> for malicious action which harms another Here's are things a lawyer might be able to answer. What specifically is my action that I am legally responsible fo

> for malicious action which harms another Here's are things a lawyer might be able to answer. What specifically is my action that I am legally responsible for? I did not install my software on your machine - you did that. And I explicitly warned you not to trust it. Yet some reason you decided not only to trust that code base, but to keep trusting me in the future enough to auto-update, likely without even telling me. What makes it malicious? I can sell you a tool to re-format your hard disk. That is not malicious, because I described it that way. So how well do I need to document some "malicious" feature before it's no longer legally malicious? And, if I sell my company to another company, who then carries out these actions, is it my responsibility? Are these criminal liabilities, or civil? What is the relevant law? What is the maximum penalty? > Yup. The mechanism for sorting out claims of truth and liability is court Sure. But clearly invalid cases can get summary judgement for far less than taking the whole thing to trial, and I've been judging my risk based on the former overriding any of my users' claims of malicious intent. This doesn't seem like a topic that can go any further without an appropriate lawyer involved.