"We have one rule in the kernel: don't break userspace. Everything else is kind of a guideline. The whole security thing? It's a guideline that we shouldn't do stupid shit. But people do stupid shit all the time and I don't get that upset." https://www.youtube.com/watch?v=1Mg5_gxNXTo#t=8m28
Imagine, Torvalds said, that terrorists exploited a flaw in the Linux kernel to cause a meltdown at a nuclear power plant, killing millions of people. “There is no way in hell the problem there is the kernel,” Torvalds said. “If you run a nuclear power plant that can kill millions of people, you don’t connect it to the Internet.” Or if you do, he continued, you build robust defenses such as firewalls and other protections beyond the operating system so that a bug in the Linux kernel is not enough to create a catastrophe. http://www.washingtonpost.com/sf/business/2015/11/05/net-of-...
And the Linux kernel has a track record for not being the world's most secure piece of software. Which is fine, it's a project he started for fun.
It's certainly possible to pay people for a kernel that they'll stand behind commercially. If you're using, say, a RHEL kernel and a bug or vulnerability is discovered that impacts you, by all means get upset at Red Hat. If you're using a Fedora kernel, though, you made the choice to use it. It's completely unfair for you to get the benefits of running a kernel you put neither time nor money into, and not also the risk of running that kernel.
Obviously that is Google's problem, but I haven't seen Google (nor Atlassian in this case) claim anyone else is to blame.
The problem is absolutely owned by Atlassian, but they actually did do something to fix it.
I don't believe anyone (apart from maybe Daniel J Bernstein) can claim any piece of software is bug/hole free, and neither does anyone need to!
Why, when I use someone else's software without so much as telling them, let alone signing a support contract with them, does the blame shift to them? My responsibility is to deliver a service, not to write software. If writing software is the easiest way to do it, great. If using someone else's software is the easiest way to do it, great. But I'm the one running the service, either way.
If you use someone else's code, especially if you're not paying anything for it, you get what you put into it: nothing.
The liability for this breach is ultimately owned by Atlassian, not the third party library writer. To quote the most permissive license out there:
"THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED."