The Heartbleed-bug of the software OpenSSL was a security-nightmare for IT around the world. We already know the bug was caused by a patch from a german programmer named Robin Seggelmann. While he surely didn't intend it and is probably very sorry about the problem (and frankly - most programmers would have made the same error), I ask myself if he is in danger of legal repercussions. So, can anything happen to him legally (or any other programmer who makes similar errors in public software)?
Add a comment
|
2 Answers
Clause 6 of openSSL's CLA states:
- You are not expected to provide support for Your Contributions, except to the extent You desire to provide support. You may provide
support for free, for a fee, or not at all. Unless required by
applicable law or agreed to in writing, You provide Your
Contributions on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS
OF ANY KIND, either express or implied, including, without
limitation, any warranties or conditions of TITLE, NON-
INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
That means that he's in the clear.
Beyond that the license of openSSL also has a warranty disclaimer.
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
answered Sep 10, 2015 at 12:17
-
3
-
3
-
In the event that he gets sued I am sure there are many big names in open source (RedHat in particular) that will defend him, otherwise they would not be able to sell the idea to future OSS developers.– dashesySep 10, 2015 at 17:53
The question is: does the project provide legal protection to its contributors? This issue is one of the major drivers behind the creation of foundations such as the ASF. These entities serve as the legal target for negligence and other legal complaints, insulating the contributors. The fact that a CLA says 'no warranty' is not an airtight protection from all possible legal problems.
Of course, as we say in the USA, 'anyone can sue anyone for anything.' So all of this is a question of legal opinion as to whether the OpenSSL CLA, or the ASF's release policy, or anything else, completely insulates a contributor from the effects of their work.
-
The project itself probably doesn't provide legal protection, but the community as a whole does provide protection. I'd start by contacting the EFF if you ever found yourself in this situation. Sep 14, 2015 at 0:52