I'm Not Making Any Guarantees

The Heartbleed bug continues to yield fallout. Earlier I expressed surprised at how few people seemed to know what a bug is. So I'm assuming that there are a lot of people confused as to where this widely used software came from. Many reports have mentioned that it's in something called OpenSSL. But many are surely wondering why there is no company name attached to it. You'd expect Mt. Gox-like story of incompetence, or a GM-like story of profit over responsibility. Geez, give us something to get angry at. Give us someone to sure.

The answer to all this is that there is no company behind it, it's open source.  That is, it's written primarily with volunteer work, given away for free, and not owned by anyone. In retrospect, yes, it's pretty weird that we have this widely-used product that no-one has figured out how to make money off of.

Perhaps this incident an important lesson in humanity. Normally there is an expectation that a misfortune this big must be someone's fault, that someone must have sleepy motives. But no, apparently it can just be an honest mistake. To err is still human.

As for suing, that theoretically won't happen. Everyone familiar with Open Source software is familiar with readme files that make it clear - usually in capitals - that the program comes WITHOUT ANY WARRANTY.  Hopefully no lawyer will try some legal black magic to get around that disclaimer. If lawsuits were to start flying, it would have a chilling effect on open source software, which - as we've just learned - is behind the scenes of a lot of today's technology.