2

I'm studying for the Certified Cloud Security Professional (CCSP) exam and am confused by some statements that were made regarding cloud application security. Specifically a statement on proprietary software vs open source:

Perhaps one of the main points in favor of proprietary options is the possibility that liability will map back to the vendor -- that breaches or other impact due to failures in the program can be blamed on the vendor, who may be help accountable (although it's difficult to think of examples where this has occurred).

I don't understand -- if I'm using opensource software to protect some asset in my organization, how does that completely absolve the developer? Are open source use licenses that good? Or is this predicated on the assumption that I'm not paying anything for open source software? Or perhaps it's based on the assumption that as a customer who had the opportunity to review the source code for security issues, I did?

Don't get me wrong, I'm not implying that everyone should have the means to sue open source developers (certainly not!!) but I want to understand why the cloud application security material in this course seems to have a blanket statement essentially saying "if you're using open-source security software, you can't hold the developer liable."

Improve this question
3
  • 2
    If the vendor of a product discloses limitations that make it unsuitable for some purpose, and someone else uses it for that purpose anyway, any consequences would be the fault of the person who used it. I think the argument with open-source software is that since the product's behavior is fully defined by the source code, disclosure of the source code represents disclosure of what the product does and any limitations it might have. Unless the programmer has information which is not clearly expressed in the source, someone who has the source code and a particular customer's...
    – supercat
    Commented Apr 25, 2018 at 15:35
  • 2
    ...requirements [the customer would be such a person] should be better able to know whether a program will meet a that customer's requirements than someone who has the source code but doesn't know the customer's exact needs.
    – supercat
    Commented Apr 25, 2018 at 15:36
  • Unfortunately, most users of open source software never even receive the code, much less look at it, let alone understand it. So such an argument doesn't quite correspond to reality.
    – cHao
    Commented Apr 25, 2018 at 20:33

2 Answers 2

Reset to default
3

There is no contract between you (the licensee) and the licensor of the software. The creator of the open source software just says "here's the software, you may use it if you like, as long as you fulfil some conditions. ". No contract, no liability.

I think the developer would only be liable if they intentionally created software that causes damage. (Which has happened, some open source browser plugins have recently been modified to run bitcoin mining software, or worse. I suppose the miscreants could follow all the GPL rules or whatever license is used).

Improve this answer
2

It all depends on the license, not on whether the code source is open or not (although it is true that clauses shielding developers from liability are usually much bolder in open source licenses).

Say, if a commercial license had a clause like this (from 3-Clause BSD License):

IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE

you probably would not accept it/pay for it. But when it comes free it actually comes at the cost of you being unable to sue for damages.

Improve this answer
1
  • 2
    Most commercial licenses have clauses very much like this. (Every EULA i've ever seen contains a rather broad disclaimer of liability.) And either way, stating something in a license agreement doesn't make it true. :)
    – cHao
    Commented Apr 26, 2018 at 13:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .