Re: one item on my wish list

[David Kastrup]

Klaus Föhl <address@hidden> writes:

> There is Christmas around the corner, and the recent report from Noeck
> on showcasing Lilypond at a teacher training reminds me on the outward
> visibility. And on the topic of music integration in wiki environments.
>
> For the mediawiki software (known from its wikipedia use) there exists
> Extension:LilyPond which is deprecated due to security issues
> and http://www.mediawiki.org/wiki/Extension:Score as a safer successor.
> Still it is experimental. Not yet advisable to install it in any wiki
> open to the outside world.
>
> But if it were sufficiently safe to install as addon to mediawiki
> it certainly would raise the LilyPond visibility, and the brevity
> of the coded music would speak by itself.
>
> Any chances for a Christmas present?

Ah, the joyous spirit of receiving...

"Sufficiently safe" is in the mind of the beholder.  There have been
some improvements in how reliably the "-dsafer" LilyPond sandbox works.
But there will be nobody promising you to pay all followup costs in case
it gets breached.  The GPLv3 states explicitly:

      15. Disclaimer of Warranty.

      THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
    APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
    HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
    OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
    THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
    IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
    ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

      16. Limitation of Liability.

      IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
    WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
    THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
    GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
    USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
    DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
    PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
    EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
    SUCH DAMAGES.

It also states:

  You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.

Now it is unlikely that even under your invocation of the Christmas
spirit, anybody is going to step forward and offer warranty protection
without a fee.

The question is more what kind of warranty would get offered for what
price, and what kind of damage would be covered.

LilyPond is not inherently designed for safe operation.  It has some
mechanisms for locking away "dangerous" Scheme constructs, but it is not
plausible that somebody intent on finding a hole will not be able to do
so.

-- 
David Kastrup