Hacker News Reader

Comment by cesarb | Hacker News Reader

> It's his code to break if he wants.

This is a library, not standalone software. Breaking it means breaking the code of every software which uses that library.

View on HN

And per the MIT license, he offers it “WITHOUT WARRANTY OF ANY KIND (…) INCLUDING BUT NOT LIMITED TO (…) FITNESS FOR A PARTICULAR PURPOSE”

That doesn't give him the right to commit sabotage. If as the developer of a FOSS program I deliberately introduce something that will harm users, a "no warranty" clause won't protect me from the consequences. The guy knew full well how npm worked, and new full well that he was deliberately breaking lots of sites. "No warranty" just means he isn't liable for accidents.

No warranty means he isn't liable for any behavior of the software at all. You don't have to like it but it is true.

Of all the awful legal takes I've seen on this site, yours is an early contender for best of 2022.

> No warranty means he isn't liable for any behavior of the software at all.

Somebody should tell all those computer virus authors, all they had to do was not include a warranty, and they're untouchable!

Those seem like different things since a computer virus "user" never consents to or accepts the license, whereas someone importing the library into their package.json has.

Eh, just write in the EULA exactly what your virus will do and that they have no warranty, bundle it as an add-on a la toolbar bundling in the 00s, and bam, you've got the user's consent to do anything!

You can pretend there's no difference between this and a computer virus, but there clearly is.

The users of this software pull it, explicitly, voluntarily. The author says it doesn't serve any particular purpose, and in using it you understand that. the software itself did nothing malicious, it just stopped working. It's not the same thing as slapping a license on a computer virus and forcibly foisting it onto an unwitting victim. It's not naive legalese loophole workaround thinking. When you choose to use the software you agree to abide by the license, which includes no promise of utility whatsoever.

He is responsible for his own behavior, and harming with intent is not a liability that can be waived in the US. This is literally first week of Contracts course material in law school.

But there was no harm or no intent to harm, the software just stopped working. Just because you rely on someone's work doesn't mean you can expect it to continue forever.

no it does not mean you can legally change your software to malware.

I think it's disingenuous to label it as "malware".

Nah its not. It crashes hoobs and the ring plugin for homebridge. And probably a lot of other software.

Modern JS crashes my older browsers too. It doesn't mean it's the JS author's fault for using code my system can't handle.

The intent is extremely important to the word malware. the intent WAS malicious.

It was malicious about as much as flash no longer working, or nest thermostats.

> Breaking it means breaking the code of every software which uses that library.

No, those other programs importing it is what breaks them. They do that themselves. Or does he have push access to all their repositories?

Reply on news.ycombinator.com