3 ms·

Aside from understanding the license, you have to remember to look for the license. For example, Stack Overflow content is very nonintuitively licensed CC-BY-S

by wrs 7y ago

Aside from understanding the license, you have to remember to look for the license. For example, Stack Overflow content is very nonintuitively licensed CC-BY-SA, so if you copy and paste code from Stack Overflow (who doesn't?) it's essentially the same as including GPL code. Apparently there was a movement to MIT-license the code (as opposed to the textual content) that failed for some reason, so this is now a ticking time bomb. (And if you try to sell your company, the acquirer will find that code in diligence.) Even worse, ruby-forum.com is CC-BY-NC-SA, so you can't use code from there for commercial purposes in the first place, never mind the copyleft aspect.

cycloptic 7y ago
With the amount of copy-pasting going on it should be required by any company developers at this point to attach SPDX copyright and licensing statements [0] to everything that passes through their text editor. I recently watched a talk at FOSDEM about a neat tool called REUSE [1] that will audit your project for these statements and spit out a bill of materials. [0]: https://spdx.org/using-spdx-license-identifier https://spdx.org/using-spdx-license-identifier [1]: https://reuse.software/tutorial/ https://reuse.software/tutorial/
- saagarjha 7y ago
  > their text editor Good luck getting this to work with every text editor your engineers will use, and not having them revolt because it messes with their workflow…
  - cycloptic 7y ago
    It really doesn't mess with any workflow. It's asking them to write the copyright information at the top of the file when they copy something from Github or whatever. The tool can do it in an automated fashion and ensure you do it right before check-in. It's good practice to do this when contributing something upstream too. You'll usually want the engineer to add your company's name and copyright info if they do it on company time. I would actually raise an eyebrow if your engineers were resistant to keeping a written log of copyright information based on workflow grounds. That could indicate that there is a lot more copy-pasting going on that they don't want you to know about — when the code is 100% written by the same team without copy-pasting then there is a lot less question on who owns what. And I don't mean that to discourage teams from reusing open source components, but rather to help them understand that there are associated bookkeeping costs that can potentially be reduced with the right workflow.
ReactiveJelly 7y ago
> so if you copy and paste code from Stack Overflow (who doesn't?) it's essentially the same as including GPL code. Oops... What do I do about this? Describe the 5 or 10 lines of code to another programmer and have them write a re-implementation of it?
- wrs 7y ago
  I think that’s the easiest way, to basically translate it to pseudocode and back. Kind of a micro-cleanroom approach.
gregmac 7y ago
Worse is certain code audits will find code that matches, and you have to sit in hours of discussions explaining why no in fact, that's not a copy, it's just basically the only way to escape quotes or call that library function or iterate all lines in a text file. Even worse is if the developer included a comment linking to the Stack Overflow answer as a citation, which makes it look like copy and paste (maybe it even was), yet still is the code anyone would write independently.

by wrs 7y ago

cycloptic 7y ago

With the amount of copy-pasting going on it should be required by any company developers at this point to attach SPDX copyright and licensing statements [0] to everything that passes through their text editor. I recently watched a talk at FOSDEM about a neat tool called REUSE [1] that will audit your project for these statements and spit out a bill of materials. [0]: https://spdx.org/using-spdx-license-identifier https://spdx.org/using-spdx-license-identifier [1]: https://reuse.software/tutorial/ https://reuse.software/tutorial/

saagarjha 7y ago
> their text editor Good luck getting this to work with every text editor your engineers will use, and not having them revolt because it messes with their workflow…
- cycloptic 7y ago
  It really doesn't mess with any workflow. It's asking them to write the copyright information at the top of the file when they copy something from Github or whatever. The tool can do it in an automated fashion and ensure you do it right before check-in. It's good practice to do this when contributing something upstream too. You'll usually want the engineer to add your company's name and copyright info if they do it on company time. I would actually raise an eyebrow if your engineers were resistant to keeping a written log of copyright information based on workflow grounds. That could indicate that there is a lot more copy-pasting going on that they don't want you to know about — when the code is 100% written by the same team without copy-pasting then there is a lot less question on who owns what. And I don't mean that to discourage teams from reusing open source components, but rather to help them understand that there are associated bookkeeping costs that can potentially be reduced with the right workflow.

ReactiveJelly 7y ago

> so if you copy and paste code from Stack Overflow (who doesn't?) it's essentially the same as including GPL code. Oops... What do I do about this? Describe the 5 or 10 lines of code to another programmer and have them write a re-implementation of it?

wrs 7y ago
I think that’s the easiest way, to basically translate it to pseudocode and back. Kind of a micro-cleanroom approach.

gregmac 7y ago

Worse is certain code audits will find code that matches, and you have to sit in hours of discussions explaining why no in fact, that's not a copy, it's just basically the only way to escape quotes or call that library function or iterate all lines in a text file. Even worse is if the developer included a comment linking to the Stack Overflow answer as a citation, which makes it look like copy and paste (maybe it even was), yet still is the code anyone would write independently.