I was seeing a lot of news about the colors.js library. I would like to know if the open source license entitles the developer of the colors.js library to make it dysfunctional and create the damage to the community (as we all have seen).
Open source licenses apply to other people. They do not apply to the author and copyright owner of the project. The author/owner can always do whatever they want. Software licenses can't prohibit the authors from making large changes to software, nor can they determine whether a change is 'good' or not.
The simple answer is "yes", if nothing else because there is no judge of what is "dysfunctional" and what is "removing legacy features".
However, I'd argue you're thinking about this the wrong way: the damage was caused by people downloading and using code without verifying that it was fit for purpose.
There are really two separate issues here:
- Is the developer allowed to sabotage their own code? - Yes, because it's their own code. The license has nothing to do with this, because the license does not bind the copyright holder in the first place (and typical open source licenses don't have a "don't release broken code" clause anyway).
- Can the developer be held liable for sabotaging their own code? - Maybe, depending on jurisdiction.
In the US, and some other common law jurisdictions, the warranty disclaimer at the end of a typical open source license completely eliminates liability for damages arising from broken code. This is the case even if the developer "has been advised of the possibility" of such damages - which to my non-lawyer mind rather strongly implies that arguments of the form "[developer] knew that their changes were going to break things, and made those changes anyway" are invalid.
However, in many other jurisdictions, the implied warranty cannot be disclaimed, and the developer can in theory be held liable for damages arising from their intentionally defective software. The practicality of doing this is going to vary quite a lot, however, because the plaintiff needs to show that the code caused some actual monetary harm. On the other hand, depending on jurisdiction and relevant law, the defendant may or may not be allowed to argue that the plaintiff was negligent in using the defendant's software without independently auditing it, which may reduce or eliminate the defendant's liability. There is also the more practical issue that the defendant may be judgment proof.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
the disclaimer is amost exactly the same in the GPL License:
THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
It could very well depend on which kind of "corruption".
I can write a library, and then "corrupt" it in a way that makes it obviously unusable. If you downloaded my corrupted library instead of the previous version, and tried to use it, you would notice immediately that it is broken. You are in the same state as if you never had downloaded my library in the first place. That kind of change is quite low risk for the developer.
I can write a library, and then "corrupt" it in a way that makes it less obviously unusable. For example, any function that could produce an error in the wrong circumstances will produce an error. You can build your own product with my library, but as soon as you start testing, you will notice that it fails. That is still low risk for the developer.
I can write a library, and then "corrupt" it in a way that makes it slightly buggy. For example, any function that could produce an error in the wrong circumstances will produce an error on every thousandth call. You can build your own product with my library. It will go through your testing (quite likely). But customers will start complaining to you because sometimes your application doesn't work. If that is done intentionally, I might be in legal trouble. I don't know that any disclaimer would necessarily protect me against intentionally causing damage.
I can write a library, and then "corrupt" it in a way that serves criminal purposes. For example, you use my library in a banking application, but the new version sends any credit card number that the user enters to my email address. That is most likely totally illegal, but not because of any license terms, but because it's just illegal to do independent of open / closed source.
A license is something that a content creator, who creates a work, can use, to specify how other people are allowed to use that work.
So it usually has nothing to do with whether that work is good or bad, works or doesn't for some specific purpose, or anything else about its actual or intended purpose.
It is purely about what others are allowed to do, or not do, with it.
So it isn't that the license makes the creator entitled to do anything. Its more that the license literally is not about what the creator can do, in the first place.
Most of the answers describe the legal angle well: most (but not all) open source licenses have an explicit no warranty cause.
From the development perspective:
If a given library is critical to you, you should vet a new version before accepting it.
Once you vetted the version and realized that it's deliberately broken for your use-case, there is nothing stopping you from fixing the issues or reverting to an earlier release.
You might even develop and distribute your own version. This last part is an important one. While the original developer can remove an old feature, you can decide to maintain it and possibly develop your fork in a different direction.
To untangle the legal consequences, it is important to understand and each new version of a Open Source library is a release that is legally independent of any previous or future versions of itself. (Unless its licence says otherwise. I have never seen such a licence)
First an author releases some versions of some software and it is good. These releases remain. When using github, they will be available as long as the repository is not deleted. And even if it is deleted from github, you can get a copy from anybody who has one.
Now, the author has released a new version. This version is deliberately broken.
Some people, who trusted that author, will let their automatic package system update the library and now their whole system is broken. Very funny. Hah hah.
To fix all this, all it takes is for everybody to go back to the previous version. The licence of that version is not changed. The functionality is not changed. In the grand scheme of things, this was a minor annoyance.
And now we know not to trust that author.
Do Open Source Licenses allow authors to corrupt their own code?
That's pretty much asking if F/OSS licenses allow an author to create some code, distribute it, then later decide to stop distributing it, possibly replacing it with some new code.
If that's allowed should be obvious, but it has nothing to do with licenses. More with the fact that in most parts of the world, anyone is allowed to do programming, and to distribute their own creations, or not to. Programming isn't an occupation that requires a particular training or certifications that would carry some requirements on what you can do (like doctoring or lawyering might be).
Licenses only have to do with what rights the author gives others. What you can do with a work created by someone else is limited by copyright statutes, and they basically say that you can't (re)distribute a work without permission. The open source and copyleft licenses give that permission.
In a case like colors.js, there's the additional question of Github killing the author's account and restoring the old version of the code. That's also more about Github usage terms than the license. The old version was distributed under a free license, so Github (or anyone else) has permission to distribute it under those terms, even if the original author doesn't like to distribute it any longer. (If they can just kill someone's account because they don't like what they did is a different matter.)
Of course, one could also try to pin a liability for any resulting damages on the library author, but that might a bit hard to do. After all, no user of the library is required to automatically pull new versions of it without verifying their operation. Doing just that seems rather negligent. Add on the fact that there was no contract between the library author and the user, no compensation, and (as other answers have noted) free and open source licenses usually disclaim any warranty anyway.
Opensource projects (in particular GPLv3+ licensed ones, like RefPerSys or GCC) have no warranty, and might not even have any well defined purposes. Even GCC is so large a project that its purpose is not evidently defined: it is a collection of compilers. It did happen in the past that the Linux kernel had some unspecified or wrong behavior (e.g. some driver crashing the kernel).
And open source developers are allowed to make software bugs (mistakes). I think that even proprietary software developers can make bugs.
Sometimes, a bug is renamed as a feature. Sometimes, a requested feature trigger other bugs (in previously non-buggy code). The Rice's theorem is related.
In some countries (in France, see article 323-1 du Code Pénal) software has some legal limitations and legal barriers. These apply to both open source and proprietary software.
I am not a lawyer, but I understand that it is people's behavior, not open source software, which can be illegal.
Feel free to contact me by email.