8 ms·

> So, I have opinions about criticism of crates.io for supply-chain attacks. I also strongly disagree with most of the criticisms of crates.io, but… We are ow

• trollbridge 6mo ago
  Owed by whom, though? That seemed to the point of the article - "owed" implies some kind of debt or obligation. Free software developers don't have any obligations to anyone else.
  • MeetingsBrowser 6mo ago
    Once you advertise and ask people use your software in production, you have an obligation to make sure it is somewhat safe. If you actively advertise and give away free food, there is a baseline assumption that you are at least cooking the food in sanitary conditions. If people get sick after eating the food you gave them, you can’t just shrug and say it was free.
    • 6keZbCECT2uB 6mo ago
      Your reasonable options are: 1. I stop sharing the software I write 2. You take responsibility for the software you use Any software you use with this clause, "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." Already attests that the authors do not offer guarantees that the software will have the features you need, supply chain security or otherwise.
      • skeeter2020 6mo ago
        that clause - even in all caps - doesn't absolve them like you think it does. A quick example: if credentials were comprimised and malware pushed and it was determined to be due to reasonably preventible negligence an author could be held responsible.
        • cuu508 6mo ago
          Does this really happen? Can you provide concrete examples?
        • well_ackshually 6mo ago
          No. Because the only reason you then get hit by this new version with malware is either that you're not pinning your versions (and that's irresponsible), or you're blindly bumping (and that's irresponsible.) The software is provided as is.
        • ahtihn 6mo ago
          Are companies that are compromised by supply chain attacks held responsible for their negligent behavior? Blindly pulling updates from providers that offer you no contractual guarantees has to be gross negligence right?
        • trollbridge 6mo ago
          No, they wouldn't be "held responsible". There is a great deal of insecure code out there and I have yet to see some open-source author found liable for that.
      • general1465 6mo ago
        If I will poison you (for free of course) am I absolved of guilt because I did not want a payment for that?
        • skydhash 6mo ago
          Poisoning is intent. If I leaves a cup of some liquid with a clear warning that it has not be tested for being drinkable, I don’t think that I’m liable for you being poisoned when you go and drink it. Especially if I do not sell drinks. Of course, there are regulations about safety, but they are mostly about when you’re at risk of being harmed while I use my tools for myself. They’re not about you ignoring warnings labels and getting harmed. IANAL.
    • deleted 6mo ago
      [deleted]
    • deleted 6mo ago
      [deleted]
    • deleted 6mo ago
      [deleted]
    • x0x0 6mo ago
      Sorry, but that's really absurd entitlement and also contravenes the license. Open source is fundamentally a gift culture from the authors: here's a thing. You can use it for free; it may or may not meet your needs; but I do not owe you anything either way.
      • MeetingsBrowser 6mo ago
        Gifts come with some implied responsibility from the giver and a niche hobby project is different from a package manager. Take it to the extreme. What if I write a library, put an OSS license on it, advertise it, and then bundle malware in the release. Am I fault for including malicious code, or are the users who downloaded it entitled for expecting the code, that I asked them to use, will not harm them. I would argue the burden is mostly on the user for smaller niche projects, but mostly on the developer for large, heavily advertised, critical infrastructure projects. It is not entitlement to expect operating systems, package managers, browsers, etc to be following good practices.
        • x0x0 6mo ago
          > It is not entitlement to expect operating systems, package managers, browsers, etc to be following good practices. It is the definition of entitlement, because what you are claiming is "good practices" is actually "ongoing labor and active management." And, again, contravenes the license you agreed to. If you don't like that, you should execute a contract that does offer the support you want.
  • skeeter2020 6mo ago
    >> Free software developers don't have any obligations to anyone else. This is doing a lot of heavy lifting, and not really valid as a categorical statement. It's important to narrow the context because "Free software developers" are ultimately still people or organizations that fall into our established systems. There is no specific purchase contract between the provider and user, so unlike commercial software that supply-side obligation is not explicit. There's typically a license that tries to legal-away any responsibility, and this is not so clear-cut. Free software is not found at the side of the road without any providence. It's usually the product of one or more legal entities, promoted, it's use encouraged and maintenance & delivery can be implied by the actions of the developers. All of these things carry varying degrees of obligation within legal, cultural and social frameworks. We try to reduce this down to "no obligations" or "expectation to support for free in perpetuity" but no binary position is accurate.
    • worthless-trash 6mo ago
      I applaude your dedication to the bit.
  • 4bpp 6mo ago
    The problem here is that there is more than two metaphorical people involved: there is the developer, the would-be user, and the evangelist who harangues the developer with "rewrite it in Rust brah" drive-by comments or blog posts about how nobody sane would use memory-unsafe languages/ecosystems without a vibrant community package management ecosystem in the year of our lord 2026. The last person, I think, most clearly, does "owe" you supply-chain security, in the sense that he bears moral (and ought to be made to bear professional) responsibility for any adverse consequences you may suffer from its lack, though in practice he will probably often protest that he couldn't do anything about it because it's not like he is developer. Whether the developer also owes it is a more interesting question, and I think it greatly depends on what attitude he takes towards the evangelist (does he consider him a nuisance who makes implicit promises the developer is uninterested in delivering, or an ally who raises the dev's profile?). Long ago, I remember seeing a cartoon which involved a tag-team of two people robbing a third, with A pointing a gun at C and saying "give your money to B", while B comments "I'm really just standing here, but I figure it's best if you do as he says". I'm not sure what exact piece of day-to-day politics this was made to comment on (though it was probably some or another flavour of political violence), but it seems somewhat applicable here as well. The lines just become "accept the supply chain, or suffer my public ridicule" and "I'm just providing the software 'as-is', but you probably should do as he says".
  • staticassertion 6mo ago
    I think that they arguably do when they publish to a registry. I think that crosses a bridge from "I'm just writing software" and "I'm publishing software for consumption". Arguably, to be clear, I don't have very strong feelings, but I think there is a distinction between "I've placed code online" and "I've explicitly published it for use".
  • saltcured 6mo ago
    I think people are scratching at a cognitive dissonance around: 1. Consumer protection, product safety, and liability. 2. Truth in advertising, fraud prevention, etc. 3. Freedom of expression, association, publication, etc. There is legal precedence in concepts like "attractive nuisance" to put the liability on a producer or owner not to allow the naive public to encounter their dangerous constructions. But we generally allow for media to illustrate such things, i.e. you can depict dangerously unprotected swimming pools, booby-traps, or poisoned food distribution in a book, image, or movie. You get in trouble when you put any of this in the real world though. This is particularly confusing with software because of its duality as being something like speech or media that we can publish and also something like tools or products that can be manufactured, distributed, and consumed with observable results in the real world. Who is liable when the unsafe software is distributed and converted from speech into machine action by naive end users?
• Jerrrrrrrry 6mo ago
  [dead]
• deleted 6mo ago
  [deleted]
• zdw 6mo ago
  > You cannot offer a taxi service in a car that is not fit for the road, and then just shrug when it crashes a people get hurt. The problem is that there's no overt way to tell whether the "car" (code) you're looking at is someone's experimental go-kart made by lashing a motor to a few boards, or a well tested and security analyzed commercial product, without explicitly doing those processes on your own. The problem is all the go-kart hobbyists who make moderately popular go-kart designs end up being asked for all sorts of commercial territory requirements. The people on the consuming end think "reliability is their job!" and try to force all their requirements and obligations onto the go-kart makers, which usually doesn't end well.
  • unethical_ban 6mo ago
    One could have different tiers of repository for different levels of trust. In arch Linux, I trust the base repositories more than AUR.
  • hnlmorg 6mo ago
    Important security packages should be audited by 3rd party researchers and their results shared. For example https://github.com/RustCrypto/RSA?tab=readme-ov-file https://github.com/RustCrypto/RSA?tab=readme-ov-file If you’re using a security package and it isn’t either a shim over an existing API (eg porting a C-library to a non-C language) or it fails to provide evidence of independent audits, then steer clear or it. Most other domains are generally much easier for the developer to audit. However I will say in an age of AI, it will become much easier than it already is to inadvertently pull bad packages.
  • jjav 6mo ago
    > The problem is that there's no overt way to tell whether the "car" (code) you're looking at is someone's experimental go-kart made by lashing a motor to a few boards, or a well tested and security analyzed commercial product, without explicitly doing those processes on your own. Yes you can, companies just don't like the answer. To run with that analogy, if you are setting up that taxi company, will you build your fleet by picking up free gokarts around the neighborhood, or by purchasing cars from a known manufacturer who has gone through crash testing etc? Not particularly different for software. If you need certified quality, you need to pay the providers fairly substantial amounts of money for that.
• marssaxman 6mo ago
  > The moment a group says “use our stuff for critical projects” they take on some baseline level of responsibility for making things secure Every popular open-source license explicitly states that exactly the opposite is true: Apache license: "Licensor provides the Work (and each Contributor provides its Contributions) on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND" GPL v2: "THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND" Mozilla license: "Under no circumstances and under no legal theory, whether tort (including negligence), contract, or otherwise, shall any Contributor, or anyone who distributes Covered Software as permitted above, be liable to You for any direct, indirect, special, incidental, or consequential damages of any character" BSD license (both 2 and 3 clause versions): "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES" MIT license: "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" You are and have always been on your own when using open-source software. Nobody owes you anything.
  • hnlmorg 6mo ago
    That’s a slightly different thing in my opinion but I’m glad that you’ve raised it. Developers have an ethical responsibility but that doesn’t mean they should be legally accountable for genuine mistakes.
    • ForHackernews 6mo ago
      No one has an ethical responsibility to provide free security auditing to trillion dollar companies.
      • hnlmorg 6mo ago
        That’s a strawman argument because we aren’t talking about security auditing for trillion dollar companies. We are talking about developers having ethical ownership for communicating their project responsibly. That means being honest about when a pet project is just a pet project rather than talking about every POC as if it’s production ready. And it’s disingenuous to spin this as “only trillion dollar companies use open source” because we all know that isn’t even remotely true.
• mightyham 6mo ago
  You really can't compare crates to a taxi service and I think the article lays out the reasoning nicely. The people running crates are a small team of mostly volunteers offering a free service. If someone offered a free taxi service as a small organization of volunteers then they could easily be forgiven for not having the same standards that a regulated for-profit business would.
• pabs3 6mo ago
  > We are owed supply chain security. Careful, requiring that might get you completely unmaintained software instead.