3 ms·

> Wait; I'm not even entitled to software not doing anything blatantly illegal on purpose, or perpetrating a privacy violation without my knowledge and consent?

> Wait; I'm not even entitled to software not doing anything blatantly illegal on purpose, or perpetrating a privacy violation without my knowledge and consent? Exactly! Try to reading through the licenses of the code you pull in, and it'll be evident. Here is a excerpt from the MIT license > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED If the code you randomly pulled down from GitHub puts your computer on fire, you're the only one responsible for that happening. > Also, "open source" has an even greater focus on getting paid than "free software". Does it? Which Open Source license has any focus on getting paid at all? You seem to mix up "development/funding model" with "distribution license", where Open Source is the latter, not the former. > Surely, if people are paid, certain entitlements exist between certain people Depends on the funding model. Open Collective, Patreon and GitHub Sponsors are all donations, where you donate without any expectations of getting anything at all back. > E.g. if you use a phone that runs on a Linux kernel, you may be entitled to kernel security updates, at least for a certain support period. Sure, you probably are, but not from the Linux kernel, but from whoever you bought the phone from/your carrier. This article is about the kind of people write software like the Kernel, not the people who sell your products using FOSS.

jeroenhd 4y ago
> If the code you randomly pulled down from GitHub puts your computer on fire, you're the only one responsible for that happening. That's what's the license says, but your local laws and regulations might disagree, and your license does not overrule the law. Distributing malware is illegal and malware is defined differently in different countries. If you intend to upload sketchy code, make sure you've read up on what constitutes as cybercrime where you live because one of your victims may go to the police. To make a flawed comparison: setting up a stand with cookies that happen to be poisoned next to a sign that reads "cookies free to be eaten at your own risk" don't necessarily let you go free when someone ends up in a hospital. Now, as a counter argument, your average commercial OS is packed full of what would've constituted spyware twenty years ago, so you're probably free to package some types of malware. I don't know if what the colors.js guy did was illegal (at least he reminded people oftthe dangers of npm, which everyone then proceeded to forget) but I think he got away without a lawsuit. I doubt he'd gotten away would he have lived where I live, though.
- bee_rider 4y ago
  I wonder if anyone has actually been charged based on malicious open source contributions. Off the cuff, it seems unlikely -- the person whose computer was damaged would have to navigate multiply jurisdictions and explain something technical to a court, likely as an individual.
  - kazinator 4y ago
    The precursors to such a situation don't have to be exceptionaly unusual. It could be someone working in a language that is not normally compiled ahead of time and shipped in binary form (e.g. malicious Javascript). Even if not accompanied by a license, the code just has to use pieces of some open source work so that it is a derived work. That malware author is then effectively a contributing author, whether aware of it or not. > the person whose computer was damaged would have to navigate multiply jurisdictions and explain something technical to a court, likely as an individual. Easily done if the person is actually a mega corporation.
    - kazinator 4y ago
      Though [re-reading parent] if we are specifically concerned with contributions that were accepted by a non-malicious upstream under good faith and then turned out to be malicious, then that is something else.
kazinator 4y ago
1. Not all the content of a warranty disclaimer holds in all legal jurisdictions. Giving people free stuff doesn't absolve you of liability for harm. Not everyone who uses some open source thing is aware of it; it may have been installed by someone else. 2. By open source having "more of a focus on getting paid", what I mean is that the term taken over and capitalized as Open Source by some people in the 1990' who wanted to distance themselves from the GNU project's rhetoric about freedom in order to emphasize the commercial viability of free software development. They formed something called the Open Source Definition. It's fair to call having more of a "focus on getting paid" than free software in the GNU sense. 3. Not all money for work on open source is donation. People working on it sometimes get regular salaries. Customers sometimes pay for it in the form of commercial products. 4. Chances are high that whoever you buy your phone from does kernel development. Just about the only way they could avoid it would be to license the SoC/board from someone else who does (and then they are almost certainly entitled to support).

jeroenhd 4y ago

> If the code you randomly pulled down from GitHub puts your computer on fire, you're the only one responsible for that happening. That's what's the license says, but your local laws and regulations might disagree, and your license does not overrule the law. Distributing malware is illegal and malware is defined differently in different countries. If you intend to upload sketchy code, make sure you've read up on what constitutes as cybercrime where you live because one of your victims may go to the police. To make a flawed comparison: setting up a stand with cookies that happen to be poisoned next to a sign that reads "cookies free to be eaten at your own risk" don't necessarily let you go free when someone ends up in a hospital. Now, as a counter argument, your average commercial OS is packed full of what would've constituted spyware twenty years ago, so you're probably free to package some types of malware. I don't know if what the colors.js guy did was illegal (at least he reminded people oftthe dangers of npm, which everyone then proceeded to forget) but I think he got away without a lawsuit. I doubt he'd gotten away would he have lived where I live, though.

bee_rider 4y ago
I wonder if anyone has actually been charged based on malicious open source contributions. Off the cuff, it seems unlikely -- the person whose computer was damaged would have to navigate multiply jurisdictions and explain something technical to a court, likely as an individual.
- kazinator 4y ago
  The precursors to such a situation don't have to be exceptionaly unusual. It could be someone working in a language that is not normally compiled ahead of time and shipped in binary form (e.g. malicious Javascript). Even if not accompanied by a license, the code just has to use pieces of some open source work so that it is a derived work. That malware author is then effectively a contributing author, whether aware of it or not. > the person whose computer was damaged would have to navigate multiply jurisdictions and explain something technical to a court, likely as an individual. Easily done if the person is actually a mega corporation.
  - kazinator 4y ago
    Though [re-reading parent] if we are specifically concerned with contributions that were accepted by a non-malicious upstream under good faith and then turned out to be malicious, then that is something else.

kazinator 4y ago

1. Not all the content of a warranty disclaimer holds in all legal jurisdictions. Giving people free stuff doesn't absolve you of liability for harm. Not everyone who uses some open source thing is aware of it; it may have been installed by someone else. 2. By open source having "more of a focus on getting paid", what I mean is that the term taken over and capitalized as Open Source by some people in the 1990' who wanted to distance themselves from the GNU project's rhetoric about freedom in order to emphasize the commercial viability of free software development. They formed something called the Open Source Definition. It's fair to call having more of a "focus on getting paid" than free software in the GNU sense. 3. Not all money for work on open source is donation. People working on it sometimes get regular salaries. Customers sometimes pay for it in the form of commercial products. 4. Chances are high that whoever you buy your phone from does kernel development. Just about the only way they could avoid it would be to license the SoC/board from someone else who does (and then they are almost certainly entitled to support).