HN commenters constantly mistake “what I should do” with “what I am obligated to do.” Nobody is saying open source developers are legally mandated to be careful with user data. We are saying they should. There’s no need to haul out the license and put our lawyer hats on here. One can be within one’s legal rights and still be wrong.