Re:Dev rejects CVE severity, makes his GitHub repo read-only
by Ekaros on Sunday June 30, 2024 @01:49PM
(#40838678)
If we keep this idea in mind. Couldn't we argue that any piece of software that communicates over internet might allow any type of exploiting, including arbitrary code execution at Ring 0. As technically simple open socket could be made to input data directly to be executed by kernel process?
[ Parent
| on HN ]
Re:Dev rejects CVE severity, makes his GitHub repo read-only
by swatcoder on Sunday June 30, 2024 @01:57PM
(#40838743)
Indeed, and if that software can't point to some contract or license that suggests someone else is liable, then they are responsible.
Funnily enough, almost all open source projects not only disclaim such liability in very large print at the top of their licenses, but they don't even complicate the relationship with some kind of purchase agreement and renumeration.
They literally just say "Here's a thing. Use it if you want, change it if you want, but you're responsible for making sure it meets your requirements."