Hacker News Reader

Comment by capableweb | Hacker News Reader

> There are some duties that apply to people that are open sourcing stuff:

No, zero duties. The express purpose of Open Source is that I can release code for free to world, and it's your responsibility to figure out if it's what you need. Adding some arbitrary "duties" that people must fulfill to release open source, is something else, and should not be called just "Open Source" as that already has a definition.

If you get hit by any of those points you list, then you're the one responsible for that.

> If you are an Open Source dev, you are a "Code Influencer".

That's mixing up terms. Open Source developers are developers who release Open Source code, that's it. People who try to "influence" the ecosystem one way or another, could be called "code influencers" I guess, but please don't mix them together. One doesn't imply the other.

View on HN

Nope, you never have zero duties, as much as you would like to be a jerk to people. Just like putting salmonella in your free cookies will get the police to show up at your door real quick, releasing open source code with malicious behavior, or lying about what you’re doing, or just straight up being a rude person is not really acceptable, open source maintainer or not. There are appropriate consequences for all of these, and not all of them involve the legal system.

Purposefully poising people without disclosing that, is illegal. Yes.

Purposefully infecting computers with viruses without disclosing that, is probably illegal too. Yes.

Publishing code that on purpose infects computers with virus but disclosing that, is probably not illegal.

Publishing code without any disclosures at all, which happens to infect people, is probably not illegal either.

You don't have to download random code from GitHub and run it. No one is forcing you to. And if you do so, you're responsible for your own actions.

Lying about what you're doing or being rude is shitty, and the ecosystem should not support that, I agree with that. But throwing in a MIT license together with some code you publish, doesn't simply that you won't lie or that you won't be rude. It just says that you can use that code if you want to.

What you're looking for if you're looking for promises of not being lied to, is something closer to a Code of Conduct or Contributing Guidelines. It's outside the scope of (most) licenses.

Right, there's levels of consequences here. You're very focused on what's illegal. Some of the things I mentioned are illegal and you would probably be sued/go to jail for them. Some probably aren't illegal or may even be explicitly legal (NO WARRANTY, etc.) but there are still consequences to doing it. You'll often only get the chance to get people to try your published code that happens to infect them once, and after that they will not only avoid your software but also get people to do the same. They may even be upset that your software did this, because despite there being no legal agreement in place between you and the person that downloaded your software to prevent this, they do have a social expectation that you're not being negligent, or misrepresenting your code. Nothing stops them from calling you a jerk.

I agree but you’ve just explained nicely why this duty has nothing to do with open source software. The duties you’re talking about are universal. Are there any special duties open source devs have that other people don’t have?

    >> * Don't lie about what it does.
    >> * Don't hack people by smuggling some nasty code into minor version updates.
    >> * Don't leave people vulnerable to third party exposure by not taking care of your private keys.  
    >
    > If you get hit by any of those points you list, then you're the one responsible for that.

If someone on the street hands you a free sample, say a candy bar, is it then your responsibility to check that the candy bar:

1. contains no razor blades (malicious behavior), and

2. contains no peanuts because of your allergy even though the packaging says it doesn't (lying about what it is)?

Obviously not, anyone handing those out violating those assumptions is an asshole and in most jurisdictions a criminal. It is not the responsibility of the acceptor to check these things, our society expects (and enforces through the law) that people are honest and non-malicious. Even if the sample is free.

The exact same applies to source code you distribute. It would not be reasonable to analyze every free candy bar for hidden razor blades by meticulously taking it apart, nor do a spectral analysis for peanut traces in exactly the same way it is not reasonable for people to verify every line of code.

>> It is not the responsibility of the acceptor to check these things, our society expects (and enforces through the law) that people are honest and non-malicious. Even if the sample is free.

>> The exact same applies to source code you distribute. It would not be reasonable to analyze every free candy bar for hidden razor blades by meticulously taking it apart, nor do a spectral analysis for peanut traces in exactly the same way it is not reasonable for people to verify every line of code.

That is not what the licenses say.

Most FLOSS licenses have a clause like this:

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

If the author explicitly disclaims all responsibilty about the released software, then all responsibilty falls on the user.

So how is a normal influencer then an actual influencer, and not just a person "releasing" content "for free to (the) world"?

I couldn't care less about the definition of what an "influencer" is or not.

What we're talking about here is releasing code as FOSS. Just because I add a MIT license to code I publish publicly, doesn't mean I want to be some "influencer" or whatever. It just implies (rather explicitly) exactly what it says in the license text, nothing more, nothing less.

Reply on news.ycombinator.com