3 ms·

With the amount of copy-pasting going on it should be required by any company developers at this point to attach SPDX copyright and licensing statements [0] to

With the amount of copy-pasting going on it should be required by any company developers at this point to attach SPDX copyright and licensing statements [0] to everything that passes through their text editor. I recently watched a talk at FOSDEM about a neat tool called REUSE [1] that will audit your project for these statements and spit out a bill of materials. [0]: https://spdx.org/using-spdx-license-identifier https://spdx.org/using-spdx-license-identifier [1]: https://reuse.software/tutorial/ https://reuse.software/tutorial/

saagarjha 6y ago
> their text editor Good luck getting this to work with every text editor your engineers will use, and not having them revolt because it messes with their workflow…
- cycloptic 6y ago
  It really doesn't mess with any workflow. It's asking them to write the copyright information at the top of the file when they copy something from Github or whatever. The tool can do it in an automated fashion and ensure you do it right before check-in. It's good practice to do this when contributing something upstream too. You'll usually want the engineer to add your company's name and copyright info if they do it on company time. I would actually raise an eyebrow if your engineers were resistant to keeping a written log of copyright information based on workflow grounds. That could indicate that there is a lot more copy-pasting going on that they don't want you to know about — when the code is 100% written by the same team without copy-pasting then there is a lot less question on who owns what. And I don't mean that to discourage teams from reusing open source components, but rather to help them understand that there are associated bookkeeping costs that can potentially be reduced with the right workflow.