4 ms·

Owed by whom, though? That seemed to the point of the article - "owed" implies some kind of debt or obligation. Free software developers don't have any obligati

Owed by whom, though? That seemed to the point of the article - "owed" implies some kind of debt or obligation. Free software developers don't have any obligations to anyone else.

MeetingsBrowser 7mo ago
Once you advertise and ask people use your software in production, you have an obligation to make sure it is somewhat safe. If you actively advertise and give away free food, there is a baseline assumption that you are at least cooking the food in sanitary conditions. If people get sick after eating the food you gave them, you can’t just shrug and say it was free.
- 6keZbCECT2uB 7mo ago
  Your reasonable options are: 1. I stop sharing the software I write 2. You take responsibility for the software you use Any software you use with this clause, "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." Already attests that the authors do not offer guarantees that the software will have the features you need, supply chain security or otherwise.
  - skeeter2020 7mo ago
    that clause - even in all caps - doesn't absolve them like you think it does. A quick example: if credentials were comprimised and malware pushed and it was determined to be due to reasonably preventible negligence an author could be held responsible.
    - cuu508 7mo ago
      Does this really happen? Can you provide concrete examples?
    - well_ackshually 7mo ago
      No. Because the only reason you then get hit by this new version with malware is either that you're not pinning your versions (and that's irresponsible), or you're blindly bumping (and that's irresponsible.) The software is provided as is.
    - ahtihn 7mo ago
      Are companies that are compromised by supply chain attacks held responsible for their negligent behavior? Blindly pulling updates from providers that offer you no contractual guarantees has to be gross negligence right?
    - trollbridge 7mo ago
      No, they wouldn't be "held responsible". There is a great deal of insecure code out there and I have yet to see some open-source author found liable for that.
  - general1465 7mo ago
    If I will poison you (for free of course) am I absolved of guilt because I did not want a payment for that?
    - skydhash 7mo ago
      Poisoning is intent. If I leaves a cup of some liquid with a clear warning that it has not be tested for being drinkable, I don’t think that I’m liable for you being poisoned when you go and drink it. Especially if I do not sell drinks. Of course, there are regulations about safety, but they are mostly about when you’re at risk of being harmed while I use my tools for myself. They’re not about you ignoring warnings labels and getting harmed. IANAL.
      - general1465 7mo ago
        You can get poisoned unintentionally, as it happens in supply chain attacks.
        doubled112 7mo ago
        A supply chain attack would be intentional, just not intentional by the creator. If I mix some ecoli into your drink mix, I did this on purpose. You just don’t know it until it is too late. Are you liable for allowing this to happen?
        general1465 7mo ago
        You screw up by poisoning me. However if I will sell that drink to somebody else then I will be on the hook for poisoning them.
        skydhash 7mo ago
        No one is selling anything. A lot of OSS projects don't even distribute binaries, only code tarballs. If the risks are substantial enough for you to worry about, you take the source code and review them. Then you run it if it's satisfactory. Let's take npm. The postinstall scripts and auto fetching of dependencies have always been seen as problematic. So plenty of warnings beforehand, but people chose convenience over security. Debian's package management has the same feature (postinstall scripts and dependencies management). But the risks are lower, mostly because your main targets would be a core group of committers, which I'd like to believe is more conscious about security risks. And there's a lot of reviews before binaries are built and made available in a stable version. And I'd also like believe popular packages like nginx, curl, coreutils, postgresql,... have a lot more eyeballs on them.
- deleted 7mo ago
  [deleted]
- deleted 7mo ago
  [deleted]
- deleted 7mo ago
  [deleted]
- x0x0 7mo ago
  Sorry, but that's really absurd entitlement and also contravenes the license. Open source is fundamentally a gift culture from the authors: here's a thing. You can use it for free; it may or may not meet your needs; but I do not owe you anything either way.
  - MeetingsBrowser 7mo ago
    Gifts come with some implied responsibility from the giver and a niche hobby project is different from a package manager. Take it to the extreme. What if I write a library, put an OSS license on it, advertise it, and then bundle malware in the release. Am I fault for including malicious code, or are the users who downloaded it entitled for expecting the code, that I asked them to use, will not harm them. I would argue the burden is mostly on the user for smaller niche projects, but mostly on the developer for large, heavily advertised, critical infrastructure projects. It is not entitlement to expect operating systems, package managers, browsers, etc to be following good practices.
    - x0x0 7mo ago
      > It is not entitlement to expect operating systems, package managers, browsers, etc to be following good practices. It is the definition of entitlement, because what you are claiming is "good practices" is actually "ongoing labor and active management." And, again, contravenes the license you agreed to. If you don't like that, you should execute a contract that does offer the support you want.
skeeter2020 7mo ago
>> Free software developers don't have any obligations to anyone else. This is doing a lot of heavy lifting, and not really valid as a categorical statement. It's important to narrow the context because "Free software developers" are ultimately still people or organizations that fall into our established systems. There is no specific purchase contract between the provider and user, so unlike commercial software that supply-side obligation is not explicit. There's typically a license that tries to legal-away any responsibility, and this is not so clear-cut. Free software is not found at the side of the road without any providence. It's usually the product of one or more legal entities, promoted, it's use encouraged and maintenance & delivery can be implied by the actions of the developers. All of these things carry varying degrees of obligation within legal, cultural and social frameworks. We try to reduce this down to "no obligations" or "expectation to support for free in perpetuity" but no binary position is accurate.
- worthless-trash 7mo ago
  I applaude your dedication to the bit.
4bpp 7mo ago
The problem here is that there is more than two metaphorical people involved: there is the developer, the would-be user, and the evangelist who harangues the developer with "rewrite it in Rust brah" drive-by comments or blog posts about how nobody sane would use memory-unsafe languages/ecosystems without a vibrant community package management ecosystem in the year of our lord 2026. The last person, I think, most clearly, does "owe" you supply-chain security, in the sense that he bears moral (and ought to be made to bear professional) responsibility for any adverse consequences you may suffer from its lack, though in practice he will probably often protest that he couldn't do anything about it because it's not like he is developer. Whether the developer also owes it is a more interesting question, and I think it greatly depends on what attitude he takes towards the evangelist (does he consider him a nuisance who makes implicit promises the developer is uninterested in delivering, or an ally who raises the dev's profile?). Long ago, I remember seeing a cartoon which involved a tag-team of two people robbing a third, with A pointing a gun at C and saying "give your money to B", while B comments "I'm really just standing here, but I figure it's best if you do as he says". I'm not sure what exact piece of day-to-day politics this was made to comment on (though it was probably some or another flavour of political violence), but it seems somewhat applicable here as well. The lines just become "accept the supply chain, or suffer my public ridicule" and "I'm just providing the software 'as-is', but you probably should do as he says".
staticassertion 7mo ago
I think that they arguably do when they publish to a registry. I think that crosses a bridge from "I'm just writing software" and "I'm publishing software for consumption". Arguably, to be clear, I don't have very strong feelings, but I think there is a distinction between "I've placed code online" and "I've explicitly published it for use".
saltcured 7mo ago
I think people are scratching at a cognitive dissonance around: 1. Consumer protection, product safety, and liability. 2. Truth in advertising, fraud prevention, etc. 3. Freedom of expression, association, publication, etc. There is legal precedence in concepts like "attractive nuisance" to put the liability on a producer or owner not to allow the naive public to encounter their dangerous constructions. But we generally allow for media to illustrate such things, i.e. you can depict dangerously unprotected swimming pools, booby-traps, or poisoned food distribution in a book, image, or movie. You get in trouble when you put any of this in the real world though. This is particularly confusing with software because of its duality as being something like speech or media that we can publish and also something like tools or products that can be manufactured, distributed, and consumed with observable results in the real world. Who is liable when the unsafe software is distributed and converted from speech into machine action by naive end users?

Owed by whom, though? That seemed to the point of the article - "owed" implies some kind of debt or obligation. Free software developers don't have any obligations to anyone else.

MeetingsBrowser 7mo ago

Once you advertise and ask people use your software in production, you have an obligation to make sure it is somewhat safe. If you actively advertise and give away free food, there is a baseline assumption that you are at least cooking the food in sanitary conditions. If people get sick after eating the food you gave them, you can’t just shrug and say it was free.

6keZbCECT2uB 7mo ago
Your reasonable options are: 1. I stop sharing the software I write 2. You take responsibility for the software you use Any software you use with this clause, "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." Already attests that the authors do not offer guarantees that the software will have the features you need, supply chain security or otherwise.
- skeeter2020 7mo ago
  that clause - even in all caps - doesn't absolve them like you think it does. A quick example: if credentials were comprimised and malware pushed and it was determined to be due to reasonably preventible negligence an author could be held responsible.
  - cuu508 7mo ago
    Does this really happen? Can you provide concrete examples?
  - well_ackshually 7mo ago
    No. Because the only reason you then get hit by this new version with malware is either that you're not pinning your versions (and that's irresponsible), or you're blindly bumping (and that's irresponsible.) The software is provided as is.
  - ahtihn 7mo ago
    Are companies that are compromised by supply chain attacks held responsible for their negligent behavior? Blindly pulling updates from providers that offer you no contractual guarantees has to be gross negligence right?
  - trollbridge 7mo ago
    No, they wouldn't be "held responsible". There is a great deal of insecure code out there and I have yet to see some open-source author found liable for that.
- general1465 7mo ago
  If I will poison you (for free of course) am I absolved of guilt because I did not want a payment for that?
  - skydhash 7mo ago
    Poisoning is intent. If I leaves a cup of some liquid with a clear warning that it has not be tested for being drinkable, I don’t think that I’m liable for you being poisoned when you go and drink it. Especially if I do not sell drinks. Of course, there are regulations about safety, but they are mostly about when you’re at risk of being harmed while I use my tools for myself. They’re not about you ignoring warnings labels and getting harmed. IANAL.
    - general1465 7mo ago
      You can get poisoned unintentionally, as it happens in supply chain attacks.
      - doubled112 7mo ago
        A supply chain attack would be intentional, just not intentional by the creator. If I mix some ecoli into your drink mix, I did this on purpose. You just don’t know it until it is too late. Are you liable for allowing this to happen?
        general1465 7mo ago
        You screw up by poisoning me. However if I will sell that drink to somebody else then I will be on the hook for poisoning them.
        skydhash 7mo ago
        No one is selling anything. A lot of OSS projects don't even distribute binaries, only code tarballs. If the risks are substantial enough for you to worry about, you take the source code and review them. Then you run it if it's satisfactory. Let's take npm. The postinstall scripts and auto fetching of dependencies have always been seen as problematic. So plenty of warnings beforehand, but people chose convenience over security. Debian's package management has the same feature (postinstall scripts and dependencies management). But the risks are lower, mostly because your main targets would be a core group of committers, which I'd like to believe is more conscious about security risks. And there's a lot of reviews before binaries are built and made available in a stable version. And I'd also like believe popular packages like nginx, curl, coreutils, postgresql,... have a lot more eyeballs on them.
deleted 7mo ago
[deleted]
deleted 7mo ago
[deleted]
deleted 7mo ago
[deleted]
x0x0 7mo ago
Sorry, but that's really absurd entitlement and also contravenes the license. Open source is fundamentally a gift culture from the authors: here's a thing. You can use it for free; it may or may not meet your needs; but I do not owe you anything either way.
- MeetingsBrowser 7mo ago
  Gifts come with some implied responsibility from the giver and a niche hobby project is different from a package manager. Take it to the extreme. What if I write a library, put an OSS license on it, advertise it, and then bundle malware in the release. Am I fault for including malicious code, or are the users who downloaded it entitled for expecting the code, that I asked them to use, will not harm them. I would argue the burden is mostly on the user for smaller niche projects, but mostly on the developer for large, heavily advertised, critical infrastructure projects. It is not entitlement to expect operating systems, package managers, browsers, etc to be following good practices.
  - x0x0 7mo ago
    > It is not entitlement to expect operating systems, package managers, browsers, etc to be following good practices. It is the definition of entitlement, because what you are claiming is "good practices" is actually "ongoing labor and active management." And, again, contravenes the license you agreed to. If you don't like that, you should execute a contract that does offer the support you want.

skeeter2020 7mo ago

>> Free software developers don't have any obligations to anyone else. This is doing a lot of heavy lifting, and not really valid as a categorical statement. It's important to narrow the context because "Free software developers" are ultimately still people or organizations that fall into our established systems. There is no specific purchase contract between the provider and user, so unlike commercial software that supply-side obligation is not explicit. There's typically a license that tries to legal-away any responsibility, and this is not so clear-cut. Free software is not found at the side of the road without any providence. It's usually the product of one or more legal entities, promoted, it's use encouraged and maintenance & delivery can be implied by the actions of the developers. All of these things carry varying degrees of obligation within legal, cultural and social frameworks. We try to reduce this down to "no obligations" or "expectation to support for free in perpetuity" but no binary position is accurate.

worthless-trash 7mo ago
I applaude your dedication to the bit.

4bpp 7mo ago

The problem here is that there is more than two metaphorical people involved: there is the developer, the would-be user, and the evangelist who harangues the developer with "rewrite it in Rust brah" drive-by comments or blog posts about how nobody sane would use memory-unsafe languages/ecosystems without a vibrant community package management ecosystem in the year of our lord 2026. The last person, I think, most clearly, does "owe" you supply-chain security, in the sense that he bears moral (and ought to be made to bear professional) responsibility for any adverse consequences you may suffer from its lack, though in practice he will probably often protest that he couldn't do anything about it because it's not like he is developer. Whether the developer also owes it is a more interesting question, and I think it greatly depends on what attitude he takes towards the evangelist (does he consider him a nuisance who makes implicit promises the developer is uninterested in delivering, or an ally who raises the dev's profile?). Long ago, I remember seeing a cartoon which involved a tag-team of two people robbing a third, with A pointing a gun at C and saying "give your money to B", while B comments "I'm really just standing here, but I figure it's best if you do as he says". I'm not sure what exact piece of day-to-day politics this was made to comment on (though it was probably some or another flavour of political violence), but it seems somewhat applicable here as well. The lines just become "accept the supply chain, or suffer my public ridicule" and "I'm just providing the software 'as-is', but you probably should do as he says".

staticassertion 7mo ago

I think that they arguably do when they publish to a registry. I think that crosses a bridge from "I'm just writing software" and "I'm publishing software for consumption". Arguably, to be clear, I don't have very strong feelings, but I think there is a distinction between "I've placed code online" and "I've explicitly published it for use".

saltcured 7mo ago

I think people are scratching at a cognitive dissonance around: 1. Consumer protection, product safety, and liability. 2. Truth in advertising, fraud prevention, etc. 3. Freedom of expression, association, publication, etc. There is legal precedence in concepts like "attractive nuisance" to put the liability on a producer or owner not to allow the naive public to encounter their dangerous constructions. But we generally allow for media to illustrate such things, i.e. you can depict dangerously unprotected swimming pools, booby-traps, or poisoned food distribution in a book, image, or movie. You get in trouble when you put any of this in the real world though. This is particularly confusing with software because of its duality as being something like speech or media that we can publish and also something like tools or products that can be manufactured, distributed, and consumed with observable results in the real world. Who is liable when the unsafe software is distributed and converted from speech into machine action by naive end users?