10 ms·

IAAL. My reading of the article and the terms of service strongly suggest that the author of this article is not well informed on the subject. For example, my

by bmh_ca 10y ago

IAAL. My reading of the article and the terms of service strongly suggest that the author of this article is not well informed on the subject. For example, my informal and cursory analysis of the article: > Section D.7 requires the person uploading content to waive any and all attribution rights. It does not. The Github license requires a waiver of the requirement of attribution insofar as such waiver is needed for Github to do what it already does e.g. as the license indicates, provide search results without attribution. Further, only Github has been given this waiver. Anyone else is still held to any requirement of attribution. > section D.5 requires ... the right to “reproduce your Content solely on GitHub as permitted through GitHub's functionality”, with no further restructions attached; this is a killer for, I believe, any and all licences falling into the “copyleft” category While D.5 does permit performing, using, and displaying of a work, it permits reproducing on GitHub only. Any copying from GitHub not granted by way of another license would be a violation of the author's copyright. Use, performance, or displaying in the absence of a right to reproduce strikes me as a rather narrow set of rights. I stand to be corrected, but I see nothing sinister, nefarious, or unwarranted by GitHub. YMMV. If you need legal advice, retain a lawyer.

snuxoll 10y ago
The big problem with this is consent of other parties for works that have been forked or are otherwise mirrored on github, from what I can see. If I go and fork some random open source project off Sourceforge or whatever, I cannot publish it on GitHub as I do not have the original author's permission to grant GitHub these rights.
- pbnjay 10y ago
  This was also true before the new ToS though.
  - quadrangle 10y ago
    Please explain. Did the previous terms also require anything that debatably required getting permissions from copyright holders beyond those granted by, e.g. GPLv3?
    - matthewmacleod 10y ago
      The new terms do not grant permission to Github to do anything that they weren't already doing. If you take the view that this agreement is not compatible with a particular software license, then publishing the same software on Github prior to the changes logically must have been a license violation.
      - quadrangle 10y ago
        I think that's sorta true, but this formalizes something in a way that at least might change something about it. IANAL
      - notzorbo3 10y ago
        What? No. Prior it meant Github was violating your license. Just because they were already doing it doesn't mean they had a right to do so. Now, it means you're granting them a license. I'm not a lawyer, and I have absolutely no clue if it's even legal for Github to change their ToS like this. But I assume if you don't have the right to grant this attribution exception to Github (because you don't own all the code) and you don't remove your code from Github, then you are now also in violation of the rights of contributors to the project that didn't consent to this waiver.
- derekp7 10y ago
  In that case, I'd like to see their terms of service re-worded, as "You grant ... rights, or affirm that you will only submit content that is under a license which grants these rights".
  - snuxoll 10y ago
    I mean, they could skip the whole "without attribution" thing as well by just providing a link to the LICENSE/COPYING + NOTICES (if included) file in the repository as well when displaying search results. Overall I feel this was a pretty poor move by GitHub.
Ajedi32 10y ago
> provide search results without attribution Does a link to the source repository (which grants easy access to the usernames of all contributors and the full content of all files in the repo) not count as attribution?
forgottenpass 10y ago
The Github license requires a waiver of the requirement of attribution insofar as such waiver is needed for Github to do what it already does e.g. as the license indicates, provide search results without attribution. Assuming github does have feature(s) that require additional privileges to the source beyond what the open source license provides, doesn't that preclude hosting any project where any single one of the contributors don't contribute via github? (ignoring CLAs and work for hire.) The uploader is unauthorized to grant a wider license to github than they received the code under, right? I stand to be corrected, but I see nothing sinister, nefarious, or unwarranted by GitHub. I wouldn't say they're being sinister, but I don't think that was the point. The point was that their cover-your-ass move is preventing a large number of open source projects from being hosted on the service in compliance with the ToS.
- ProblemFactory 10y ago
  > Assuming github does have feature(s) that require additional privileges to the source beyond what the open source license provides, doesn't that preclude hosting any project where any single one of the contributors don't contribute via github? Yes it does. If there's a license that says "you must not make backups of the code on Thursdays", then hosting it on github would be incompatible with the license. So is hosting other people's non-open-source code in a public repo. Github's ToS put the responsibility of checking that the compatibility of the license and github features on whoever uploads the code. > The point was that their cover-your-ass move is preventing a large number of open source projects from being hosted on the service in compliance with the ToS. Well, there are features that Github wants to have on public repos, for example public code search with short snippets, and the "fork" button. Their ToS has to "cover their ass" for these features, their lawyers would throw a fit if they kept the features without asking for permission in the ToS. If there are OSS licenses that are not compatible with these features, then either the uploader or github was breaking copyright laws already. But I'm not convinced that its anywhere as big deal as the author of the article makes it seem. So github has public code search, which shows 5 line snippets of code with a link back to the repo. Does this satisfy LPPL's "code must be distributed unmodified" rule? Is this enough attribution to satisfy CC-BY? A reasonable person would say yes, because you can just click on the link to get to the whole repo with the full codebase and authors.txt file. But github isn't going to take the legal responsibility of checking each license for these questions, people uploading the code will have to do it themselves. (Also, github has no way of checking that the person uploading the code actually has the right to put the license.txt file on the code).
libertymcateer 10y ago
IAAL as well. I think you've convinced me. I was concerned that the use, performance or display may be a problem... but thinking it through, I do not really see this as an issue with most copyleft licenses. They are usually tied to distribution of code - which is reproduction. I echo your disclaimer. If you need a lawyer, get one.
- lukas 10y ago
  This is a little off topic but these comments make me wonder: why are lawyers so reluctant to give informal advice? I really appreciate the two thoughtful and informed comments at the top of this article here - why the disclaimers? I look for and give informal advice about all kinds of other topics that have the same levels of ambiguity and sometimes the same levels of importance as legal issues but it's always a real challenge to get a lawyer to weigh in informally on a legal issue. If someone asks me my opinion about an engineering or management issue they're facing, I'll give it to them knowing that I don't know the complete set of facts and they should take my opinion with a grain of salt. I might be missing important context and I might just be wrong. If I ask someone else advice on any topic, I assume that there is an implicit disclaimer. Is there something fundamentally different about the law? Is it because lawyers are in the business of giving advice? Anyway, appreciate you guys weighing in and hope you do it more frequently :).
  - xyzzy_plugh 10y ago
    Typically, as licensed members of a regulated profession they could be held liable for any advice they provide.
  - teraflop 10y ago
    There are strong legal protections for the attorney-client relationship, such that lawyers are obligated to act scrupulously in their clients' interests. These rules exist for good reason, but a prudent lawyer will want to make it very clear when such a relationship exists and when it doesn't.
    - 10y ago
derefr 10y ago
> it permits reproducing on GitHub only. Any copying from GitHub not granted by way of another license would be a violation of the author's copyright. If you grant Github a right to reproduce your IP, but no further rights, do people have a right to view Github's reproduction of your IP?
- dragonwriter 10y ago
  Viewing is not a right protected by copyright, so no license is required for that.
  - hobarrera 10y ago
    Viewing: Nope. Projecting it on a conference: Depends.
Buttons840 10y ago
> Further, only Github has been given this waiver. Anyone else is still held to any requirement of attribution. This convinced me. I can release my code under GPL, and then sell it to someone else under different terms. It's my code, and I have copyright. I don't have to give the same permissions to everyone. Likewise, just because I give Github certain permissions doesn't mean I have given the same permission to everyone else.
- flukus 10y ago
  But some projects don't have the copyright of the original author/s, particularly forked ones.
  - notzorbo3 10y ago
    Even worse, if you've ever accepted a patch or pull request and didn't get copyright transferred to you, then that code is still owned by the author of the patch, and you'll need their permission too. edit: I don't think forked repos are much of a problem. They're already on Github, so they already accepted the ToS. if they didn't, that's not your problem as a forkee. Unless the code was forked before this new ToS. Copyright is so messy.
- vsl 10y ago
  That's all fine if your project is a tiny one and you never ever accepted any contribution or used any dependency.
hvis 10y ago
Thanks. Any (informal) opinion on the validity, according to the new ToS, of mirroring third-party F/LOSS projects on GitHub (ones distributed under GPL, MIT or BSD)? Do I need to get the permissions from each author of the work to upload it, above what Free Software licences already allow?
- mirabilos 10y ago
  As things are right now: yes, especially for GPL works, “probably not” for BSD or MIT works. I _am_ working with them to get it fixed, but they enacted the new terms prematurely, so _currently_ the mess is there.
  - hvis 10y ago
    Thanks for working on it.
sparr0 10y ago
> The Github license requires a waiver of the requirement of attribution insofar as such waiver is needed for Github to do what it already does e.g. as the license indicates, provide search results without attribution. The whole problem is that I, as an uploader of code that I did not write, do not have the authority to make that waiver.
- Lazare 10y ago
  But in that case, you've never been able to upload code to github, right?
  - comex 10y ago
    It may be the case that what the license permits (combined with fair use law) is sufficient to allow what GitHub actually, currently does with the code, but not everything their TOS claims the right to do. In particular, "store and display your Content [..] as necessary to render the Website and provide the Service" is rather broad given that the functionality included in the "Service" (defined as "the applications, software, products, and services provided by GitHub") can change at any time, without notice.
  - caf 10y ago
    Not necessarily. If the license allows you to redistribute the code, you're just redistributing it to GitHub, and you're OK as far as the software license goes. If GitHub then does things with that code that the license doesn't allow, it was GitHub that is doing something it's not allowed to - unless, as uploader, you've agreed to indemnify GitHub for this sort of thing.
  - vsl 10y ago
    Wrong. My OSS project has over 15 years of history, uploaded to GitHub after migration from SF.net. It has third party dependencies that I use under their licenses - which often do require attribution.
gsylvie 10y ago
IANAL. I'm just a random person who studied the book, "Open Source Licensing: Software Freedom and Intellectual Property Law," by Lawrence Rosen. The OP doesn't mention D.4 much. The first paragraph of D.4 seems fine to me. But I worry the "clarification" (2nd paragraph) in D.4 could potentially cause problems: > That means you're giving us the right to do things like reproduce your content (so we can do things like copy it to our database and make backups); display it (so we can do things like show it to you and other users); modify it (so our server can do things like parse it into a search index); distribute it (so we can do things like share it with other users); and perform it (in case your content is something like music or video). Is "modify it" the same as "create derivative works"? If so, seems you've granted Github the right to "modify it" and "distribute it" potentially without any restrictions.
AndyKelley 10y ago
This all sounds reasonable. Meta question here. Is it necessary to say "I am not a lawyer...if you need legal advice, retain a lawyer."? Is that statement really legally protecting you? Is it intended to encourage the reader to take you less seriously? I'm having trouble not seeing this statement as a cargo cult prefix/postfix to commenting on legal issues, and if it's not really necessary, it seems more tasteful to me to leave it out.
- tomsmeding 10y ago
  He said "IAAL" -- I am a lawyer. Don't know whether that's a typo or not, but it certainly doesn't equal "IANAL" ;)
  - deleted 10y ago
    [deleted]
Arizhel 10y ago
>YMMV. If you need legal advice, retain a lawyer. So I need to find a lawyer and pay him $1000+ so I can see if GitHub is safe to use? I guess I'll just stick with storing projects on my computer at home and skip this cloud-based stuff. I can't afford to retain a lawyer and consult with him for everything I do with code online.
- andrewstuart2 10y ago
  Cloud != SaaS. You can host your own GitLab CE or Gitea on any ol' $5 server and it will easily serve your own needs, plus give you full control.
gyehuda 10y ago
Thanks, I came to a similar conclusion and shared it here (in case anyone wishes to see or comment). I'm not a lawyer, btw. https://www.quora.com/Are-GitHubs-new-terms-of-services-problematic/answer/Gil-Yehuda https://www.quora.com/Are-GitHubs-new-terms-of-services-prob...

by bmh_ca 10y ago

snuxoll 10y ago

The big problem with this is consent of other parties for works that have been forked or are otherwise mirrored on github, from what I can see. If I go and fork some random open source project off Sourceforge or whatever, I cannot publish it on GitHub as I do not have the original author's permission to grant GitHub these rights.

pbnjay 10y ago
This was also true before the new ToS though.
- quadrangle 10y ago
  Please explain. Did the previous terms also require anything that debatably required getting permissions from copyright holders beyond those granted by, e.g. GPLv3?
  - matthewmacleod 10y ago
    The new terms do not grant permission to Github to do anything that they weren't already doing. If you take the view that this agreement is not compatible with a particular software license, then publishing the same software on Github prior to the changes logically must have been a license violation.
    - quadrangle 10y ago
      I think that's sorta true, but this formalizes something in a way that at least might change something about it. IANAL
    - notzorbo3 10y ago
      What? No. Prior it meant Github was violating your license. Just because they were already doing it doesn't mean they had a right to do so. Now, it means you're granting them a license. I'm not a lawyer, and I have absolutely no clue if it's even legal for Github to change their ToS like this. But I assume if you don't have the right to grant this attribution exception to Github (because you don't own all the code) and you don't remove your code from Github, then you are now also in violation of the rights of contributors to the project that didn't consent to this waiver.
derekp7 10y ago
In that case, I'd like to see their terms of service re-worded, as "You grant ... rights, or affirm that you will only submit content that is under a license which grants these rights".
- snuxoll 10y ago
  I mean, they could skip the whole "without attribution" thing as well by just providing a link to the LICENSE/COPYING + NOTICES (if included) file in the repository as well when displaying search results. Overall I feel this was a pretty poor move by GitHub.

Ajedi32 10y ago

> provide search results without attribution Does a link to the source repository (which grants easy access to the usernames of all contributors and the full content of all files in the repo) not count as attribution?

forgottenpass 10y ago

The Github license requires a waiver of the requirement of attribution insofar as such waiver is needed for Github to do what it already does e.g. as the license indicates, provide search results without attribution. Assuming github does have feature(s) that require additional privileges to the source beyond what the open source license provides, doesn't that preclude hosting any project where any single one of the contributors don't contribute via github? (ignoring CLAs and work for hire.) The uploader is unauthorized to grant a wider license to github than they received the code under, right? I stand to be corrected, but I see nothing sinister, nefarious, or unwarranted by GitHub. I wouldn't say they're being sinister, but I don't think that was the point. The point was that their cover-your-ass move is preventing a large number of open source projects from being hosted on the service in compliance with the ToS.

ProblemFactory 10y ago
> Assuming github does have feature(s) that require additional privileges to the source beyond what the open source license provides, doesn't that preclude hosting any project where any single one of the contributors don't contribute via github? Yes it does. If there's a license that says "you must not make backups of the code on Thursdays", then hosting it on github would be incompatible with the license. So is hosting other people's non-open-source code in a public repo. Github's ToS put the responsibility of checking that the compatibility of the license and github features on whoever uploads the code. > The point was that their cover-your-ass move is preventing a large number of open source projects from being hosted on the service in compliance with the ToS. Well, there are features that Github wants to have on public repos, for example public code search with short snippets, and the "fork" button. Their ToS has to "cover their ass" for these features, their lawyers would throw a fit if they kept the features without asking for permission in the ToS. If there are OSS licenses that are not compatible with these features, then either the uploader or github was breaking copyright laws already. But I'm not convinced that its anywhere as big deal as the author of the article makes it seem. So github has public code search, which shows 5 line snippets of code with a link back to the repo. Does this satisfy LPPL's "code must be distributed unmodified" rule? Is this enough attribution to satisfy CC-BY? A reasonable person would say yes, because you can just click on the link to get to the whole repo with the full codebase and authors.txt file. But github isn't going to take the legal responsibility of checking each license for these questions, people uploading the code will have to do it themselves. (Also, github has no way of checking that the person uploading the code actually has the right to put the license.txt file on the code).

libertymcateer 10y ago

IAAL as well. I think you've convinced me. I was concerned that the use, performance or display may be a problem... but thinking it through, I do not really see this as an issue with most copyleft licenses. They are usually tied to distribution of code - which is reproduction. I echo your disclaimer. If you need a lawyer, get one.

lukas 10y ago
This is a little off topic but these comments make me wonder: why are lawyers so reluctant to give informal advice? I really appreciate the two thoughtful and informed comments at the top of this article here - why the disclaimers? I look for and give informal advice about all kinds of other topics that have the same levels of ambiguity and sometimes the same levels of importance as legal issues but it's always a real challenge to get a lawyer to weigh in informally on a legal issue. If someone asks me my opinion about an engineering or management issue they're facing, I'll give it to them knowing that I don't know the complete set of facts and they should take my opinion with a grain of salt. I might be missing important context and I might just be wrong. If I ask someone else advice on any topic, I assume that there is an implicit disclaimer. Is there something fundamentally different about the law? Is it because lawyers are in the business of giving advice? Anyway, appreciate you guys weighing in and hope you do it more frequently :).
- xyzzy_plugh 10y ago
  Typically, as licensed members of a regulated profession they could be held liable for any advice they provide.
- teraflop 10y ago
  There are strong legal protections for the attorney-client relationship, such that lawyers are obligated to act scrupulously in their clients' interests. These rules exist for good reason, but a prudent lawyer will want to make it very clear when such a relationship exists and when it doesn't.
  - 10y ago

derefr 10y ago

> it permits reproducing on GitHub only. Any copying from GitHub not granted by way of another license would be a violation of the author's copyright. If you grant Github a right to reproduce your IP, but no further rights, do people have a right to view Github's reproduction of your IP?

dragonwriter 10y ago
Viewing is not a right protected by copyright, so no license is required for that.
- hobarrera 10y ago
  Viewing: Nope. Projecting it on a conference: Depends.

Buttons840 10y ago

> Further, only Github has been given this waiver. Anyone else is still held to any requirement of attribution. This convinced me. I can release my code under GPL, and then sell it to someone else under different terms. It's my code, and I have copyright. I don't have to give the same permissions to everyone. Likewise, just because I give Github certain permissions doesn't mean I have given the same permission to everyone else.

flukus 10y ago
But some projects don't have the copyright of the original author/s, particularly forked ones.
- notzorbo3 10y ago
  Even worse, if you've ever accepted a patch or pull request and didn't get copyright transferred to you, then that code is still owned by the author of the patch, and you'll need their permission too. edit: I don't think forked repos are much of a problem. They're already on Github, so they already accepted the ToS. if they didn't, that's not your problem as a forkee. Unless the code was forked before this new ToS. Copyright is so messy.
vsl 10y ago
That's all fine if your project is a tiny one and you never ever accepted any contribution or used any dependency.

hvis 10y ago

Thanks. Any (informal) opinion on the validity, according to the new ToS, of mirroring third-party F/LOSS projects on GitHub (ones distributed under GPL, MIT or BSD)? Do I need to get the permissions from each author of the work to upload it, above what Free Software licences already allow?

mirabilos 10y ago
As things are right now: yes, especially for GPL works, “probably not” for BSD or MIT works. I _am_ working with them to get it fixed, but they enacted the new terms prematurely, so _currently_ the mess is there.
- hvis 10y ago
  Thanks for working on it.

sparr0 10y ago

> The Github license requires a waiver of the requirement of attribution insofar as such waiver is needed for Github to do what it already does e.g. as the license indicates, provide search results without attribution. The whole problem is that I, as an uploader of code that I did not write, do not have the authority to make that waiver.

Lazare 10y ago
But in that case, you've never been able to upload code to github, right?
- comex 10y ago
  It may be the case that what the license permits (combined with fair use law) is sufficient to allow what GitHub actually, currently does with the code, but not everything their TOS claims the right to do. In particular, "store and display your Content [..] as necessary to render the Website and provide the Service" is rather broad given that the functionality included in the "Service" (defined as "the applications, software, products, and services provided by GitHub") can change at any time, without notice.
- caf 10y ago
  Not necessarily. If the license allows you to redistribute the code, you're just redistributing it to GitHub, and you're OK as far as the software license goes. If GitHub then does things with that code that the license doesn't allow, it was GitHub that is doing something it's not allowed to - unless, as uploader, you've agreed to indemnify GitHub for this sort of thing.
- vsl 10y ago
  Wrong. My OSS project has over 15 years of history, uploaded to GitHub after migration from SF.net. It has third party dependencies that I use under their licenses - which often do require attribution.

gsylvie 10y ago

IANAL. I'm just a random person who studied the book, "Open Source Licensing: Software Freedom and Intellectual Property Law," by Lawrence Rosen. The OP doesn't mention D.4 much. The first paragraph of D.4 seems fine to me. But I worry the "clarification" (2nd paragraph) in D.4 could potentially cause problems: > That means you're giving us the right to do things like reproduce your content (so we can do things like copy it to our database and make backups); display it (so we can do things like show it to you and other users); modify it (so our server can do things like parse it into a search index); distribute it (so we can do things like share it with other users); and perform it (in case your content is something like music or video). Is "modify it" the same as "create derivative works"? If so, seems you've granted Github the right to "modify it" and "distribute it" potentially without any restrictions.

AndyKelley 10y ago

This all sounds reasonable. Meta question here. Is it necessary to say "I am not a lawyer...if you need legal advice, retain a lawyer."? Is that statement really legally protecting you? Is it intended to encourage the reader to take you less seriously? I'm having trouble not seeing this statement as a cargo cult prefix/postfix to commenting on legal issues, and if it's not really necessary, it seems more tasteful to me to leave it out.

tomsmeding 10y ago
He said "IAAL" -- I am a lawyer. Don't know whether that's a typo or not, but it certainly doesn't equal "IANAL" ;)
- deleted 10y ago
  [deleted]

Arizhel 10y ago

>YMMV. If you need legal advice, retain a lawyer. So I need to find a lawyer and pay him $1000+ so I can see if GitHub is safe to use? I guess I'll just stick with storing projects on my computer at home and skip this cloud-based stuff. I can't afford to retain a lawyer and consult with him for everything I do with code online.

andrewstuart2 10y ago
Cloud != SaaS. You can host your own GitLab CE or Gitea on any ol' $5 server and it will easily serve your own needs, plus give you full control.

gyehuda 10y ago

Thanks, I came to a similar conclusion and shared it here (in case anyone wishes to see or comment). I'm not a lawyer, btw. https://www.quora.com/Are-GitHubs-new-terms-of-services-problematic/answer/Gil-Yehuda https://www.quora.com/Are-GitHubs-new-terms-of-services-prob...