Comment by fjfaase | Hacker News Reader

Comment by fjfaase | Hacker News Reader

Parent Full thread

What I understand (from having attended some Dutch government meetings about this), is that companies are liable and should make an assessment of all third party libraries that they are using with respect to the risk involved with cyber security. Furthermore, they should actively monitor any security updates of those third party libraries and incorporate fixes in their own software and push those to users of their software. This does include embedded software in the devices they sell.

This applies to all software that is part of a commercial interaction, no matter whether the other party has to pay for the software or not. The software could be part of a device or be part of a certain service.

I understood that as long as the developers of open software are not involved in a commercial interaction, they cannot be held liable. I guess that if you receive some kind of support (a grant) for developing open source software, you are not immediately in a commercial interaction. But if you have some kind of agreement with an organization to develop or maintain open source software specific for that organization, that could count as commercial interaction.

> But if you have some kind of agreement with an organization to develop or maintain open source software specific for that organization, that could count as commercial interaction.

I think that's the risk. It's not clear what counts as a commercial interaction. eg I built a lib used for data analysis of bio samples. I have occasionally done some consulting for users, but nothing in over a decade. Does that count as commercial interaction? It's unclear to me. I'm considering deleting the open source and/or updating the license to ban the EU.

Like obviously this is a very low probability risk, but I don't care to take any risks for something that I give away for free :shrug:

Separately, the idea that I have to have a security policy or any other thing; I decline.

I understand your worries as they were one of my reasons to join these government organized briefings.

It seems very unlikely that such a lib in itself has any cyber security risk as long as it itself does not query an external database through a network connection.

The users of the lib have to asses that it has no security risk.

Did you sign any formal agreement with the users of the lib? Is there still any obligsation on your side with respect to the lib?

If you would discover some security issue, like a buffer overrun, would you fix it? Then just mentioning it, would be enough. The users of the lib bear the greatest responsibility. They have to regularly check your lib for security problems.

> It seems very unlikely that such a lib in itself has any cyber security risk as long as it itself does not query an external database through a network connection.

It almost certainly has tons, because it was not designed to read attacker-controlled images or data files. If someone uses it that manner, I would be absolutely shocked if it doesn't. The testing suite focuses exclusively on correctness and speed.

> If you would discover some security issue, like a buffer overrun, would you fix it?

No. I don't use this work; I no longer work in science; etc. It's just a gift to other people of several years of work and a ton of time in vtune making it go fast.

Reply on news.ycombinator.com