1

There haven't been any significant incidents on FOSS software developers turning evil and pumping their software with malicious code. But each person is different, with different intentions. While I can't imagine myself doing anything horrible, some people build up reputation, only to crush it by committing a self-beneficial act and dive into the ocean depths, leaving others with sad reality and frustration. I'm convinced that FOSS software published by anonymous developers is trusted, only because it's FOSS and all this culture surrounding it.

Generally speaking, both intentional and unintentional damage is just damage. Now what GPL states, is that the copyright holder is in no way responsible for any damages. Does that literally mean, that if I stored my credentials on a GPL-licensed password manager, Bitwarden and they happened to anyhow intentionally compromise me, I wouldn't be able to sue them and win the court case as I wasn't given any warranties, that it will work as intended? Same thing, if some guy added a zero-day malicious code into his software, that antivirus isn't able to detect yet?

Proprietary software vendors take responsibility for what they made and will be fined for anything malicious.

Improve this question

3 Answers 3

Reset to default
5

At least in the UK, a license cannot override the law. If you do something actively malicious, you expose yourself to potential penalties, both civil and criminal.

The point of the "no warranty" clauses in open source licenses is to ensure that the bar for (successful) legal action is set much higher - in order to win the case, you would have to show that I had actively attempted to damage you/you business, rather than it just being due to incompetence on my part.

Improve this answer
3

In the United States, the disclaimer only disclaims warranties which are a specific kind of protection that applies to products sold to consumers. Vendors can offer whatever warranties they like to attract customers, e.g., "if your product breaks in the next three years due to faulty production quality, we will replace it." But U.S. law also automatically grants certain implicit warranties unless they are waived by the vendor.

Warranties, as a legal instrument, protect consumers from faulty products and deceptive sales tactics. If the software has deliberate defects or malicious "features" (e.g., malware) then we need not rely on warranties to pursue legal action: in such a case, the author has surely violated a number of civil and criminal laws.

Improve this answer
1

As the question is still 'hot', I just wanted to point you to this current case, where a npm library has been made unusable by the official maintainer of the library, and it causes many hiccups (while it does not seem to be actual malware (in the traditional meaning of the word)). https://github.com/aws/aws-cdk/issues/18323

It appears to be a protest against use of OSS by big companies http://web.archive.org/web/20210704022108/https://github.com/Marak/faker.js/issues/1046 without properly getting paid (even though the developer offered the code under the MIT license).

As a result, GitHub has blocked this developer. It will be interesting to see if there is any legal action as a follow up.

Improve this answer
1
  • It seems as if this case might not be the perfect example, as the developer was driven by personal problems (as reported by media).
    – Martin_in_AUT
    Jan 11, 2022 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.