Hacker News Reader

Comment by slavoingilizov | Hacker News Reader

Exactly! If someone hacks my bank, I can sue them and get my money back. If someone hacks the app using your library, I have zero rights.

No business would take that risk and use your library at scale. Yes, open source is great, etc. But it doesn't solve the problem.

View on HN

> If someone hacks the app using your library.

Sorry, but I still don't understand what you mean here. There could be a bug in the library in the same manner that there could be bugs in any other open source library. Could those bugs become a security issue for your app? Yes, they could. Despite of this we all use open source software, right?

Let's say you were using Active Merchant[1], would you sue Shopify if someone hacked your app to process irregular payments through your Bank's payment gateway (accessed by Active Merchant [2])?

[1] https://github.com/activemerchant/active_merchant

[2] https://github.com/activemerchant/active_merchant/tree/maste...

Also, most OSS licenses protect the developers against this kind of nonsense anyway ('...not guaranteed fit for any purpose...'), for good reason.

If someone hacks your business checking account, you have 24 hours to detect and report the unauthorized transfer. After that, the UCC doesn't require the bank to give you your money back.

And yet every business has a checking account, and many aren't that diligent about checking it every 24 hours.

Reply on news.ycombinator.com