9

The Heartbleed-bug of the software OpenSSL was a security-nightmare for IT around the world. We already know the bug was caused by a patch from a german programmer named Robin Seggelmann. While he surely didn't intend it and is probably very sorry about the problem (and frankly - most programmers would have made the same error), I ask myself if he is in danger of legal repercussions. So, can anything happen to him legally (or any other programmer who makes similar errors in public software)?

5

Clause 6 of openSSL's CLA states:

  1. You are not expected to provide support for Your Contributions, except to the extent You desire to provide support. You may provide
    support for free, for a fee, or not at all. Unless required by
    applicable law or agreed to in writing, You provide Your
    Contributions on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS
    OF ANY KIND, either express or implied, including, without
    limitation, any warranties or conditions of TITLE, NON-
    INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.

That means that he's in the clear.

Beyond that the license of openSSL also has a warranty disclaimer.

THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

  • 3
    Does this clause legally hold, especially in Germany? – Mnementh Sep 10 '15 at 12:20
  • 3
    @Mnementh that's a question for law.SE I think. – ratchet freak Sep 10 '15 at 12:21
  • In the event that he gets sued I am sure there are many big names in open source (RedHat in particular) that will defend him, otherwise they would not be able to sell the idea to future OSS developers. – dashesy Sep 10 '15 at 17:53
5

The question is: does the project provide legal protection to its contributors? This issue is one of the major drivers behind the creation of foundations such as the ASF. These entities serve as the legal target for negligence and other legal complaints, insulating the contributors. The fact that a CLA says 'no warranty' is not an airtight protection from all possible legal problems.

Of course, as we say in the USA, 'anyone can sue anyone for anything.' So all of this is a question of legal opinion as to whether the OpenSSL CLA, or the ASF's release policy, or anything else, completely insulates a contributor from the effects of their work.

  • The project itself probably doesn't provide legal protection, but the community as a whole does provide protection. I'd start by contacting the EFF if you ever found yourself in this situation. – Abhi Beckert Sep 14 '15 at 0:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.