Fall 2025
Featured Article
Tainted Source Code
Bryan H. ChoiOpen-source software has long eluded tort liability. Fierce ideological commitments and sticky license terms support a long tradition of forbearance against penalizing harmful or negligent work in opensource communities. The free, noncommercial, distributed, and anonymous characteristics of open-source contributions present additional obstacles to legal enforcement. The exponential rise in software supply chain attacks has given new urgency to the problem of bad open-source code. Yet, current approaches are unlikely to meaningfully improve open-source security and safety. On the one hand...
Beyond FLOPs: Shortcomings of FLOPs as a Model Classification Metric in AI Regulation
By Sasha Rosenthal-Larrea and Lucille D. Finn - Edited by Shriya SrikanthSasha Rosenthal-Larrea is a partner in Cravath's Corporate Department, where she focuses her practice on advising clients on the most significant intellectual property issues, including with respect to complex licensing and collaborations, patent and copyright licensing strategy, software and artificial intelligence. Lucille D. Finn is an associate in Cravath's Corporate Department. Introduction Regulators in the U.S. and around the world are walking a tightrope between removing roadblocks to artificial intelligence (“AI”) innovation and protecting against the potential dangers posed by...
Tainted Source Code
Open-source software has long eluded tort liability. Fierce ideological commitments and sticky license terms support a long tradition of forbearance against penalizing harmful or negligent work in opensource communities. The free, noncommercial, distributed, and anonymous characteristics of open-source contributions present additional obstacles to legal enforcement. The exponential rise in software supply chain attacks has given new urgency to the problem of bad open-source code. Yet, current approaches are unlikely to meaningfully improve open-source security and safety. On the one hand, technological tools and self-governance mechanisms remain woefully underdeveloped and underutilized. On the other hand, liability proposals that place all the burden on commercial vendors to inspect the open-source packages they use are impractical solutions that ignore how software is built and maintained. This Article argues that donated code should be subject to tort liability by analogy to the law of tainted food and blood donations. Food safety law is the progenitor of modern tort law, and it reveals an older set of tensions between altruistic efforts to address societal hunger and the need for accountability in regulating the quality of food supply chains. At common law, the charitable nature of a donation is a nonfactor in determining liability. Legislatures have intervened to provide safe harbors, but only up to an extent. This nuanced history offers a principled path forward for extending a liability framework to donations of open-source code.