstack 5y ago
I'll leave it as an exercise for the reader to understand the difference between "I am not liable if I have a bug that ruins your production environment" and "I am not liable if I maliciously introduce a fatal bug knowingly into your production environment".
- fulafel 5y ago
  Most of those (malice, who introduced it to your environment, fatal bug) seem contestable, even if we grant for the purpose of argument that the as-is disclaimer does not cover all cases.
  - rsstack 5y ago
    Did you see the commit before it was deleted? I'd love to see a lawyer claiming anything else.
    - fulafel 5y ago
      Which of the 3 claims are you referring to? The commit is here as far as i know, not deleted: https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6 https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d1...
      - WJW 5y ago
        Any reasonable expert in the field will testify that it is not possible to write an infinite loop like that unintentionally.
        fulafel 5y ago
        The commit had a comment to the effect of being test / toy code not meant to be put into a release. I don't think a claim of randomly producing the snippet would be put forward in the hypothetical court case. Then there's the question of malice vs some other motive of expression in looping and printing some ASCII / zalgo art in your own terminal art lib.
        salawat 5y ago
        Any reasonable expert in the field will tell you you don't plug an auto-updating dependency into production. Marak wrote code. You, (the consumer), pulled, and deployed it without due diligence. That is entirely on you. Not one person is obligated to keep your crap working except you. This has really outed all the people who really should know better.
- phkahler 5y ago
  But he didn't introduce it into any particular production environment. For fucks sake, people need to pin dependencies to a known good version at the very least.
  - cecilpl2 5y ago
    Of course he did. Intent matters, and this was a reasonably foreseen consequence of the way the system is set up. He knew how npm works and he knew the implication of adding that code is that hundreds of libraries and production systems would automatically upgrade and install it. In fact, the whole point of what he did was to introduce the code into production environments.
    - jessaustin 5y ago
      Raise your hand if you pull directly from the internet into production without testing! <no hands raised> How can we claim he did anything to production if no one will admit they're dumb enough to push this latest version without testing it?
Supermancho 5y ago
It could be illegal (regardless of warranty or license), but it happens to not be in most of the US.
marwis 5y ago
If you put a bomb in a box and attach a button with a note that the button is provided as-is and author disclaims any liability, then leave it in public place and someone presses it, do you think you will not be found liable?
- LegitShady 5y ago
  if you build a car oitside in public view and someome copies it and crashes are you liable? tbis ismt a bomb in a box its his project car you copied without any warranty or.gurantee of stability.
MattPalmer1086 5y ago
No, he has no civil liability to the extent permitted by law, as the license states. He basically can't be sued. That's different to criminal liability.

I'll leave it as an exercise for the reader to understand the difference between "I am not liable if I have a bug that ruins your production environment" and "I am not liable if I maliciously introduce a fatal bug knowingly into your production environment".

fulafel 5y ago
Most of those (malice, who introduced it to your environment, fatal bug) seem contestable, even if we grant for the purpose of argument that the as-is disclaimer does not cover all cases.
- rsstack 5y ago
  Did you see the commit before it was deleted? I'd love to see a lawyer claiming anything else.
  - fulafel 5y ago
    Which of the 3 claims are you referring to? The commit is here as far as i know, not deleted: https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6 https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d1...
    - WJW 5y ago
      Any reasonable expert in the field will testify that it is not possible to write an infinite loop like that unintentionally.
      - fulafel 5y ago
        The commit had a comment to the effect of being test / toy code not meant to be put into a release. I don't think a claim of randomly producing the snippet would be put forward in the hypothetical court case. Then there's the question of malice vs some other motive of expression in looping and printing some ASCII / zalgo art in your own terminal art lib.
      - salawat 5y ago
        Any reasonable expert in the field will tell you you don't plug an auto-updating dependency into production. Marak wrote code. You, (the consumer), pulled, and deployed it without due diligence. That is entirely on you. Not one person is obligated to keep your crap working except you. This has really outed all the people who really should know better.
phkahler 5y ago
But he didn't introduce it into any particular production environment. For fucks sake, people need to pin dependencies to a known good version at the very least.
- cecilpl2 5y ago
  Of course he did. Intent matters, and this was a reasonably foreseen consequence of the way the system is set up. He knew how npm works and he knew the implication of adding that code is that hundreds of libraries and production systems would automatically upgrade and install it. In fact, the whole point of what he did was to introduce the code into production environments.
  - jessaustin 5y ago
    Raise your hand if you pull directly from the internet into production without testing! <no hands raised> How can we claim he did anything to production if no one will admit they're dumb enough to push this latest version without testing it?

Supermancho 5y ago

It could be illegal (regardless of warranty or license), but it happens to not be in most of the US.

marwis 5y ago

If you put a bomb in a box and attach a button with a note that the button is provided as-is and author disclaims any liability, then leave it in public place and someone presses it, do you think you will not be found liable?

LegitShady 5y ago
if you build a car oitside in public view and someome copies it and crashes are you liable? tbis ismt a bomb in a box its his project car you copied without any warranty or.gurantee of stability.

MattPalmer1086 5y ago

No, he has no civil liability to the extent permitted by law, as the license states. He basically can't be sued. That's different to criminal liability.