[disintegore]

IANAL but I'm fairly certain this protects you against legal action and not negativity on the internet.

Furthermore, if we're to interpret this clause as "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large.

[jasonlotito]

From the grand parent:

"If you're a developer of a project that is used in a security-sensitive context, you either be receptive to security concerns or you clearly label your project as a toy project."

The reply:

"THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ... FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT."

Furthermore, from the GP: "No one expects you to write perfect code, but we do expect you to fix flaws when you learn about them."

Nothing in the license implies any such guarantee.

> "do not place any trust in this software whatsoever" then I guess that's really bad news for the security community at large.

I mean, that's what the license says. If you want assurances, get it in writing. Otherwise, when you use code, it's on you to make that guarantee of the code you are using.

Entitlement. Gimme gimme gimme. It's a shame.

[disintegore]

I didn't think it could be so difficult to separate legal contracts from social ones.

If you have voluntarily assumed the role of maintaining an open source project, it's perfectly reasonable for people to expect you to address merge requests and issues on the issue tracker. It's reasonable to expect a maintainer to process technical arguments and justify their technical decisions.

The maintainer of course has no legal or moral obligation to perform any of these tasks. If he should ignore these assumed responsibilities, the users of the software can react in multiple ways. They can fork the project or use something else. In both cases they are also completely and utterly within their right to put into question the reliability and credibility of the aforementioned maintainer. Especially where it concerns software that people rely on for critical processes.

All the "as is" clause means for security concerns (apart from its legal implications) is that the burden of making these guarantees lies on the community, and not the emitter of the software. It does not mean you should have no expectations of it at all and to suggest so is, frankly, nonsense.

Lastly, I think if anyone is "entitled" to anything, it's respect. If the developer of actix truly felt like he was not getting the respect he deserved then his reaction is completely justified.

[sneak]

Legal statements aren't special. They are also plain old social statements, which I think was his point. It's not solely a "don't sue me".

[ssokolow]

However, that disclaimer exists in all major open-source licenses, including all such software explicitly marketed such that a Reasonable Person (in the legal sense) would interpret it as a statement of fitness for purpose.

Thus, the disclaimer in the license cannot double as a disclaimer in the social arena.