Hacker News Reader

Comment by jrockway | Hacker News Reader

I love reading these threads. People seem to expect way more out of open-source software than is actually guaranteed to them. It is a template of some computer code that may be relevant to your work; nothing more, nothing less. "I can't believe you let this happen to me!" Well, read the license: "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED". If you don't agree to that, you have no legal right to use the code. Not sure what else there is to discuss.

View on HN

> Not sure what else there is to discuss.

Morals and ethics.

Is it ethical to use code while not agreeing to the license it is provided under?

The license doesn't say "You can't call the author out when they make a bad decision"

I agree that this is a good discussion to have, but maybe we should include the responsibility that people who so easily include potentially untrusted code have in this?

This is free code, responsibility to check may need to have a social shift to those who use it.

What are the ethics? The developer isn't interested in maintaining it. Someone else was. So the developer gave it to that interested party.

I feel like 90% of the open source libraries I've written are maintained by someone other than me now. If that's considered unethical, next time I'll just not open-source it.

The MIT license isn’t as bulletproof as you think it is.

The license doesn't really matter here. I'm only quoting it to set expectations. People are showing up demanding some sort of quality standard, when they explicitly agreed that there was no such standard. A related issue is that NPM distributed malicious code to people. That sounds like a problem between people that downloaded the malicious version and NPM. Not sure how the author is involved.

To your point, if the author added the malicious code, I don't think the license would necessarily protect him. Intent is key. But he didn't.

> A related issue is that NPM distributed malicious code to people. That sounds like a problem between people that downloaded the malicious version and NPM. Not sure how the author is involved.

It's an author/maintainer issue (and not an NPM issue) because the maintainer explicitly gave the bad actor the right to publish via NPM's delivery channel. The maintainer did so in gross negligence, in my opinion.

If courts agree with you, the world of free software is over. It will be too risky to accept contributions. Github and NPM will be shut down over lawsuits.

For that reason, I think you are wrong.

It is risky. Ask one of the 17 law firms involved with Oracle v Google if open source licensing is too risky.

Reply on news.ycombinator.com