Re:Dev rejects CVE severity, makes his GitHub repo read-only
by swatcoder on Sunday June 30, 2024 @01:57PM
(#40838743)
Indeed, and if that software can't point to some contract or license that suggests someone else is liable, then they are responsible.
Funnily enough, almost all open source projects not only disclaim such liability in very large print at the top of their licenses, but they don't even complicate the relationship with some kind of purchase agreement and renumeration.
They literally just say "Here's a thing. Use it if you want, change it if you want, but you're responsible for making sure it meets your requirements."
Funnily enough, almost all open source projects not only disclaim such liability in very large print at the top of their licenses, but they don't even complicate the relationship with some kind of purchase agreement and renumeration.
They literally just say "Here's a thing. Use it if you want, change it if you want, but you're responsible for making sure it meets your requirements."