It will probably be similar to when a physical product is defective because of a faulty 3rd party component.
More importantly, as a professional software developer, the testing of my product should find problems in 3rd party components. If I chose poorly and the 3rd party component doesn't do what it's supposed to do, that's my responsibility. I can't just slough it off onto someone else.
my product should find problems in 3rd party components.
Does that mean that say a security vulnerability in openssl is a responsibility of all software which uses them? I think its unreasonable to expect software projects/products to find things like heartbleed.
What about bugs in kernel/OS? How many user-mode software can find bugs in kernel/OS?
Comments
It will probably be similar to when a physical product is defective because of a faulty 3rd party component.
More importantly, as a professional software developer, the testing of my product should find problems in 3rd party components. If I chose poorly and the 3rd party component doesn't do what it's supposed to do, that's my responsibility. I can't just slough it off onto someone else.
Does that mean that say a security vulnerability in openssl is a responsibility of all software which uses them? I think its unreasonable to expect software projects/products to find things like heartbleed.
What about bugs in kernel/OS? How many user-mode software can find bugs in kernel/OS?
The OS is not a 3rd party library. You're confusing two different topics here.
BTW: Software vendors find bugs in the OS all the time.