7 ms·

I just recevied an DMCA takedown from GitHub because upstream is “unopensourced”

146 points by jsiepkes 6y ago

I just received a DMCA takedown request for a GitHub repo of mine because my fork of EdgeFS (I started working on a Illumos / SmartOS port) uses sources of EdgeFS. Apparently Nextenta has (more then 9 months later) has come to the conclusion that they want to "un-opensource" it and want to put the OSS genie back in the bottle. Is this even possible? The most interesting excerpts: -------------8<--------- Please provide a detailed description of the original copyrighted work that has allegedly been infringed. If possible, include a URL to where it is posted online. After DDN’s acquisition of the NexentaEdge source code (as described above), it was renamed “EdgeFS” and was subsequently improperly open sourced under [private] without DDN’s permission. -------------8<--------- Is the work licensed under an open source license? If so, which open source license? Are the allegedly infringing files being used under the open source license, or are they in violation of the license? No. EdgeFS was improperly contributed as open source without the authorization of DataDirect Networks, Inc. or its wholly-owned subsidiary, Nexenta by DDN, Inc., the copyright owners. -------------8<---------

dddw 6y ago
wow, that's just stupid. Buying an opensource product and then trying to un-opensource it. Good look with the troubles, hopefully there is someone here on HN who knows any good legal defense people ( EFF ? )
frantzmiccoli 6y ago
Not a lawyer. Reading the former license would make sense. But I would be very surprised if any mainstream open source license can be revoked. https://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0 was the license of EdgeFS if I believe in Google's cached result. There is no mention of a time limit or withdrawal possibility. Some jurisdictions may restrict my conclusion because they don't allow authors to renounce all their rights - to put something in the public domain for example. But giving an open source license is like selling one, you can not just roll back six years later "please give me this back, I don't want this to have happened" Plus, if EdgeFS has/had external contribution, changing the license of the project without prior allowance from other authors is an infringement of they copyright.
georgyo 6y ago
Not a lawyer but, If it was released under an open source license by people who did not legally have permission to change the license, then yes this is possible. It sucks, and you should likely still challenge it. But they may have the legal high ground. It's like if a stolen painting is given away or sold. The recipient is may have no knowledge the painting is stolen and acting in good faith. But the original owners before it was stolen are still the legal owners.
- mreome 6y ago
  Yeah, not much to go by from the snips, but "After DDN’s acquisition ... subsequently improperly open sourced ... without DDN’s permission" [emphasis added] makes it sound like this is what they are claiming happened. That someone released the source code as open source when they didn't have the copyrights to it anymore. Not knowing all the facts it's hard to say, but there is a possibility they may have the law on their side here. This is kind of an interesting question in open-source. Developers tend to just assume that a license is valid, but that's only true if the license issuer had full copyright of the code to begin with (work-product agreements become a possible source of complication here). There is always a chance that someone could come along later and claim copyright over some/all of that code, which could by then be forked and/or incorporated into various projects.
  - jopsen 6y ago
    Claiming a rouge employee entered agreement/sale/purchase/contract and therefore said agreement is invalid, probably only works in some cases. I'm no lawyer, but I would guess that if senior management of a subdivision is doing something it's hard to claim "rouge employee" :) Otherwise, corporations would break all sorts of contracts claiming they were never valid in the first place.
  - itronitron 6y ago
    >> Developers tend to just assume that a license is valid They also tend to assume that if the license is valid then the code is also not implementing any unlicensed patents.
- deleted 6y ago
jka 6y ago
It appears that Nexenta's edgefs code was open source under an Apache 2.0 license at least as far back as 2020-03-12: https://web.archive.org/web/20200312165928/https://github.com/Nexenta/edgefs https://web.archive.org/web/20200312165928/https://github.co... ... and probably further back too - here's an HN post referencing the licensing from around Q3 2019: https://news.ycombinator.com/item?id=20671417 https://news.ycombinator.com/item?id=20671417 I hadn't heard of DataDirect Networks before; it looks like their acquisition of Nexenta closed in May 2019: https://www.theregister.co.uk/2019/05/07/ddn_is_buying_nexenta/ https://www.theregister.co.uk/2019/05/07/ddn_is_buying_nexen... "Nexenta by DDN will be run as a separate entity, retaining its own sales and engineering teams. The Nexenta sales people now get a wider DDN channel to use and there are cross-selling opportunities for both." As far as I understand -- I'm not a lawyer -- changing a license requires that existing contributors are notified and agree to the change of licensing. https://softwareengineering.stackexchange.com/questions/55326/can-you-change-a-license-once-you-pick-one https://softwareengineering.stackexchange.com/questions/5532...
- pas 6y ago
  > As far as I understand -- I'm not a lawyer -- changing a license requires that existing contributors are notified and agree to the change of licensing. Not the contributors, but the copyright holders. That's why usually projects require a CLA (Contributor License Agreement) to be signed, so they get the copyrights (or they get the rights to relicense the work).
  - jka 6y ago
    Thanks for the clarification, that makes sense.
Communitivity 6y ago
UPDATE: According to the web archive [2], the LICENSE file was committed first 10 months before Mar 12 2020, i.e. sometime in May 2019. That looks a lot like someone wanted to commit it as Open Source just before the acquisition finalized, and may make your battle harder. UPDATE 2: Found possible confirmation unfortunately that EdgeFS was not Open Source before May 2019 (retrieved May 8,2020 [3]): dmitry_yus 3 points·1 year ago Fair points and let me provide some clarifications! :-) Yes, EdgeFS isn't open sourced at the moment but we are moving in direction of opening it up under Apache License. That's our intent and sooner or later this will happen." As always, I am not a lawyer and this doesn't constitute legal advice, and you should see a lawyer for accurate details. That said, if Github tells you when you forked, and you can show their license file at the time was an Open Source license, then you should be able to point that out. Where things get murky and you may be SOL are if any of these are the case: * You Open Sourced it yourself rather than forking via Github * There was no license file * You worked on the project for them as your employer at any point * The fork occurred in May 2019 or afterwards * The project was uploaded to Github, or Open Sourced, in May 2019 or afterwards Fighting a DMCA is an uphill battle, as there is no risk to Github in enforcing it, but a big risk for them in fighting it. They make their money off of commercial users I suspect, so if commercial users stop believing Github will uphold their IPR, then they'll stop paying. If any of the above conditions are true I would expect it to be a steep uphill battle. It may be a steep uphill battle requiring lawyers to fight anyway, since it revolves around IP in an acquisition. What it may come down to is that code Open Sourced before May 2019 is ok, code Open Sourced after that might be under a cloud (and basically means you shouldn't use it unless you're willing to fund a long and painful legal battle). A sad end to one of the flag bearers of the Illumos effort (I believe I remember reading Adam Leventhal of Nexenta on the Developers Council[1]). [1] https://web.archive.org/web/20160710123826/http://wiki.illumos.org/display/illumos/illumos+Developers%27+Council+Meeting%2C+May+16%2C+2012 https://web.archive.org/web/20160710123826/http://wiki.illum... [2] https://web.archive.org/web/20200312165928/https://github.com/Nexenta/edgefs https://web.archive.org/web/20200312165928/https://github.co... [3] https://www.reddit.com/user/dmitry_yus/ https://www.reddit.com/user/dmitry_yus/
- jka 6y ago
  To add to this: If you still have a local check-out of the source repository, do not publish or edit it, but keep a read-only copy of it (including commit history) somewhere safe for evidential purposes if you intend to pursue any legal investigation and recourse. And find a software & intellectual property lawyer if so, too :)
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
greatgib 6y ago
In addition with other comments, you Can look at what are your contributions and code changes. All the parts that are completely reworked by you could be considered as yours. And you can also ask them to ensure that they don't use your own code/modification as a retaliation of the code not being open source.
ballenf 6y ago
> Instead, we will offer the EdgeFS users a royalty-free license for non-commercial uses subject to the terms of our EULA. That line is in the DMCA request. I'd guess the investors were told they were paying for this IP but didn't take fast enough steps to prevent a legitimate officer of the company from open-sourcing it.
- zuzzurro 6y ago
  One year between the acquisition and the take down seems a lot of time. It may seem they were not even trying?
paukiatwee 6y ago
I was researching k8s store offering and found https://rook.io https://rook.io and rook support edgefs with stable status https://github.com/rook/rook#project-status https://github.com/rook/rook#project-status This post make me never use egdefs in any form.
bjoli 6y ago
Adding to other sources I found in a reply to Communitivity: https://twitter.com/nexenta/status/1141728687357857792?s=20 https://twitter.com/nexenta/status/1141728687357857792?s=20 Tweet text : Next week, our CTO and Nexenta Founder @dmitryy will be speaking at #KubeCon 2019 in Shanghai, on NexentaEdge, and the power of open-source projects (@edgeFS and @rook_io !). Get details here: http://ow.ly/SeTD50uJ0yX http://ow.ly/SeTD50uJ0yX

146 points by jsiepkes 6y ago

dddw 6y ago

wow, that's just stupid. Buying an opensource product and then trying to un-opensource it. Good look with the troubles, hopefully there is someone here on HN who knows any good legal defense people ( EFF ? )

frantzmiccoli 6y ago

Not a lawyer. Reading the former license would make sense. But I would be very surprised if any mainstream open source license can be revoked. https://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0 was the license of EdgeFS if I believe in Google's cached result. There is no mention of a time limit or withdrawal possibility. Some jurisdictions may restrict my conclusion because they don't allow authors to renounce all their rights - to put something in the public domain for example. But giving an open source license is like selling one, you can not just roll back six years later "please give me this back, I don't want this to have happened" Plus, if EdgeFS has/had external contribution, changing the license of the project without prior allowance from other authors is an infringement of they copyright.

georgyo 6y ago

Not a lawyer but, If it was released under an open source license by people who did not legally have permission to change the license, then yes this is possible. It sucks, and you should likely still challenge it. But they may have the legal high ground. It's like if a stolen painting is given away or sold. The recipient is may have no knowledge the painting is stolen and acting in good faith. But the original owners before it was stolen are still the legal owners.

mreome 6y ago
Yeah, not much to go by from the snips, but "After DDN’s acquisition ... subsequently improperly open sourced ... without DDN’s permission" [emphasis added] makes it sound like this is what they are claiming happened. That someone released the source code as open source when they didn't have the copyrights to it anymore. Not knowing all the facts it's hard to say, but there is a possibility they may have the law on their side here. This is kind of an interesting question in open-source. Developers tend to just assume that a license is valid, but that's only true if the license issuer had full copyright of the code to begin with (work-product agreements become a possible source of complication here). There is always a chance that someone could come along later and claim copyright over some/all of that code, which could by then be forked and/or incorporated into various projects.
- jopsen 6y ago
  Claiming a rouge employee entered agreement/sale/purchase/contract and therefore said agreement is invalid, probably only works in some cases. I'm no lawyer, but I would guess that if senior management of a subdivision is doing something it's hard to claim "rouge employee" :) Otherwise, corporations would break all sorts of contracts claiming they were never valid in the first place.
- itronitron 6y ago
  >> Developers tend to just assume that a license is valid They also tend to assume that if the license is valid then the code is also not implementing any unlicensed patents.
deleted 6y ago

jka 6y ago

It appears that Nexenta's edgefs code was open source under an Apache 2.0 license at least as far back as 2020-03-12: https://web.archive.org/web/20200312165928/https://github.com/Nexenta/edgefs https://web.archive.org/web/20200312165928/https://github.co... ... and probably further back too - here's an HN post referencing the licensing from around Q3 2019: https://news.ycombinator.com/item?id=20671417 https://news.ycombinator.com/item?id=20671417 I hadn't heard of DataDirect Networks before; it looks like their acquisition of Nexenta closed in May 2019: https://www.theregister.co.uk/2019/05/07/ddn_is_buying_nexenta/ https://www.theregister.co.uk/2019/05/07/ddn_is_buying_nexen... "Nexenta by DDN will be run as a separate entity, retaining its own sales and engineering teams. The Nexenta sales people now get a wider DDN channel to use and there are cross-selling opportunities for both." As far as I understand -- I'm not a lawyer -- changing a license requires that existing contributors are notified and agree to the change of licensing. https://softwareengineering.stackexchange.com/questions/55326/can-you-change-a-license-once-you-pick-one https://softwareengineering.stackexchange.com/questions/5532...

pas 6y ago
> As far as I understand -- I'm not a lawyer -- changing a license requires that existing contributors are notified and agree to the change of licensing. Not the contributors, but the copyright holders. That's why usually projects require a CLA (Contributor License Agreement) to be signed, so they get the copyrights (or they get the rights to relicense the work).
- jka 6y ago
  Thanks for the clarification, that makes sense.

Communitivity 6y ago

UPDATE: According to the web archive [2], the LICENSE file was committed first 10 months before Mar 12 2020, i.e. sometime in May 2019. That looks a lot like someone wanted to commit it as Open Source just before the acquisition finalized, and may make your battle harder. UPDATE 2: Found possible confirmation unfortunately that EdgeFS was not Open Source before May 2019 (retrieved May 8,2020 [3]): dmitry_yus 3 points·1 year ago Fair points and let me provide some clarifications! :-) Yes, EdgeFS isn't open sourced at the moment but we are moving in direction of opening it up under Apache License. That's our intent and sooner or later this will happen." As always, I am not a lawyer and this doesn't constitute legal advice, and you should see a lawyer for accurate details. That said, if Github tells you when you forked, and you can show their license file at the time was an Open Source license, then you should be able to point that out. Where things get murky and you may be SOL are if any of these are the case: * You Open Sourced it yourself rather than forking via Github * There was no license file * You worked on the project for them as your employer at any point * The fork occurred in May 2019 or afterwards * The project was uploaded to Github, or Open Sourced, in May 2019 or afterwards Fighting a DMCA is an uphill battle, as there is no risk to Github in enforcing it, but a big risk for them in fighting it. They make their money off of commercial users I suspect, so if commercial users stop believing Github will uphold their IPR, then they'll stop paying. If any of the above conditions are true I would expect it to be a steep uphill battle. It may be a steep uphill battle requiring lawyers to fight anyway, since it revolves around IP in an acquisition. What it may come down to is that code Open Sourced before May 2019 is ok, code Open Sourced after that might be under a cloud (and basically means you shouldn't use it unless you're willing to fund a long and painful legal battle). A sad end to one of the flag bearers of the Illumos effort (I believe I remember reading Adam Leventhal of Nexenta on the Developers Council[1]). [1] https://web.archive.org/web/20160710123826/http://wiki.illumos.org/display/illumos/illumos+Developers%27+Council+Meeting%2C+May+16%2C+2012 https://web.archive.org/web/20160710123826/http://wiki.illum... [2] https://web.archive.org/web/20200312165928/https://github.com/Nexenta/edgefs https://web.archive.org/web/20200312165928/https://github.co... [3] https://www.reddit.com/user/dmitry_yus/ https://www.reddit.com/user/dmitry_yus/

jka 6y ago
To add to this: If you still have a local check-out of the source repository, do not publish or edit it, but keep a read-only copy of it (including commit history) somewhere safe for evidential purposes if you intend to pursue any legal investigation and recourse. And find a software & intellectual property lawyer if so, too :)

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

greatgib 6y ago

In addition with other comments, you Can look at what are your contributions and code changes. All the parts that are completely reworked by you could be considered as yours. And you can also ask them to ensure that they don't use your own code/modification as a retaliation of the code not being open source.

ballenf 6y ago

> Instead, we will offer the EdgeFS users a royalty-free license for non-commercial uses subject to the terms of our EULA. That line is in the DMCA request. I'd guess the investors were told they were paying for this IP but didn't take fast enough steps to prevent a legitimate officer of the company from open-sourcing it.

zuzzurro 6y ago
One year between the acquisition and the take down seems a lot of time. It may seem they were not even trying?

paukiatwee 6y ago

I was researching k8s store offering and found https://rook.io https://rook.io and rook support edgefs with stable status https://github.com/rook/rook#project-status https://github.com/rook/rook#project-status This post make me never use egdefs in any form.

bjoli 6y ago

Adding to other sources I found in a reply to Communitivity: https://twitter.com/nexenta/status/1141728687357857792?s=20 https://twitter.com/nexenta/status/1141728687357857792?s=20 Tweet text : Next week, our CTO and Nexenta Founder @dmitryy will be speaking at #KubeCon 2019 in Shanghai, on NexentaEdge, and the power of open-source projects (@edgeFS and @rook_io !). Get details here: http://ow.ly/SeTD50uJ0yX http://ow.ly/SeTD50uJ0yX