4 ms·
> Should open source software developers that knowingly distribute malicious open source software also be exempt from liability? This isn’t an academic question
by transpute 3y ago
> Should open source software developers that knowingly distribute malicious open source software also be exempt from liability? This isn’t an academic question. The recent XZ backdoor..
What's an example of legal liability for state-sponsored cyberattacks? What's the burden of proof for attribution?
> the claim that placing liability on software companies as “final assemblers” will lead to broad investments across the current open source ecosystem
What happens when the customer is the "final assembler" of open-source components into signed binaries, e.g. hyperscalers?
- giantg2 3y agoIt's pretty clear that the liability shield doesn't cover malicious acts. The malicious act is committed by the person introducing the backdoor. There shouldn't be any liability on the company since they had no knowledge. If a user wants to be sure of the security, they can inspect the code for flaws (or rely on reviews of others who had inspections).