3 ms·
Lawyers at my job pointed out one particularly nasty aspect of CLAs: the lack of liability controls. All open source licenses have some form of legal liability
by Twirrim 3y ago
Lawyers at my job pointed out one particularly nasty aspect of CLAs: the lack of liability controls.
All open source licenses have some form of legal liability wording in them, e.g. from GPL v2:
> 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
No CLA I've seen so far does anything to maintain that protection from liability. Those responsible for the software could switch the license to one which leaves you, or your employer, legally liable for any damages incurred. That could very, very quickly, bankrupt you and/or them.
- justinludwig 3y agoSure, but in America, anybody can sue anybody for anything. Your lawyers are of course right that having a clause in a software license disclaiming all liability for its use could be helpful in your defense -- but it's not an ironclad guarantee that you will not be sued or even found liable for your contributions in the event that it causes some kind of catastrophe. If this is a major concern for you, you should probably avoid contributing to FOSS altogether. However, if you don't own the software and don't distribute the software and don't have any other kind of relationship with the users of the software, it's likely going to require the plaintiff to demonstrate particularly egregious conduct on your part in order for a court to find that you have some liability for damages arising from the use of the software. But YMMV.
- gavinhoward 3y agoWell, of course. But if I accept a contribution, I'm already accepting responsibility for it, so I will not accept it unless I understand it and test the snot out of it. This is another reason I don't accept contributions from individuals.
- Twirrim 3y agoIt's not about you. It's about the person/company that signs the CLA. They're the ones that end up in potential legal nightmares, unless the CLA specifically promises to continue to indemnity.
- gavinhoward 3y agoI think my CLA should do that. I'll make sure my lawyer adds that to the draft.