2

I'm thinking about developing an open-source web application where users can enter trips that they have done (touristic or commuting) and then view statistics and maps created from this data. If I want to host this application myself and make it publicly accessible, I would have to also to take care of the databases containing the data on the server.

However, I am certainly not an expert on online-security, so I'm wondering, what happens, if someone get unauthorised access to the data and maybe even the passwords, will I be personally liable?

4

You are likely liable if applications that you run and operate, that store user-supplied data, have that data exfiltrated. The exact nature of the liability depends on the applicable jurisdiction(s): in Europe (and now that the GDPR is in effect also if you cater for European visitors) things can get quite hairy, while the US is generally less-sensitive to this (with certain exceptions: health information, credit card data, and so on).

This liability does not generally depend on whether the application is open-source or not.

You are not, generally, liable if someone else runs a copy of your open-source application, and it gets hacked either through their misconfiguration or vulnerabilities in your code. Most free software licences contain big disclaimers that make this clear to the end-user; this one's from GPLv3 (shouty capitals are theirs, not mine):

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.