4 ms·

It's a bit more complex than that. There's the legal concept of apparent authority. Let's say I go into a bank. The bank requires an officer to approve all loa

by wegs 6y ago

It's a bit more complex than that. There's the legal concept of apparent authority. Let's say I go into a bank. The bank requires an officer to approve all loans. A minimum-wage teller offers me a loan with a 2% interest rate, with absolutely no authority to do so. I don't know that, and I come out thinking I have a 2% loan. The bank is generally still required to honor the terms of that loan. https://en.wikipedia.org/wiki/Apparent_authority https://en.wikipedia.org/wiki/Apparent_authority If forensics here prove that the person who open-sourced did not have the authority to do so (but was affiliated with whoever holds copyright on EdgeFS), and that OP had no reasonable way to know they did not have that authority, the most likely outcome is that: * Nextenra could not pull back the license. * Nextenta's recourse would be to go after whatever employee open-sourced it without authority, not OP. This contrasts with an example where an unaffiliated party posted Nextenta's source under an open source license. If you post the Windows source code under the GPL, and you don't work for Microsoft, and I make use of that source code, that's when I'm also liable. I'm not a lawyer. This isn't legal advice, which I couldn't give without knowing specifics of what happened when and how. This is merely a correction to the post which says: "If it was released under an open source license by people who did not legally have permission to change the license, then yes this is possible." This was statement is misleading, at least under US law. I'll also mention you can't get reasonable even legal information without posting a lot more background (two short exerts aren't adequate for anyone to have a legal opinion).

jsiepkes 6y ago
> I'll also mention you can't get reasonable even legal information without posting a lot more background (two short exerts aren't adequate for anyone to have a legal opinion). There isn't that much more to show but here is the entire DMCA takedown request which I received: https://gist.github.com/siepkes/8e1f51e2ce9e44ba7116ed79e49298f4 https://gist.github.com/siepkes/8e1f51e2ce9e44ba7116ed79e492... > If forensics here prove that the person who open-sourced did not have the authority to do so Announcements of the opensourcing were made on various places (like Reddit [1]) by Dmitry Yusupov who is Co-founder and CTO of Nexenta. He also made a lot of commits in the OSS Github repo which was Apache licensed. [1] https://www.reddit.com/r/edgefs/comments/cf0o2b/edgefs_open_sourced/ https://www.reddit.com/r/edgefs/comments/cf0o2b/edgefs_open_...
- wegs 6y ago
  If it were me, I would: 1) Contact the maintainers of the other repositories. 2) Draft a DMCA counter-notice, laying out that: "The repository was open-sourced by Dmitry Yusupov who is co-founder and CTO of Nexenta. This was publicly advertised on multiple public forums, including [], as well as the github repository itself. As a CTO, he had either authority (or, at least, apparent authority) to open-source this tool. This tool continued to be publicly advertised under a [insert license] license by Nextenta for [insert number] months in Nextenta's official github repository. I cloned this tool in full compliance with the license under which Nextenta licensed this tool, and continue to comply with this license. Whereas this license has no expiration clause, Nextenta has no legal grounds under which to withdraw the [insert license] license under which it licensed this code to us. I, and others, have invested significant time, cost, and effort, in reliance on Nextenta's advertising. In addition, Nextenta's business has generated significant value from the goodwill from their announcement of the open-sourcing of EdgeFS. Nextenta has no grounds on which to retroactively withhold continued rights to users who use their code under this license. Shutting down this repository causes ongoing harm to myself and to [others who have signed on] and continue to rely on this repository for [whatever value you derive]. If Nextenta believes its CTO and employees were not authorized to take this action, Nextenta's recourse is to seek damages from those employees. It has no grounds to retroactively deny rights to [list of people]. If it chooses to do so, [standard language about seeking maximum damages, expressly reserving all rights, etc.]" Find legal language online in other such filings, and stitch it together. Try to understand what it says and why. 3) Chip in for a 1-hour consultation with a GOOD lawyer (high per-hour costs, likely, but low time commitment). Have them revise this letter. Good lawyers can do this FAST. Note that you want to have EVERYTHING organized and lined up going into this meeting. The more time you spend beforehand, the less you'll need to pay the lawyer. That's the point of the draft. 4) If you have sufficient funds, have them ship this letter off on their letterhead (looks scarier). Lacking funds, do it yourself (still shows you know your rights). Most companies will back down at this point. However, if they don't, these things can either get super-expensive (if you hire a lawyer) or completely life-consuming (if you decide to handle the legal work yourself). One upside is you do learn /a lot/ in the process either way. Lawyer friends who can help you unofficially are also super-useful. I'll mention that's what I'd do. Most people would back down and get on with their life. Another pressure point are an adversary's customers. Those are often awesome. If customers don't believe a company follows contracts, they're f-ed. Often, this just takes communicating what happened, but sometimes it needs to be adapted to customer culture. But you do need to be careful how you pursue this (again, being careful to stay well within the right side of the law).
mreome 6y ago
According to that article: "There must be some act or some knowing omission on the part of the principal - if the agent alone acts to give the third party this false impression, then the principal is not bound" which makes it seem that it would not just be a matter of the agent's (person who released the code) affiliation with EdgeFS, but also about what knowledge EdgeFS had and what actions (or more importantly lack of action) EdgeFS may have previously taken. The article also indicates "The agent must have been held out by someone with actual authority to carry out the transaction and an agent cannot hold himself out as having authority for this purpose." Which makes it seem that EdgeFS would not be bound to any actions taken by someone who they had never presented as having the authority to take those actions. So, very complex here, and appears that the issue of apparent authority is largely bound to a lot of other factors, not just association or lack thereof.
- wegs 6y ago
  It is complex, and none of us have the background to make this determination without knowing the full background of the case. However, the standard I learned here was pretty low. In my law class, the example of where apparent authority would apply was an employee wearing a UPS company uniform communicating something. An example of where it would not apply was a UPS employee selling obviously-stolen merchandise out of the back of a truck, claiming to do it on behalf of UPS. Given that this was: (a) In an official github repo from the organization (b) The announcement was made by the co-founder and CTO It would need to be a complex set of circumstance for apparent authority to NOT apply. I can come up with such circumstances which might apply, but it would have to be a lot more than just saying they didn't authorize their CTO to do this. If you can't take the statements of a CTO at face-value, the world of business would collapse. (And to re-emphasize: I am not a lawyer. "In my law class" should not convey I went to law school, and taking a couple of law classes does not a lawyer make).
  - mreome 6y ago
    I was commenting based just on the limited info in the snippets posted. If the CTO/organization you noted it the one that owns the rights to the code, then I’d agree that apparent authority does seem to apply here. I had read into "After DDN’s acquisition ... subsequently improperly open sourced ... without DDN’s permission" to mean that the code had been acquired from another entity, but then someone associated with that entity which no longer had any rights to the code released it as open source.
WhyNotHugo 6y ago
This sounds quite accurate. As a company, they open sourced it. If they had a rogue employee open sourcing software without, that's their problem. I'd be a bit more willing to hear them out if they reached out 2-3 days later. But 9 months, and with work having been done based on it, is unacceptable. Plus, you DO have a licence for this code; that's literally written permission to use this code under those terms. I hope it doesn't say anything about revocation though.

by wegs 6y ago

jsiepkes 6y ago

> I'll also mention you can't get reasonable even legal information without posting a lot more background (two short exerts aren't adequate for anyone to have a legal opinion). There isn't that much more to show but here is the entire DMCA takedown request which I received: https://gist.github.com/siepkes/8e1f51e2ce9e44ba7116ed79e49298f4 https://gist.github.com/siepkes/8e1f51e2ce9e44ba7116ed79e492... > If forensics here prove that the person who open-sourced did not have the authority to do so Announcements of the opensourcing were made on various places (like Reddit [1]) by Dmitry Yusupov who is Co-founder and CTO of Nexenta. He also made a lot of commits in the OSS Github repo which was Apache licensed. [1] https://www.reddit.com/r/edgefs/comments/cf0o2b/edgefs_open_sourced/ https://www.reddit.com/r/edgefs/comments/cf0o2b/edgefs_open_...

wegs 6y ago
If it were me, I would: 1) Contact the maintainers of the other repositories. 2) Draft a DMCA counter-notice, laying out that: "The repository was open-sourced by Dmitry Yusupov who is co-founder and CTO of Nexenta. This was publicly advertised on multiple public forums, including [], as well as the github repository itself. As a CTO, he had either authority (or, at least, apparent authority) to open-source this tool. This tool continued to be publicly advertised under a [insert license] license by Nextenta for [insert number] months in Nextenta's official github repository. I cloned this tool in full compliance with the license under which Nextenta licensed this tool, and continue to comply with this license. Whereas this license has no expiration clause, Nextenta has no legal grounds under which to withdraw the [insert license] license under which it licensed this code to us. I, and others, have invested significant time, cost, and effort, in reliance on Nextenta's advertising. In addition, Nextenta's business has generated significant value from the goodwill from their announcement of the open-sourcing of EdgeFS. Nextenta has no grounds on which to retroactively withhold continued rights to users who use their code under this license. Shutting down this repository causes ongoing harm to myself and to [others who have signed on] and continue to rely on this repository for [whatever value you derive]. If Nextenta believes its CTO and employees were not authorized to take this action, Nextenta's recourse is to seek damages from those employees. It has no grounds to retroactively deny rights to [list of people]. If it chooses to do so, [standard language about seeking maximum damages, expressly reserving all rights, etc.]" Find legal language online in other such filings, and stitch it together. Try to understand what it says and why. 3) Chip in for a 1-hour consultation with a GOOD lawyer (high per-hour costs, likely, but low time commitment). Have them revise this letter. Good lawyers can do this FAST. Note that you want to have EVERYTHING organized and lined up going into this meeting. The more time you spend beforehand, the less you'll need to pay the lawyer. That's the point of the draft. 4) If you have sufficient funds, have them ship this letter off on their letterhead (looks scarier). Lacking funds, do it yourself (still shows you know your rights). Most companies will back down at this point. However, if they don't, these things can either get super-expensive (if you hire a lawyer) or completely life-consuming (if you decide to handle the legal work yourself). One upside is you do learn /a lot/ in the process either way. Lawyer friends who can help you unofficially are also super-useful. I'll mention that's what I'd do. Most people would back down and get on with their life. Another pressure point are an adversary's customers. Those are often awesome. If customers don't believe a company follows contracts, they're f-ed. Often, this just takes communicating what happened, but sometimes it needs to be adapted to customer culture. But you do need to be careful how you pursue this (again, being careful to stay well within the right side of the law).

mreome 6y ago

According to that article: "There must be some act or some knowing omission on the part of the principal - if the agent alone acts to give the third party this false impression, then the principal is not bound" which makes it seem that it would not just be a matter of the agent's (person who released the code) affiliation with EdgeFS, but also about what knowledge EdgeFS had and what actions (or more importantly lack of action) EdgeFS may have previously taken. The article also indicates "The agent must have been held out by someone with actual authority to carry out the transaction and an agent cannot hold himself out as having authority for this purpose." Which makes it seem that EdgeFS would not be bound to any actions taken by someone who they had never presented as having the authority to take those actions. So, very complex here, and appears that the issue of apparent authority is largely bound to a lot of other factors, not just association or lack thereof.

wegs 6y ago
It is complex, and none of us have the background to make this determination without knowing the full background of the case. However, the standard I learned here was pretty low. In my law class, the example of where apparent authority would apply was an employee wearing a UPS company uniform communicating something. An example of where it would not apply was a UPS employee selling obviously-stolen merchandise out of the back of a truck, claiming to do it on behalf of UPS. Given that this was: (a) In an official github repo from the organization (b) The announcement was made by the co-founder and CTO It would need to be a complex set of circumstance for apparent authority to NOT apply. I can come up with such circumstances which might apply, but it would have to be a lot more than just saying they didn't authorize their CTO to do this. If you can't take the statements of a CTO at face-value, the world of business would collapse. (And to re-emphasize: I am not a lawyer. "In my law class" should not convey I went to law school, and taking a couple of law classes does not a lawyer make).
- mreome 6y ago
  I was commenting based just on the limited info in the snippets posted. If the CTO/organization you noted it the one that owns the rights to the code, then I’d agree that apparent authority does seem to apply here. I had read into "After DDN’s acquisition ... subsequently improperly open sourced ... without DDN’s permission" to mean that the code had been acquired from another entity, but then someone associated with that entity which no longer had any rights to the code released it as open source.

WhyNotHugo 6y ago

This sounds quite accurate. As a company, they open sourced it. If they had a rogue employee open sourcing software without, that's their problem. I'd be a bit more willing to hear them out if they reached out 2-3 days later. But 9 months, and with work having been done based on it, is unacceptable. Plus, you DO have a licence for this code; that's literally written permission to use this code under those terms. I hope it doesn't say anything about revocation though.