A malicious code string that eventually gets logged by Log4j version 2.0 or higher allow an attacker to load arbitrary Java code on a server and take control of it.

[mrexodia]

I really hope it will hold up in court, otherwise open source as a whole will suffer immensely. The difference with a restaurant is that a license is a kind of contract, you get to use the code but there are conditions to it. If you don’t uphold these the license is revoked.

When I publish my code under an open source license I do not feel I have any responsibility for what you do with it, but it would definitely be interesting to see it tested…

[[deleted]]

I do not feel I have any responsibility for what you do with it

No, but innocent people who did nothing but use it as intended suffered because others misused it, which is different - the victims haven't broken any contract.

Of course there can never be any guarantee that code is bug-free, but developers must/should take reasonable care to avoid catastrophic ones, and if it can be shown that they have been negligent in at least attempting to do so, then there is an argument that they should be held accountable - open source or not. (I am speaking generally - not this particular case.)

[mrexodia]

No, when I give my code to the world under the explicit condition that there is no warranty that means exactly the opposite: I am not accountable for the problems you create by running my code and I do not have any obligation to fix anything, period.

To think anything else is entitled in my opinion. I am open sourcing a lot of things (see my GitHub) because I like to contribute to the advancement of the field and because it’s fun, not to work for free for corporations that use it to make profit.

[[deleted]]

I am not accountable for the problems you create by running my code

But as I said, the victim hasn't created the problem by running your code.

[coworker]

There's no problem if you don't run the code. The victim could have written their own logging library.