4 ms·

The author of an open source project usually makes NO guarantees and assumes no liability. They've tossed a blueprint into the world. When you decided to use i

The author of an open source project usually makes NO guarantees and assumes no liability. They've tossed a blueprint into the world. When you decided to use it, you took on all of its technical debt and design decisions as your own. You can't fault the author if you use it in an environment they didn't have, or didn't intend it to be used in, or in a manner that wasn't intended. They left an artifact, they did NOT make an agreement to support it. If someone makes a mistake in a book, there's no obligation for the author to correct it. If someone misunderstands the ideas and goes on to do some horrible deeds using it as justification, it's not the author's fault. Open source software is, for the most part, an unsupported gift economy. It isn't commercial, and it certainly isn't a chain... there's no delivery to be had... something was tossed over the wall, and it may never happen again. We Tims have been waiting for the next episode of Hello Internet for a while now... it may never come. That is also the nature of open source software.

j-bos 4y ago
We the Tims accept this fact and stand waiting.
danjoredd 4y ago
RIP Hello Internet. Cortex is great, but it just isn't the same. Grey always said he would probably take the Irish Exit on that show, and that's exactly what he ended up doing
hinkley 4y ago
This is a historically narrow view of the situation. We are all living in a post-war era. That war was over whether and how much of the software in the world should be locked up behind proprietary licenses and paywalls. To win the war, Open Source had to produce software that was less awful than the proprietary software it was trying to unseat. It did. Companies went out of business or adapted. Now everyone is trying to pretend that the choice all along was between someone else's software and making your own. That wasn't the choice, and it's revisionist history to claim otherwise. A war was one, territory was occupied, and the 'treaty' at the end of that war was "make stuff that isn't awful", which is being peeled away layer by layer. The above is the opening to my thesis as to why SaaS is now trying to eat Open Source: FOSS is abdicating responsibility for quality, and so the only way to get quality is to harass FOSS authors who think we are ungrateful whiners, or pay for improvements on the backs of paying customers who just want software that works, not to be told to put up or shut up. The only sane way to defend against the re-privatization of FOSS software is to stop treating your users like they need to grow up and realize that you're deflecting. Unless authors accept that you have an ethical responsibility that comes with occupying a corner of the collective consciousness, it's going to be walled gardens everywhere you look. We aren't paying people to 'steal' your code. We're paying people to act like professionals.
- OkayPhysicist 4y ago
  You can also get quality by... doing it yourself. That's the Free Software core idea. Don't like what exists? You're free to change it. In fact, you're encouraged to change it, and publish your changes, so others can use your higher-quality version. It's supposed to be a gift economy, not a plunder economy. You're given something for free, with little to no strings attached. All that is politely expected of you is to A) not be a dick, and B) reciprocate in kind, if the situation arises.
  - blooalien 4y ago
    Or you can get "quality" (or support) by paying the author (or some other developer) to support / improve said software within the legal terms of whatever license that software is released under.
    - hinkley 4y ago
      Which we used to be able to do a lot more. Many of those companies are out of business or merged with a mega corporation.
- q-big 4y ago
  > and the 'treaty' at the end of that war was "make stuff that isn't awful", which is being peeled away layer by layer. There never was a treaty (not even an informal one!). In businesses, the reason why open source software was adopted was typically because it enabled cost savings (e.g. saving/reducing license costs).
- robocat 4y ago
  The metaphor “war” is invalid methinks. Ecological systems or economic competition are far better metaphors, because they are emergent and decentralised, rather than patriotic and authoritarian. “Nature red in tooth and claw”, or monopoly rent and marginal price → 0. Revisionist? The 1T$ Microsoft has not “lost the war”. The biggest FOSS wins have serious corporate sponsorship (OSes, databases, browsers, dev tools, languages, etcetera).
jacques_chester 4y ago
Software repositories have every right to set terms and conditions for their use. Nothing about tossing a blueprint into the world entitles you to have blueprint hosting for free and without requirements. Folks who don't like that there are terms and conditions on hosting software in repositories are free to host it themselves.
- vore 4y ago
  I don't really understand this argument: if GitHub allows hosting things that completely disclaim warranty and people are using things from GitHub, don't you effectively have this "tossing a blueprint into the world" problem? Sure, you aren't entitled to it, but there are plenty of places that offer this kind of service and plenty of consumers who get software from these services.
  - jacques_chester 4y ago
    I was talking about the complaints that Github allows PRs.
- LtWorf 4y ago
  I could easily self host my projects on a rpi and rate limit all the companies that download the same thing over and over every second. Companies can and should set up internal mirrors. The advantage of github is that people have accounts and it's easy for them to send patches or discover projects. But I'm fully capable of using git via email.
- senko 4y ago
  Is there a software repository that requires the developers to assume the liabilities?
- Dylan16807 4y ago
  The hosting costs are almost zero, and plenty of people are willing to do it for free. How is this supposed to change anything?
humanistbot 4y ago
That's nice in principle, but definitely not how it operates in practice.
falcolas 4y ago
Practically speaking, I'm going to assert that there is no team of developers, let alone single developers, who are capable of taking on both the burden of their own software and the software that they import. I simply can not imagine even a whole fortune 500 company supporting their own business logic written on top of Spring, which includes log4j and a whole host of other open source dependencies. And what's the commercial alternative? I'm personally not aware of one. Also, the liability thing is a grey area - it works for the US (mostly, Tornado cash is currently testing these waters) - since there are open issues with developers of "questionable" software traveling to some countries. Heck, even the US has pulled some OSS developers aside at customs because of their work on OSS projects.
- 411111111111111 4y ago
  Wouldn't you have to start with the JVM? Or possibly with the Linux kernel?
  - l33t233372 4y ago
    Not necessarily. If you _purchase_ software that includes the guarantees that you desire. (e.g. of correctness, fitness for purpose, and support), then you don’t have to maintain the entire stack yourself.
    - nradov 4y ago
      Even if you purchase the software from a commercial vendor that doesn't mean that the vendor will indemnify you for damages caused by their failures, or that they have sufficient financial resources to pay for such damages (counterparty risk).
    - conductr 4y ago
      At that point, just buy insurance
  - AceJohnny2 4y ago
    What about the hardware? Who will take on liability for Row Hammer[1] vulnerabilities? What about Meltdown [2] or Spectre? [1] https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer [2] https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability) https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...
throwaway894345 4y ago
> You can't fault the author if you use it in an environment they didn't have, or didn't intend it to be used in, or in a manner that wasn't intended. It goes even farther than that: you can’t fault the author even if you did use it in the intended manner.
deleted 4y ago
[deleted]
numbsafari 4y ago
Funny thing, most commercial software also comes with T&Cs that say the make no guarantees and assume no liability. e.g., Microsoft Windows 10 retail license: > Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. And their liability is limited to... > at its election, either: (i) repair or replace the software at no charge, or (ii) accept return of the software (or at its election the device on which the software was preinstalled) for a refund of the amount paid, if any. So, maybe they'll fix, or maybe they'll refund you your money and you discontinue your use of the software. Maybe they'll issue a fix that you incur the cost of installing and testing. [1] https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/U...
- JohnFen 4y ago
  I can be on board with that. If you don't like the software I provided for free, then I'll refund every dime that you paid me.
skybrian 4y ago
This isn't entirely true because many people don't just write software, they also promote it. For example, they create websites encouraging adoption, much in the same way companies do, with instructions on how to install it easily, implying that you should install it. And maybe they'll give talks and make videos? But it gets worse. Often the people promoting the software aren't the people who wrote it, and they may make claims that the authors never intended. None of these things mean that the authors accept formal liability, but morally speaking, if you're encouraging people to use your software and you're participating in an ecosystem promoting its usage, and it turns out to have bad security flaws, then maybe you shouldn't be so encouraging? Be upfront that it's just something you threw together. Add a few speedbumps. Maybe don't publish it on npm? Disrupt the hype train. Disclaiming all responsibility should imply that you also don't hype it up and set people up for failure.
- enraged_camel 4y ago
  It's kind of amazing that 95% of gripes about open source projects and who is supposed to support them to what extent can be solved by open source authors being upfront about those expectations. If you're releasing something and have no intention of supporting it, simply put "NOT INTENTED FOR USE IN PRODUCTION" at the very top of the readme file. It's that easy, imho.
  - ptboyer 4y ago
    Wouldn't a LICENSE file already do this for the most part? MIT: "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED ..." and so forth.
    - skybrian 4y ago
      This doesn't tell the reader anything because solid open source projects that can be used in production and those that are just experiments will often have the same LICENSE. All open source licenses disclaim liability. So if you really want to discourage usage, you should say something in the README.

j-bos 4y ago

We the Tims accept this fact and stand waiting.

danjoredd 4y ago

RIP Hello Internet. Cortex is great, but it just isn't the same. Grey always said he would probably take the Irish Exit on that show, and that's exactly what he ended up doing

hinkley 4y ago

This is a historically narrow view of the situation. We are all living in a post-war era. That war was over whether and how much of the software in the world should be locked up behind proprietary licenses and paywalls. To win the war, Open Source had to produce software that was less awful than the proprietary software it was trying to unseat. It did. Companies went out of business or adapted. Now everyone is trying to pretend that the choice all along was between someone else's software and making your own. That wasn't the choice, and it's revisionist history to claim otherwise. A war was one, territory was occupied, and the 'treaty' at the end of that war was "make stuff that isn't awful", which is being peeled away layer by layer. The above is the opening to my thesis as to why SaaS is now trying to eat Open Source: FOSS is abdicating responsibility for quality, and so the only way to get quality is to harass FOSS authors who think we are ungrateful whiners, or pay for improvements on the backs of paying customers who just want software that works, not to be told to put up or shut up. The only sane way to defend against the re-privatization of FOSS software is to stop treating your users like they need to grow up and realize that you're deflecting. Unless authors accept that you have an ethical responsibility that comes with occupying a corner of the collective consciousness, it's going to be walled gardens everywhere you look. We aren't paying people to 'steal' your code. We're paying people to act like professionals.

OkayPhysicist 4y ago
You can also get quality by... doing it yourself. That's the Free Software core idea. Don't like what exists? You're free to change it. In fact, you're encouraged to change it, and publish your changes, so others can use your higher-quality version. It's supposed to be a gift economy, not a plunder economy. You're given something for free, with little to no strings attached. All that is politely expected of you is to A) not be a dick, and B) reciprocate in kind, if the situation arises.
- blooalien 4y ago
  Or you can get "quality" (or support) by paying the author (or some other developer) to support / improve said software within the legal terms of whatever license that software is released under.
  - hinkley 4y ago
    Which we used to be able to do a lot more. Many of those companies are out of business or merged with a mega corporation.
q-big 4y ago
> and the 'treaty' at the end of that war was "make stuff that isn't awful", which is being peeled away layer by layer. There never was a treaty (not even an informal one!). In businesses, the reason why open source software was adopted was typically because it enabled cost savings (e.g. saving/reducing license costs).
robocat 4y ago
The metaphor “war” is invalid methinks. Ecological systems or economic competition are far better metaphors, because they are emergent and decentralised, rather than patriotic and authoritarian. “Nature red in tooth and claw”, or monopoly rent and marginal price → 0. Revisionist? The 1T$ Microsoft has not “lost the war”. The biggest FOSS wins have serious corporate sponsorship (OSes, databases, browsers, dev tools, languages, etcetera).

jacques_chester 4y ago

Software repositories have every right to set terms and conditions for their use. Nothing about tossing a blueprint into the world entitles you to have blueprint hosting for free and without requirements. Folks who don't like that there are terms and conditions on hosting software in repositories are free to host it themselves.

vore 4y ago
I don't really understand this argument: if GitHub allows hosting things that completely disclaim warranty and people are using things from GitHub, don't you effectively have this "tossing a blueprint into the world" problem? Sure, you aren't entitled to it, but there are plenty of places that offer this kind of service and plenty of consumers who get software from these services.
- jacques_chester 4y ago
  I was talking about the complaints that Github allows PRs.
LtWorf 4y ago
I could easily self host my projects on a rpi and rate limit all the companies that download the same thing over and over every second. Companies can and should set up internal mirrors. The advantage of github is that people have accounts and it's easy for them to send patches or discover projects. But I'm fully capable of using git via email.
senko 4y ago
Is there a software repository that requires the developers to assume the liabilities?
Dylan16807 4y ago
The hosting costs are almost zero, and plenty of people are willing to do it for free. How is this supposed to change anything?

humanistbot 4y ago

That's nice in principle, but definitely not how it operates in practice.

falcolas 4y ago

Practically speaking, I'm going to assert that there is no team of developers, let alone single developers, who are capable of taking on both the burden of their own software and the software that they import. I simply can not imagine even a whole fortune 500 company supporting their own business logic written on top of Spring, which includes log4j and a whole host of other open source dependencies. And what's the commercial alternative? I'm personally not aware of one. Also, the liability thing is a grey area - it works for the US (mostly, Tornado cash is currently testing these waters) - since there are open issues with developers of "questionable" software traveling to some countries. Heck, even the US has pulled some OSS developers aside at customs because of their work on OSS projects.

411111111111111 4y ago
Wouldn't you have to start with the JVM? Or possibly with the Linux kernel?
- l33t233372 4y ago
  Not necessarily. If you _purchase_ software that includes the guarantees that you desire. (e.g. of correctness, fitness for purpose, and support), then you don’t have to maintain the entire stack yourself.
  - nradov 4y ago
    Even if you purchase the software from a commercial vendor that doesn't mean that the vendor will indemnify you for damages caused by their failures, or that they have sufficient financial resources to pay for such damages (counterparty risk).
  - conductr 4y ago
    At that point, just buy insurance
- AceJohnny2 4y ago
  What about the hardware? Who will take on liability for Row Hammer[1] vulnerabilities? What about Meltdown [2] or Spectre? [1] https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer [2] https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability) https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...

throwaway894345 4y ago

> You can't fault the author if you use it in an environment they didn't have, or didn't intend it to be used in, or in a manner that wasn't intended. It goes even farther than that: you can’t fault the author even if you did use it in the intended manner.

deleted 4y ago

[deleted]

numbsafari 4y ago

Funny thing, most commercial software also comes with T&Cs that say the make no guarantees and assume no liability. e.g., Microsoft Windows 10 retail license: > Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. And their liability is limited to... > at its election, either: (i) repair or replace the software at no charge, or (ii) accept return of the software (or at its election the device on which the software was preinstalled) for a refund of the amount paid, if any. So, maybe they'll fix, or maybe they'll refund you your money and you discontinue your use of the software. Maybe they'll issue a fix that you incur the cost of installing and testing. [1] https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/U...

JohnFen 4y ago
I can be on board with that. If you don't like the software I provided for free, then I'll refund every dime that you paid me.

skybrian 4y ago

This isn't entirely true because many people don't just write software, they also promote it. For example, they create websites encouraging adoption, much in the same way companies do, with instructions on how to install it easily, implying that you should install it. And maybe they'll give talks and make videos? But it gets worse. Often the people promoting the software aren't the people who wrote it, and they may make claims that the authors never intended. None of these things mean that the authors accept formal liability, but morally speaking, if you're encouraging people to use your software and you're participating in an ecosystem promoting its usage, and it turns out to have bad security flaws, then maybe you shouldn't be so encouraging? Be upfront that it's just something you threw together. Add a few speedbumps. Maybe don't publish it on npm? Disrupt the hype train. Disclaiming all responsibility should imply that you also don't hype it up and set people up for failure.

enraged_camel 4y ago
It's kind of amazing that 95% of gripes about open source projects and who is supposed to support them to what extent can be solved by open source authors being upfront about those expectations. If you're releasing something and have no intention of supporting it, simply put "NOT INTENTED FOR USE IN PRODUCTION" at the very top of the readme file. It's that easy, imho.
- ptboyer 4y ago
  Wouldn't a LICENSE file already do this for the most part? MIT: "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED ..." and so forth.
  - skybrian 4y ago
    This doesn't tell the reader anything because solid open source projects that can be used in production and those that are just experiments will often have the same LICENSE. All open source licenses disclaim liability. So if you really want to discourage usage, you should say something in the README.