Are open-source developers protected to a greater extent from liability in the event of security breach involving their software?
<p>I'm studying for the Certified Cloud Security Professional (CCSP) exam and am confused by some statements that were made regarding cloud application security.  Specifically a statement on proprietary software vs open source: </p>

<blockquote>
  <p>Perhaps one of the main points in favor of proprietary options is the
  possibility that liability will map back to the vendor -- that
  breaches or other impact due to failures in the program can be blamed
  on the vendor, who may be help accountable (although it's difficult to
  think of examples where this has occurred).</p>
</blockquote>

<p>I don't understand -- if I'm using opensource software to protect some asset in my organization, how does that completely absolve the developer? Are open source use licenses <em>that</em> good? Or is this predicated on the assumption that I'm not paying anything for open source software? Or perhaps it's based on the assumption that as a customer who had the <em>opportunity</em> to review the source code for security issues, I did? </p>

<p>Don't get me wrong, I'm not implying that everyone should have the means to sue open source developers (certainly not!!) but I want to understand why the cloud application security material in this course seems to have a blanket statement essentially saying "if you're using open-source security software, you can't hold the developer liable." </p>

<p>There is no contract between you (the licensee) and the licensor of the software. The creator of the open source software just says "here's the software, you may use it if you like, as long as you fulfil some conditions. ". No contract, no liability. </p>

<p>I think the developer would only be liable if they <em>intentionally</em> created software that causes damage. (Which has happened, some open source browser plugins have recently been modified to run bitcoin mining software, or worse. I suppose the miscreants could follow all the GPL rules or whatever license is used). </p>

<p>It all depends on the license, not on whether the code source is open or not (although it is true that clauses shielding developers from liability are usually much bolder in open source licenses).</p>

<p>Say, if a commercial license had a clause like this (from <a href="https://opensource.org/licenses/BSD-3-Clause" rel="nofollow noreferrer">3-Clause BSD License</a>):</p>

<blockquote>
  <p>IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
  ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
  GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  ADVISED OF THE POSSIBILITY OF SUCH DAMAGE</p>
</blockquote>

<p>you probably would not accept it/pay for it. But when it comes free it actually comes at the cost of you being unable to sue for damages.</p>

open-source-software