James Bottomley from IBM Research, who is responsible for the SCSI and PA-RISC subsystems in the Linux kernel and previously led the technical committee at the Linux Foundation, has proposed a potential solution to the issue of possibly holding open source developers accountable for bugs in code or improper remediation of vulnerabilities. <\/p>\n
The idea is to shift the legal liability for errors in the source code from developers of open projects to suppliers of end commercial products based on that code, meaning to transfer responsibility from those who create the code to those who profit from it. For example, if a company uses third-party open code in its product and a bug\/vulnerability in that code causes harm to a user, then in such a situation the producer of the commercial software product supplied to the user should be liable and compensate for the damage, not the developer of the open library. <\/p>\n
The transfer of responsibility is proposed to be implemented through attaching a clause to the license stating the agreement to compensate for damages and protect development participants from any legal claims in case of full or partial use of the provided source code under this license as a component or product in jurisdictions imposing additional maintenance obligations on software products. <\/p>\n
In current practice, to mitigate legal risks, it is sufficient to have a warning in the license stating 'AS IS', which indicates that the developer bears no responsibility for errors, does not provide any guarantees regarding the code's functionality, and does not undertake to resolve issues, while the consumer agrees to use the code at their own risk. The lack of guarantees from developers has stimulated the development of a business model based on paid technical support, which dominated in the early stages of the open source ecosystem. <\/p>\n
As open source code penetrates the industry and corporate interest in its use grows, the concept of influencing development through non-profit funds has started to evolve\u2014on the basis of a large project, a fund is created that receives funding for development from major companies, in return for which they are given the opportunity to enter the oversight technical council and participate in collective decisions about further development. The emergence of funds has transformed the perception of open projects, which began to be viewed as a tool for technological industry development, rather than a chaotic haven for volunteers. The perception of responsibility for issues in open code has also changed\u2014instead of protecting individual developers, the clause about the absence of obligations has begun to be seen as a way for large companies that create open products to evade responsibility. <\/p>\n
The situation regarding the abandonment of obligations may change if the Cyber Resilience Act, a proposed law in the European Union, is adopted. This act imposes certain responsibilities on software manufacturers who fail to adequately address security and quickly rectify vulnerabilities throughout the product lifecycle. The bill affects commercial software manufacturers and, judging by the ongoing work, will provide a special exemption for software under open licenses, but there are no guarantees that in the future a similar law will be enacted somewhere without such exemptions. <\/p>\n