Contracting Insecurity: Software License Terms that Undermine Cybersecurity
Bibliographic record
Abstract
This article examines software contracting through the lens of cybersecurity in order to examine a series of terms and practices that arguably reduce the general level of cybersecurity. Part I considers clauses that undermine cybersecurity by suppressing public knowledge about software security vulnerabilities. This is done by preventing research through anti-reverse engineering clauses or anti-benchmarking clauses, and by suppressing the public disclosure of information about security flaws. Part II shifts gears and considers a range of practices (rather than license terms) that undermine cybersecurity. In these cases, the practices are the problem, but the licenses contribute by creating an aura of legitimacy when to the practices is obtained through the license. The practices addressed in Part II are that of making software difficult to uninstall, abusing the software update system for non-security-related purposes, and obtaining user consent for practices that expose third parties to risk of harm. Part III turns to the question of what should be done, if anything, about license terms that undermine cybersecurity. In particular, the article suggests that there are reasons to believe that such terms are the product of various market failures rather than a reflection of the optimal software license terms. The general contract law doctrines available to police unreasonable terms are unlikely to be sufficient to address the problem. Instead, specific rules adapted to the software licensing context are desirable. For example, the article comments on the proposal that license terms restricting the public disclosure of software vulnerabilities be unenforceable. The article suggests that the freedom to disclose vulnerabilities be tied to a disclosure scheme. This would likely be acceptable to most independent security researchers, many of whom abide by their own self-imposed responsible disclosure guidelines. It may also be more palatable to software vendors than a simple rule that such clauses are unenforceable.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.002 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.000 | 0.000 |
| Science and technology studies | 0.001 | 0.000 |
| Scholarly communication | 0.000 | 0.002 |
| Open science | 0.001 | 0.000 |
| Research integrity | 0.000 | 0.002 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one teacher head, not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".