16 ms·

Octotree – Proprietary Firefox extension contains AGPL-licensed code

332 points by jhardy54 6y ago

gilrain 6y ago
They have now reverted to AGPL. I'm glad they didn't decide to die on that hill. https://github.com/christianbundy/octotree/issues/1#issuecomment-719998130 https://github.com/christianbundy/octotree/issues/1#issuecom...
- jhardy54 6y ago
  Have they complied with the AGPL though? They're required to share and improvements they made in their closed-source version.
its-summertime 6y ago
https://cdn.discordapp.com/attachments/571775195745091624/772164944489480212/unknown.png https://cdn.discordapp.com/attachments/571775195745091624/77... Mirror of the thread, since the author accidentally used the delete button multiple times https://cdn.discordapp.com/attachments/571775195745091624/772175566510096394/unknown.png https://cdn.discordapp.com/attachments/571775195745091624/77... the last additional comment deleted before locking, link to the mentioned fork https://github.com/zacanger/octotree/ https://github.com/zacanger/octotree/
- jhardy54 6y ago
  Wow, I'm so happy that it was archived before the maintainer went nuclear. https://web.archive.org/web/20201031182128/https://github.com/ovity/octotree/issues/1040 https://web.archive.org/web/20201031182128/https://github.co...
  - ComputerGuru 6y ago
    That’s still after replies were deleted.
    - its-summertime 6y ago
      the deletion notices in my screenshot were from streaming updates, hence why it shows the deletions but also the comments before the deletions. I've been watching the thread since it was posted to HN, and I can say that there is no deleted comments at the time of when that archive was made
      - ComputerGuru 6y ago
        Thanks for clarifying.
- smileybarry 6y ago
  Discord attachments are deleted (almost) immediately from the CDN when you delete the message that included them, so these links aren't very stable. I tried archiving them through Wayback Machine but you can't archive image links, so I uploaded them to Imgur as well. Thread mirror: (contained in the archived GitHub issue) https://i.imgur.com/mo8ZJkd.png https://i.imgur.com/mo8ZJkd.png Last additional comment: (missing from the archive) https://i.imgur.com/Kq2IEfN.png https://i.imgur.com/Kq2IEfN.png
  - eznzt 6y ago
    >Discord attachments are deleted (almost) immediately from the CDN when you delete the message that included them, so these links aren't very stable. That's like saying that imgur images are deleted when you delete them.
    - judge2020 6y ago
      Yes, I think they just mean the images should be available in more places in case the Discord messages are deleted.
    - smileybarry 6y ago
      Right, but when you delete an image from imgur you know the image is going away. Years ago Discord wouldn't delete images uploaded as part of a post, they'd just get garbage-collected at some random future time. (And some would leak indefinitely) Thus, people got used to sharing these around and not caring about the original message. Now it's near-instant as the message delete operation sends a Google Cloud delete API immediately. But people still share these around without knowing that. We don't know where those links originated so it's both a disclaimer and a mirror.
verroq 6y ago
Time for a DMCA take down?
freedomben 6y ago
If the people from Octotree is reading this, I would recommend you address the accusations rather than deleting people's comments and calling them "trolls." Even if you are totally innocent, you've made yourself look like an asshole at best, but really, really guilty at worst with the way you are handling this.
- Latty 6y ago
  Welp, instead they appear to have doubled down: > The old source code in master is no longer under AGPL because it's been the reason of this week's trolling comments "I re-licensed code you wrote without permission because some other people were trolling me." is certainly an interesting admission, even if you take "trolling" at face value, when they appear to use it to mean "calling out our breaking of the license".
  - elmo2you 6y ago
    Can they even pull the AGPL license? The re-licensing of current/new code is one thing, but removing the license on the old code? How is that possible? What about copies elsewhere, are those no longer validly licensed? That's not how I thought licenses work. These guys just appear to go from bad to worse, ignorantly making shit up as they go (on a road to certain self-destruction, if you'd ask me). Also, why don't I hear more people about how GitHub was used to not at all host any code, but instead only as a (marketing) referral point for proprietary stuff somewhere else? I said goodbye to GitHub a while ago, so I wasn't aware this this had become acceptable practice. Anyways, if this was a court case .. this would probably be the point where a judge would look these fellows straight in the eyes and say something along the lines of: "With arrogant behavior you so clearly displayed, you yourselves have squandered any of the sympathy, lenience, and benefit of a doubt I usually give to defendants, and will hereby sentence you to the harshest possible punishment. Not only to give a clear indication that your behavior is in no way acceptable. But also to serve as a reminder for any future parasites, whenever they think of making up their own rules as they see fit". Either way, I think this shit is going to haunt these guys. Unless I got it all completely wrong, probably well deserved too.
Latty 6y ago
Posting that you don't respect the underlying license really is a great way to look guilty as hell: > This is not true. If it was true, just use the code from master and make the "small changes" yourself and stop with the spams, simple, isn't it? Completely ignoring that they are stealing other's contributions that were AGPL licensed to use in their proprietary application. Even worse in the now deleted comment where they pull a "we didn't, but if we had it would have been fine", which is pretty obviously the defence of a guilty party. Edit: Now they are claiming that they paid "most" of the other developers who contributed, further underlining the fact that they don't have the copyright for at least some of those code they are using.
- alpb 6y ago
  Most != all. This is precisely why even if you accept 5 lines of code from someone else (and they're not willing to get compensation from you), you can't change the license of that code. This is what CLAs are for. (IANAL)
  - OJFord 6y ago
    Ahh, is that when you need a CLA - when you want to later change licence? I was wondering about this (unrelatedly) earlier - since it's generally only large companies with a spattering of big non-company-owned projects that want CLAs. Does it matter if the change is to a more or less restrictive licence, or just any change?
    - deleted 6y ago
      [deleted]
    - Arnavion 6y ago
      For most big-company CLAs, when you sign the CLA you either give up copyright of your contribution or you explicitly provide an irrevocable license to the target to use your contribution in any way they want, depending on the precise wording of the CLA. (The latter is more common these days.) In either case, you don't get to complain if your contribution is relicensed later. And no, it doesn't matter what the new license is.
sali0 6y ago
I use Octotree currently, but would like to see some alternatives. Does anyone have any they would recommend?
- shosca 6y ago
  https://github.com/EnixCoda/Gitako https://github.com/EnixCoda/Gitako + https://github.com/sindresorhus/refined-github https://github.com/sindresorhus/refined-github
reanimus 6y ago
How hard would it be to take legal action for this I wonder
- retrac 6y ago
  It's my understanding that software with multiple copyright holders, especially when their work is all mushed together and being derivative of each other's work, is a major headache scenario. There's a reason the FSF requires that contributions to FSF-owned projects include a transfer of copyright.
  - kadoban 6y ago
    I'm not a lawyer. As far as I understand copyright though, any copyright holder, aka any of the contributors, could take action (eg sue or submit a DMCA claim).
    - uberman 6y ago
      Yes, any ONLY them. Assuming they could even find an interested prosecutor/attorney which is rather unlikely.
      - skissane 6y ago
        > Assuming they could even find an interested prosecutor/attorney which is rather unlikely It would be a civil matter, so prosecutors would not be involved. Finding an attorney isn't hard assuming you are willing to pay for one.
        uberman 6y ago
        Absolutely true. But the cost to prosecute an IP related civil case on average with less than $1 million USD at stake is $250k USD. With out the financial / legal support of lets say the FSF are any of the 60 or so 3rd party contributors willing to put up $250k USD to protect their 1 line commits? Are they willing to risk a quarter million in legal fees on the chance that the repo owner proceeds to trial without undoing their one line commits the night before making their claims moot? Without financial/legal support from someone like the FSF, the only way this would proceed is if the aggrieved parties were independently wealthy or could find a lawyer to take the case pro bono.
robertlagrant 6y ago
> Over the years, it has been a waste of time to explain ourselves why we need to charge for our labor. This is the last time I say anything about this. Trolls will be blocked. How badly does someone need to misunderstand a topic to write something like this? No one mentioned charging being bad.
- Latty 6y ago
  The fact they claimed it was a complete rewrite shows they don't misunderstand: they knew they were doing something wrong and tried to hide it, just now they are caught they are just trying to gaslight their way out and claim they are the victim here. I absolutely buy some people were shitty about them deciding to create a commercial product. That in no way justifies stealing from others who contributed to the project, which is the reality here.
  - jhardy54 6y ago
    > I absolutely buy some people were shitty about them deciding to create a commercial product. That in no way justifies stealing from others who contributed to the project, which is the reality here. 100x this. I'm super supportive of them making a living via a commercial product, especially one based on AGPL code. My only frustration is that they're pretending that it isn't AGPL code and refusing to respect the contributors whose code they're using.
    - mehrdadn 6y ago
      > My only frustration is that they're pretending that it isn't AGPL code and refusing to respect the contributors whose code they're using. But what I don't get is: how do you even know this with such confidence? How do you know they don't have some legal agreement with those people? How do you even know they didn't contact those contributors? How do you know the other contributors' contributions weren't trivial enough (for all I know they could've even just been formatting/indentation) and not warranting any action? How do you know the contributors aren't fine with it? And how does everyone somehow know other contributors want them to seek some sort of justice on their behalf?
lxe 6y ago
Looks like the author is upset, but doesn't explain or refute anything. In any case, it seems it's true -- the author should follow the original AGPL terms here, otherwise it's a violation. Well, now what? I bet nothing will happen -- the only way these licensing violations pique the lawyers' interest is when they are perpetrated by a high profile company with some money in the bank.
- mytailorisrich 6y ago
  I don't know the details of this project but if he is the sole author of the software then he owns the full rights over it and can decide to do whatever he wants. Of course a major issue is that such projects often accept submissions from other people, which creates major headaches if a change a license is later sought. Edit: an issue that it is very often not discussed or clear on what basis people can make contributions, and I think that the default position must be that they retain the copyright over their contributions (but is it implied what licensing they are agreeing with?) Edit 2: I understand that he is not the the sole author, but that does not make anything I wrote incorrect or irrelevant. A lot of drama for some reason...
  - jhardy54 6y ago
    > if he is the sole author of the software Absolutely, but he isn't the sole author: https://github.com/ovity/octotree/graphs/contributors https://github.com/ovity/octotree/graphs/contributors I'd imagine that he knows this, which is why he's pretending that the proprietary Octotree is a "complete rewrite".
    - mytailorisrich 6y ago
      Well he does not need a complete rewrite. He needs to remove the contributions of the third parties, which may or may not be substantial. From your link the contributions do not look huge so it seems that removing them is quite doable.
      - jhardy54 6y ago
CharlesW 6y ago
From Christian Bundy: "Since @buunguyen has decided to suppress this conversation via censorship, I thought I'd move the discussion here." https://github.com/christianbundy/octotree/issues/1 https://github.com/christianbundy/octotree/issues/1
ffpip 6y ago
If I remember correctly, their privacy policy was simple. No tracking. Now it has google-analytics, cookies and stuff. https://addons.mozilla.org/en-US/firefox/addon/octotree/privacy/ https://addons.mozilla.org/en-US/firefox/addon/octotree/priv... Can anyone else confirm?
- inshadows 6y ago
  Thanks for the info. The extension is handy, but hardly essential. Removed.
- Karupan 6y ago
  This is bigger than the licensing issue IMO. Thanks for noticing it, I’m uninstalling it right away.
jhardy54 6y ago
This link is less informative now that the maintainer nuked the thread. :/ I've started a new GH discussion here: https://github.com/christianbundy/octotree/issues/1 https://github.com/christianbundy/octotree/issues/1
jlgaddis 6y ago
I particularly like commit c8010802f [0]. Here's a small portion of it: - ## Credits - - Octotree uses the following open-source software: - - - [jQuery](https://github.com/jquery/jquery) - - [jQuery UI](https://github.com/jquery/jquery-ui) - - [jstree](https://github.com/vakata/jstree) - - [file-icons-js](https://github.com/websemantics/file-icons-js) - - [keymaster](https://github.com/madrobby/keymaster) - - [jquery-pjax](https://github.com/defunkt/jquery-pjax) - - [github-dark](https://github.com/StylishThemes/GitHub-Dark) -- [0]: https://github.com/ovity/octotree/commit/c8010802f5f04bd3f52e1aa7662f1a35c3470303#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5 https://github.com/ovity/octotree/commit/c8010802f5f04bd3f52... -- EDIT: Fixed URL.
deleted 6y ago
[deleted]
jgilias 6y ago
Too often people choose licenses for their projects without giving enough thought to potential implications. AGPL and GPLv3 in particular seem to be the kind of licenses you should think really, really hard about before choosing to use them.
- 533474 6y ago
  AGPL and GPL3 do allow for a proprietary alternative that has clearly separated modules that use only the GPL3/AGPL code as binaries. They could have done something similar to the qt licensing scheme. I think the developers who change the licenses of this repo have bad faith and yes, I agree, they deeply misunderstood the licenses or they planned all along to ride the 'free software' banner for adoption to then make money out of it. They could have done it in a more elegant way.
- drran 6y ago
  Yeah, if you wanna to work for free for the richest company(s) in the world, you should use MIT license instead.
  - jgilias 6y ago
    I'm not trying to say that some licenses are better than others. They just have different implications. And I often see that people fail to properly think about those. Yes, MIT implies that anyone can just take your code and run with it. But so can you. APGL on the other hand requires more upfront thought about how you're going to organize the project in general and what you might do with it later on.
    - frankharv 6y ago
      With the MIT license you must still keep the copyright notice in the source files. So no changing the license per say. But no way from a binary to tell if this has been adhered to.
      - loeg 6y ago
laughinghan 6y ago
As someone who has over the years participated in and released many an open source project, and still maintains one, I don't like the framing in some of these HN comments of the Octotree maintainer as The Bad Guy. Obviously, it is unethical and most likely illegal to unilaterally, summarily claim copyright or relicense other people's contributions, and I appreciate the matter-of-fact tone taken by the issue opener and the other commenter. However, I think it's obvious this isn't a scammer using open source as some kind of get-rich-quick scheme, putting in minimal effort into a fake open source project to attract highly valuable contributions in order to relicense them and make money off of other people's hard work. This someone who in all likelihood put blood, sweat, and tears into their project, gave it away for free on GitHub, accepted code contributions from people who in all likelihood were deriving a lot of value from Octotree (or else they wouldn't have had a pet issue they needed fixed in the first place), and has since grown frustrated by the time and effort costs, and the comparatively paltry returns. Is their frustration causing them to lash out in a damaging and unproductive way? Certainly. Is it okay to renege on the implicit agreement with contributors that their contributions be under the terms of the AGPL license, and act as if those contributions were of negligible value? Certainly not. Is the maintainer right in their feeling that the value of those contributions is most likely less than the value given away for free to those contributors? I mean...probably. I must really commend the noncombative, factual tone taken by the issue opener. And I hope the maintainer comes to their senses and deals with this problem the right way, by simply asking people nicely: https://news.ycombinator.com/item?id=24954772 https://news.ycombinator.com/item?id=24954772
- jMyles 6y ago
  I share your view in part, but I think you've ignored the basis for which the maintainer is reasonably understood as a malicious actor: it's not the overreaction, it's the deceit. They said that they had conducted a complete rewrite. There is no reason to do this other than to mislead and create a self-serving false narrative.
  - laughinghan 6y ago
    And what is the malicious act? To get rich off of the highly profitable code in those pull requests? The "deceit" is saying whatever to get people to go away, not to hurt anyone, or to profit off of anyone else's hard work. The right thing to do is just to ask people to assign copyright (see eg https://news.ycombinator.com/item?id=24954772 https://news.ycombinator.com/item?id=24954772 ), but lacking the maturity do what a responsible adult needs to do is just immaturity, not malice.
postit 6y ago
If you are the sole copyright holder, you are not bound by any licensing terms.
- 533474 6y ago
  It is not so simple I'm afraid; he allowed outside contribution from people who thought they were contributing to free software. He deserves the backlash. If he wanted to make money, he could have created a sub-project using octotree binaries and extended modules under new licensing terms.
- jeremyjh 6y ago
  They are not the sole copyright holder, there were many contributions under the AGPL license. Unless there was an explicit copyright assignment signed by each of them then they are also copyright holders and would have to approve any change in license. The other contributors were mentioned in the issue before it was sterilized: https://cdn.discordapp.com/attachments/571775195745091624/772164944489480212/unknown.png https://cdn.discordapp.com/attachments/571775195745091624/77...
- maffydub 6y ago
  As covered elsewhere, they're not the sole copyright holder.
how2draw 6y ago
There is still the last AGPL version. The most effective retaliation is to make a fork that is much, much better than the closed version. Less drama, more work, I know.
- josephcsible 6y ago
  Given the original maintainer's attitude toward copyright, I wouldn't be surprised if he just took the changes anyway, thus putting us back in the same situation we're in now, where only a DMCA takedown will stop him.
  - how2draw 6y ago
    He may do that, but users will use the free version. Since it is free software, many user-friendly changes are possible that tend to conflict with commercial interests. (Indeed, someone already made a post about the author's privacy policy changes, making the commercial software less valuable with zero lines of code.) While the author may make a few bucks, that kind of thing will not pass any due diligence, so his success may be quite limited.
syabro 6y ago
Can someone explain me like I'm five what's going on and where is the problem? Is author using his own old AGPL license version of code or it contains 3rd-party AGPL licensed code?
- anuila 6y ago
  The code allegedly includes third-party code as well as contributions that were initially accepted into AGPL code, which from what I understand are technically owned by the contributor and licensed to use under AGPL. What the guy here did is to disregard all of this and relicense it autonomously.
  - garmaine 6y ago
    You mean “unilaterally.”
julianlam 6y ago
It seems like the problem here stems from the project owner taking the source code as-is and essentially re-licensing it as proprietary, which is a big no-no. For context, when NodeBB faced this possibility, we simply contacted every single contributor and asked nicely if they'd assign over their ownership of their contribution to us (note the use of the word "assign", not "license", a license is revocable, an assignment is not). Future contributions by new parties required signing of the same Contributor Assignment Agreement. Here's the CAA if you're interested in reading legalese: https://cla-assistant.io/NodeBB/NodeBB https://cla-assistant.io/NodeBB/NodeBB All in all it took us under a week to secure the assignments, and any who did not sign we simply rewrote their lines of code, or we would have, but everybody signed. The bar of effort to clear is so low to avoid this kind of controversy! Reason we went this route: we wanted the flexibility to deliver a proprietary version of NodeBB for those clients that needed it. We get asked often whether there's a difference between the proprietary version and the open source version, but there isn't, it's just for legal reasons.
- avmich 6y ago
  > and any who did not sign we simply rewrote their lines of code, or we would have Why wouldn't you rewrite all lines of code instead?
  - gilrain 6y ago
    You seem to be asking "why not do something harder instead of something easier." If that's not what you mean, try rephrasing? If it is what you mean, the answer should be obvious.
    - avmich 6y ago
      No, this is not what I meant. Alternatively, I'd consider full rewrite as potentially an easier action than untangling individual rights. Imagine a person A worked on a project together with persons B, C..., and over time they all have dependence on each other code. If B, C etc. at some moment changed licensing of their code, but person A didn't, 1) A's work will become at least partially meaningless, as it depends on B, C... work 2) B, C... would be in violation of previous agreement with A (as at least some of their code depends on A's code). Even worse, assume A doesn't want to significantly modify the project structure, and starts talking with B, C... asking them not to change the license. While it's formally possible to find last modifier for each line, it doesn't usually make much sense from programming logic point of view. So, NodeBB seem to get quite lucky getting everybody - at least everybody with complex contribution - simultaneously changing their license terms in accord. I'd assume in general it could be easier to rewrite all code.
ltbarcly3 6y ago
Congratulations, if you are reading this you are the 17 billionth person to participate in an open source license drama thread. You win: -- hearing about a project you've never heard of -- reading the same misconceptions about open source which have been repeated for the last 20 years -- reading comments that are way too emotional written by people who have never contributed to open source and only use free software by accident
deleted 6y ago
[deleted]
Tsarbomb 6y ago
As someone who works on open source AGPL'd products it is pretty obvious to me what is going on. He has someone sniffing around to buy the entirety of the intellectual property. He wants to cash out.
stratosgear 6y ago
I already uninstalled Octotree and as mentioned in another comment here, https://github.com/EnixCoda/Gitako https://github.com/EnixCoda/Gitako seems to be doing exactly the same thing. This whole thing left a very sour taste in my mouth...
- agustif 6y ago
  Thanks was looking for this
- lasagnaphil 6y ago
  Wow, the plugin feels way faster than Octotree. Thanks for the suggestion!
mehrdadn 6y ago
I'm confused, is there anyone with a stake/standing in this who is complaining, or did some outsider just come and accuse a random project owner of breaching a contributor's license? If that's the case, this raises two questions: (a) How do they know a priori that the project owner hasn't cleared the license (maybe via a contract that they have no interest in publicly disclosing, or by believing [for whatever reason] they're too minor/fair use), and (b) Why are so many bystanders piling on and stirring up conflict in public trying to cancel this guy? Wouldn't it make sense to just let concerned contributors speak for themselves?
- jhardy54 6y ago
  The context is that someone asked for source and the maintainer lied: https://github.com/ovity/octotree/issues/1038#issuecomment-717571135 https://github.com/ovity/octotree/issues/1038#issuecomment-7... 1. That wasn't what was being challenged. The challenge was whether there was, in fact, a "complete rewrite", since the output files matched the AGPL source 1:1. 2. Do you mean me (Christian Bundy)? I asked a question because I was unhappy seeing the maintainer lie to one of my friends about the "complete rewrite". Lies bad, truth good. The licensing is the reason for the lie, not the reason for the investigation.
  - mehrdadn 6y ago
    First, it's far from clear to me he's lied (which is not equivalent to saying he didn't). So far as I see, it may well have been that (a) he honestly forgot there were some old lines still remaining that they didn't rewrite, (b) or he did know that, but he felt any vestiges of old code were insignificant and not enough to justify changing the sentence. If he rewrote like ~99% of the code, you might disagree about whether the remaining <1% was insignificant or not to justify calling it a "complete" rewrite, but surely you can also understand this might not be an instance of bad faith, but rather an instance of merely having a different threshold for "complete" than you? Second, let's just assume he had bad faith and lied about it being a complete rewrite; I don't know, but for all I know he might have. It's possible he's been trolled a lot by other people recently (sounds like he has, though I haven't checked the history) and he thought lying would get people to stop. Or maybe he's an awful guy. I have no idea. In any case, unless they had a dependency with a viral license, have distributed something based on that dependency, and that dependency's license required them to provide source code with it... they simply don't have any obligation to provide you with any source code, in which case you still wouldn't get anywhere, right? Are there such grounds for you being entitled to the source code at all? If there are, it seems this should be mentioned explicitly in the beginning so he understands he has an actual obligation he's not already fulfilling? > 2. Do you mean me (Christian Bundy)? I asked a question because I was unhappy seeing the maintainer lie to one of my friends about the "complete rewrite". Lies bad, truth good. In (2) you're referring to (b) in my post, right? I actually didn't mean you (I meant everyone else on the internet who just piled onto your post afterward), because I didn't think that's something you had control over, but now I'm seeing you're the one who specifically went out of your say to submit the post on HN too... which is begging for people to pile on and cancel this guy because you (or I guess your friend) didn't get the source code you wanted. All because you (who apparently aren't even the person who was wronged?) are upset because you think he lied to one of your friends, and you think contributors who might be ones to have a stake in this might also be on your side and might want you (whom they don't even know) to seek vigilante justice on their behalf? Isn't this how Twitter justice works...? Do we really need this on HN? Is this kind of public cancellation really making the world a better place?
eecc 6y ago
Original authors have natural non revocable ownership of their intellectual work. Now IANAL, but the original author can always - assuming they didn’t sign away all exploitation rights (because that’s all you can give away) - take their ball and walk away. Anyone is free to continue with the last GPL drop, but from that point on they’re on their own
- gspr 6y ago
  But this software is not just the work of this clown. That's the issue.
deng 6y ago
Contrary to most people here, I don't think the author of Octotree has much to worry about. While there is a long list of contributors to the project, only 10 have contributed 10 lines of code or more. My understanding is that a change consisting of less than 10 lines of code can be seen as trivial and hence does not need a copyright assignment (at least that's how the FSF handles it, and they're pretty strict with this stuff). Of these ten people, six were hired to work on Octotree, so he should have copyright for those. The other four together wrote less than 100 lines of code. If he has removed or rewritten these lines, he should be fine. (Even if he hasn't, I would consider this a very minor violation.)
- gspr 6y ago
  Maybe he could indeed pull off the relicensing for the reasons you suggest. He's still in deep shit: nobody will touch this project with a 3 m pole anymore, and any forks based on the last AGPL version will have a field day of attention. Soon enough, the original project will be irrelevant. Independently of whether he's right or not, this guy just killed his project (or his control of the project).
  - deng 6y ago
    Oh, he handles this situation very poorly, no question about that. That doesn't change the fact that he and his team wrote the vast majority of the original code. The long list of contributors does not reflect that.
    - lasagnaphil 6y ago
      And from the latest comment on this issue (https://github.com/christianbundy/octotree/issues/1#issuecomment-720027778 https://github.com/christianbundy/octotree/issues/1#issuecom...): It seems that the project switched from MIT to AGPL around 2016, so all the contributor commits before that doesn't matter. Excluding those, there's only 10 commits from people outside the team, which frankly isn't a big deal. Anyways, it's frustrating that the author is kinda acting a bit scummy for something that might not have been even a problem. If he was a bit patient and had just got permission from those people beforehand... (I don't really think any of those 10 people would object to it since the commits aren't that big, unless one of them is a free software movement purist perhaps) And people generally agree on Mozilla's "95% author coverage" line so I think this controversy might have been a bit overblown.
deleted 6y ago
[deleted]
darking 6y ago
The git blame loc: for f in $(git ls-files); do git blame --line-porcelain $f | sed -n 's/^author //p'; done | sort | uniq -c | sort -rn 53442 Buu Nguyen 1730 NDQ 102 Phi Nguyen 77 Fahme Bnchi 57 An Le Phu Nguyen 52 Will Simons 30 Jacob Dreesen 18 Danh Nguyen 11 Samvel Abrahamyan 10 Rico 10 duylam 6 Xiao Tan 6 Fiete Börner 5 Steven Noto 4 Ahmed El Sayegh 3 GyuYong Jung 3 Duy Lam 2 Yuichi Tanikawa 2 Andrew Levine 1 Zac Anger 1 Kevin Conaway 1 Ephemera 1 Brightcells This is a witch hunt if you ask me.
nimbius 6y ago
5 hours later buunguyen's absolutely puerile response to the issue is worth considering. Instead of addressing the concern directly he attributes the issue to trolling, locks the issue as spam, and deletes all comments but the initial issue (likely because you cannot delete it) on the grounds that people are "trolling" him for his choice of license. The behavior strongly suggests the code is stolen.
classics2 6y ago
Fruit of the poisoned tree and the toxic entitled people that come with it.
syrrim 6y ago
Poor guy. Must be very hard. Lesson learned regarding source licenses tho: only use copy-left licenses if you don't enjoy getting paid for your work.
- II2II 6y ago
  The lesson learned should be that copyright still applies to copyleft code. If you plan on changing the license, ensure that you have the rights to all of the code that you are changing the license for. People will still complain, but they won't have a leg to stand on. There are also lessons to be learned about conflict resolution, particularly about the consequences of escalating a conflict.
- Cloudef 6y ago
  It's possible to sell software even with copy-left license.
j1elo 6y ago
Tangentially to this, I submitted an Ask HN about enforcing CLAs on a big Open-Source initiative that encompasses a large number of projects, to get some insights about how good or bad are the Harmony CLAs: https://news.ycombinator.com/item?id=24906816 https://news.ycombinator.com/item?id=24906816 Would it be OK to re-submit it?
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
OJFord 6y ago
@sircmpwn Sort of implies [0] he'd need a contributor in order to fund a lawsuit (really puts his money where his mouth is on open source & privacy issues, at least, truly admirable) - but is that actually the case? Doesn't AGPL grant the user (casual observer even?) the right to view the source, not just the contributor to have it be available? (Perhaps he just means that he's supportive but doesn't care enough to pursue it alone - absolutely fair enough if that's the case, not trying to suggest he should do something, just checking my understanding.) [0] - https://github.com/christianbundy/octotree/issues/1#issuecomment-720002351 https://github.com/christianbundy/octotree/issues/1#issuecom...
- csande17 6y ago
  The AGPL says, roughly, that in order to be allowed to use the code you have to give all users the right to see the source. If they refuse to do this, the legal problem is that they're not allowed to use the code anymore -- in other words, they're violating the contributors' copyright. And to sue for copyright infringement, the plaintiff needs to be someone who holds the copyright. That's my non-lawyer understanding of why Drew needs a contributor to start a lawsuit.
  - OJFord 6y ago
    I meant user of the (erroneously) proprietary version - aren't they supposed to receive/be enabled to access the source code for the original work and by extension the derivative (erroneously proprietary) work in their own right?
    - csande17 6y ago
      According to the AGPL, yes! But the only way to enforce the AGPL in a lawsuit is for a contributor to claim their copyright was infringed.
      - OJFord 6y ago
        Ah, I see now, thanks!
Sephr 6y ago
I can't say that this behavior surprises me. The author of this repo has blocked me from using GitHub's native fork functionality because I so much as suggested that I planned to fork Octotree due to the author retroactively making existing features paid.
- Arnavion 6y ago
  Getting blocked from a repo does that too? I figured it just made the repo read-only in terms of PRs and issues.
  - jhardy54 6y ago
    Can confirm, after being blocked from the org I can't fork the project via GitHub.
VoxPelli 6y ago
Yes, AGPL is crazy, never get close to it and if you do, then be prepared to take the consequences. (To be fair though, in this case AGPL and GPL would function the same)
nednar 6y ago
You can relicense your code at any time, but if I have an AGPL licensed copy of your source code of that version I can still share it under that license, right?
gurjeet 6y ago
Obviously, this is a complicated topic but I was wondering about how well are the projects like Postgres protected when people make contributions to them? They don't require any CLA signing etc, and their only defense seems to be "you should have read our policy", which isn't obvious to a casual contributor, or easy to discover (it's mentioned in a policy regarding archival of emails [1]). > Additionally, source code submissions to mailing lists such as pgsql-hackers are considered submissions to the PostgreSQL project, falling under the project's PostgreSQL licence. Please make sure you have permission to share information with these lists before sending your message. Not requiring CLA signing greatly lowers the barrier to contributing. As a conscientious employee I had to get my company's lawyers' permission when one project asked me to sign their CLA-like document. I can only imagine how hard it can get for a prolific contributor, if they also happen to start care about legal issues. [1]: https://www.postgresql.org/about/policies/archives/ https://www.postgresql.org/about/policies/archives/
hamilyon2 6y ago
Someone should fork last aglp licensed code and make a better commercial plugin out of it. And then, if sued, coutersue for breaching agpl.
justinclift 6y ago
Wonder if "fair use" could potentially be applied to the 0.1% of the code the original author didn't create? I mean "fair use" is an acceptable thing (situation dependent) for other copyright things (music, video, books). Wonder if it might be application to software code for some situations?
dang 6y ago
We got a user request to change the URL from https://github.com/ovity/octotree/issues/1040 https://github.com/ovity/octotree/issues/1040, so I've belatedly done so.

332 points by jhardy54 6y ago

They have now reverted to AGPL. I'm glad they didn't decide to die on that hill. https://github.com/christianbundy/octotree/issues/1#issuecomment-719998130 https://github.com/christianbundy/octotree/issues/1#issuecom...

jhardy54 6y ago
Have they complied with the AGPL though? They're required to share and improvements they made in their closed-source version.

its-summertime 6y ago

https://cdn.discordapp.com/attachments/571775195745091624/772164944489480212/unknown.png https://cdn.discordapp.com/attachments/571775195745091624/77... Mirror of the thread, since the author accidentally used the delete button multiple times https://cdn.discordapp.com/attachments/571775195745091624/772175566510096394/unknown.png https://cdn.discordapp.com/attachments/571775195745091624/77... the last additional comment deleted before locking, link to the mentioned fork https://github.com/zacanger/octotree/ https://github.com/zacanger/octotree/

jhardy54 6y ago
Wow, I'm so happy that it was archived before the maintainer went nuclear. https://web.archive.org/web/20201031182128/https://github.com/ovity/octotree/issues/1040 https://web.archive.org/web/20201031182128/https://github.co...
- ComputerGuru 6y ago
  That’s still after replies were deleted.
  - its-summertime 6y ago
    the deletion notices in my screenshot were from streaming updates, hence why it shows the deletions but also the comments before the deletions. I've been watching the thread since it was posted to HN, and I can say that there is no deleted comments at the time of when that archive was made
    - ComputerGuru 6y ago
      Thanks for clarifying.
smileybarry 6y ago
Discord attachments are deleted (almost) immediately from the CDN when you delete the message that included them, so these links aren't very stable. I tried archiving them through Wayback Machine but you can't archive image links, so I uploaded them to Imgur as well. Thread mirror: (contained in the archived GitHub issue) https://i.imgur.com/mo8ZJkd.png https://i.imgur.com/mo8ZJkd.png Last additional comment: (missing from the archive) https://i.imgur.com/Kq2IEfN.png https://i.imgur.com/Kq2IEfN.png
- eznzt 6y ago
  >Discord attachments are deleted (almost) immediately from the CDN when you delete the message that included them, so these links aren't very stable. That's like saying that imgur images are deleted when you delete them.
  - judge2020 6y ago
    Yes, I think they just mean the images should be available in more places in case the Discord messages are deleted.
  - smileybarry 6y ago
    Right, but when you delete an image from imgur you know the image is going away. Years ago Discord wouldn't delete images uploaded as part of a post, they'd just get garbage-collected at some random future time. (And some would leak indefinitely) Thus, people got used to sharing these around and not caring about the original message. Now it's near-instant as the message delete operation sends a Google Cloud delete API immediately. But people still share these around without knowing that. We don't know where those links originated so it's both a disclaimer and a mirror.

verroq 6y ago

Time for a DMCA take down?

freedomben 6y ago

If the people from Octotree is reading this, I would recommend you address the accusations rather than deleting people's comments and calling them "trolls." Even if you are totally innocent, you've made yourself look like an asshole at best, but really, really guilty at worst with the way you are handling this.

Latty 6y ago
Welp, instead they appear to have doubled down: > The old source code in master is no longer under AGPL because it's been the reason of this week's trolling comments "I re-licensed code you wrote without permission because some other people were trolling me." is certainly an interesting admission, even if you take "trolling" at face value, when they appear to use it to mean "calling out our breaking of the license".
- elmo2you 6y ago
  Can they even pull the AGPL license? The re-licensing of current/new code is one thing, but removing the license on the old code? How is that possible? What about copies elsewhere, are those no longer validly licensed? That's not how I thought licenses work. These guys just appear to go from bad to worse, ignorantly making shit up as they go (on a road to certain self-destruction, if you'd ask me). Also, why don't I hear more people about how GitHub was used to not at all host any code, but instead only as a (marketing) referral point for proprietary stuff somewhere else? I said goodbye to GitHub a while ago, so I wasn't aware this this had become acceptable practice. Anyways, if this was a court case .. this would probably be the point where a judge would look these fellows straight in the eyes and say something along the lines of: "With arrogant behavior you so clearly displayed, you yourselves have squandered any of the sympathy, lenience, and benefit of a doubt I usually give to defendants, and will hereby sentence you to the harshest possible punishment. Not only to give a clear indication that your behavior is in no way acceptable. But also to serve as a reminder for any future parasites, whenever they think of making up their own rules as they see fit". Either way, I think this shit is going to haunt these guys. Unless I got it all completely wrong, probably well deserved too.

Latty 6y ago

Posting that you don't respect the underlying license really is a great way to look guilty as hell: > This is not true. If it was true, just use the code from master and make the "small changes" yourself and stop with the spams, simple, isn't it? Completely ignoring that they are stealing other's contributions that were AGPL licensed to use in their proprietary application. Even worse in the now deleted comment where they pull a "we didn't, but if we had it would have been fine", which is pretty obviously the defence of a guilty party. Edit: Now they are claiming that they paid "most" of the other developers who contributed, further underlining the fact that they don't have the copyright for at least some of those code they are using.

alpb 6y ago
Most != all. This is precisely why even if you accept 5 lines of code from someone else (and they're not willing to get compensation from you), you can't change the license of that code. This is what CLAs are for. (IANAL)
- OJFord 6y ago
  Ahh, is that when you need a CLA - when you want to later change licence? I was wondering about this (unrelatedly) earlier - since it's generally only large companies with a spattering of big non-company-owned projects that want CLAs. Does it matter if the change is to a more or less restrictive licence, or just any change?
  - deleted 6y ago
    [deleted]
  - Arnavion 6y ago
    For most big-company CLAs, when you sign the CLA you either give up copyright of your contribution or you explicitly provide an irrevocable license to the target to use your contribution in any way they want, depending on the precise wording of the CLA. (The latter is more common these days.) In either case, you don't get to complain if your contribution is relicensed later. And no, it doesn't matter what the new license is.

sali0 6y ago

I use Octotree currently, but would like to see some alternatives. Does anyone have any they would recommend?

shosca 6y ago
https://github.com/EnixCoda/Gitako https://github.com/EnixCoda/Gitako + https://github.com/sindresorhus/refined-github https://github.com/sindresorhus/refined-github

reanimus 6y ago

How hard would it be to take legal action for this I wonder

retrac 6y ago
It's my understanding that software with multiple copyright holders, especially when their work is all mushed together and being derivative of each other's work, is a major headache scenario. There's a reason the FSF requires that contributions to FSF-owned projects include a transfer of copyright.
- kadoban 6y ago
  I'm not a lawyer. As far as I understand copyright though, any copyright holder, aka any of the contributors, could take action (eg sue or submit a DMCA claim).
  - uberman 6y ago
    Yes, any ONLY them. Assuming they could even find an interested prosecutor/attorney which is rather unlikely.
    - skissane 6y ago
      > Assuming they could even find an interested prosecutor/attorney which is rather unlikely It would be a civil matter, so prosecutors would not be involved. Finding an attorney isn't hard assuming you are willing to pay for one.
      - uberman 6y ago
        Absolutely true. But the cost to prosecute an IP related civil case on average with less than $1 million USD at stake is $250k USD. With out the financial / legal support of lets say the FSF are any of the 60 or so 3rd party contributors willing to put up $250k USD to protect their 1 line commits? Are they willing to risk a quarter million in legal fees on the chance that the repo owner proceeds to trial without undoing their one line commits the night before making their claims moot? Without financial/legal support from someone like the FSF, the only way this would proceed is if the aggrieved parties were independently wealthy or could find a lawyer to take the case pro bono.

robertlagrant 6y ago

> Over the years, it has been a waste of time to explain ourselves why we need to charge for our labor. This is the last time I say anything about this. Trolls will be blocked. How badly does someone need to misunderstand a topic to write something like this? No one mentioned charging being bad.

Latty 6y ago
The fact they claimed it was a complete rewrite shows they don't misunderstand: they knew they were doing something wrong and tried to hide it, just now they are caught they are just trying to gaslight their way out and claim they are the victim here. I absolutely buy some people were shitty about them deciding to create a commercial product. That in no way justifies stealing from others who contributed to the project, which is the reality here.
- jhardy54 6y ago
  > I absolutely buy some people were shitty about them deciding to create a commercial product. That in no way justifies stealing from others who contributed to the project, which is the reality here. 100x this. I'm super supportive of them making a living via a commercial product, especially one based on AGPL code. My only frustration is that they're pretending that it isn't AGPL code and refusing to respect the contributors whose code they're using.
  - mehrdadn 6y ago
    > My only frustration is that they're pretending that it isn't AGPL code and refusing to respect the contributors whose code they're using. But what I don't get is: how do you even know this with such confidence? How do you know they don't have some legal agreement with those people? How do you even know they didn't contact those contributors? How do you know the other contributors' contributions weren't trivial enough (for all I know they could've even just been formatting/indentation) and not warranting any action? How do you know the contributors aren't fine with it? And how does everyone somehow know other contributors want them to seek some sort of justice on their behalf?

lxe 6y ago

Looks like the author is upset, but doesn't explain or refute anything. In any case, it seems it's true -- the author should follow the original AGPL terms here, otherwise it's a violation. Well, now what? I bet nothing will happen -- the only way these licensing violations pique the lawyers' interest is when they are perpetrated by a high profile company with some money in the bank.

mytailorisrich 6y ago
I don't know the details of this project but if he is the sole author of the software then he owns the full rights over it and can decide to do whatever he wants. Of course a major issue is that such projects often accept submissions from other people, which creates major headaches if a change a license is later sought. Edit: an issue that it is very often not discussed or clear on what basis people can make contributions, and I think that the default position must be that they retain the copyright over their contributions (but is it implied what licensing they are agreeing with?) Edit 2: I understand that he is not the the sole author, but that does not make anything I wrote incorrect or irrelevant. A lot of drama for some reason...
- jhardy54 6y ago
  > if he is the sole author of the software Absolutely, but he isn't the sole author: https://github.com/ovity/octotree/graphs/contributors https://github.com/ovity/octotree/graphs/contributors I'd imagine that he knows this, which is why he's pretending that the proprietary Octotree is a "complete rewrite".
  - mytailorisrich 6y ago
    Well he does not need a complete rewrite. He needs to remove the contributions of the third parties, which may or may not be substantial. From your link the contributions do not look huge so it seems that removing them is quite doable.
    - jhardy54 6y ago

CharlesW 6y ago

From Christian Bundy: "Since @buunguyen has decided to suppress this conversation via censorship, I thought I'd move the discussion here." https://github.com/christianbundy/octotree/issues/1 https://github.com/christianbundy/octotree/issues/1

ffpip 6y ago

If I remember correctly, their privacy policy was simple. No tracking. Now it has google-analytics, cookies and stuff. https://addons.mozilla.org/en-US/firefox/addon/octotree/privacy/ https://addons.mozilla.org/en-US/firefox/addon/octotree/priv... Can anyone else confirm?

inshadows 6y ago
Thanks for the info. The extension is handy, but hardly essential. Removed.
Karupan 6y ago
This is bigger than the licensing issue IMO. Thanks for noticing it, I’m uninstalling it right away.

jhardy54 6y ago

This link is less informative now that the maintainer nuked the thread. :/ I've started a new GH discussion here: https://github.com/christianbundy/octotree/issues/1 https://github.com/christianbundy/octotree/issues/1

jlgaddis 6y ago

I particularly like commit c8010802f [0]. Here's a small portion of it: - ## Credits - - Octotree uses the following open-source software: - - - [jQuery](https://github.com/jquery/jquery) - - [jQuery UI](https://github.com/jquery/jquery-ui) - - [jstree](https://github.com/vakata/jstree) - - [file-icons-js](https://github.com/websemantics/file-icons-js) - - [keymaster](https://github.com/madrobby/keymaster) - - [jquery-pjax](https://github.com/defunkt/jquery-pjax) - - [github-dark](https://github.com/StylishThemes/GitHub-Dark) -- [0]: https://github.com/ovity/octotree/commit/c8010802f5f04bd3f52e1aa7662f1a35c3470303#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5 https://github.com/ovity/octotree/commit/c8010802f5f04bd3f52... -- EDIT: Fixed URL.

deleted 6y ago

[deleted]

jgilias 6y ago

Too often people choose licenses for their projects without giving enough thought to potential implications. AGPL and GPLv3 in particular seem to be the kind of licenses you should think really, really hard about before choosing to use them.

533474 6y ago
AGPL and GPL3 do allow for a proprietary alternative that has clearly separated modules that use only the GPL3/AGPL code as binaries. They could have done something similar to the qt licensing scheme. I think the developers who change the licenses of this repo have bad faith and yes, I agree, they deeply misunderstood the licenses or they planned all along to ride the 'free software' banner for adoption to then make money out of it. They could have done it in a more elegant way.
drran 6y ago
Yeah, if you wanna to work for free for the richest company(s) in the world, you should use MIT license instead.
- jgilias 6y ago
  I'm not trying to say that some licenses are better than others. They just have different implications. And I often see that people fail to properly think about those. Yes, MIT implies that anyone can just take your code and run with it. But so can you. APGL on the other hand requires more upfront thought about how you're going to organize the project in general and what you might do with it later on.
  - frankharv 6y ago
    With the MIT license you must still keep the copyright notice in the source files. So no changing the license per say. But no way from a binary to tell if this has been adhered to.
    - loeg 6y ago

laughinghan 6y ago

As someone who has over the years participated in and released many an open source project, and still maintains one, I don't like the framing in some of these HN comments of the Octotree maintainer as The Bad Guy. Obviously, it is unethical and most likely illegal to unilaterally, summarily claim copyright or relicense other people's contributions, and I appreciate the matter-of-fact tone taken by the issue opener and the other commenter. However, I think it's obvious this isn't a scammer using open source as some kind of get-rich-quick scheme, putting in minimal effort into a fake open source project to attract highly valuable contributions in order to relicense them and make money off of other people's hard work. This someone who in all likelihood put blood, sweat, and tears into their project, gave it away for free on GitHub, accepted code contributions from people who in all likelihood were deriving a lot of value from Octotree (or else they wouldn't have had a pet issue they needed fixed in the first place), and has since grown frustrated by the time and effort costs, and the comparatively paltry returns. Is their frustration causing them to lash out in a damaging and unproductive way? Certainly. Is it okay to renege on the implicit agreement with contributors that their contributions be under the terms of the AGPL license, and act as if those contributions were of negligible value? Certainly not. Is the maintainer right in their feeling that the value of those contributions is most likely less than the value given away for free to those contributors? I mean...probably. I must really commend the noncombative, factual tone taken by the issue opener. And I hope the maintainer comes to their senses and deals with this problem the right way, by simply asking people nicely: https://news.ycombinator.com/item?id=24954772 https://news.ycombinator.com/item?id=24954772

jMyles 6y ago
I share your view in part, but I think you've ignored the basis for which the maintainer is reasonably understood as a malicious actor: it's not the overreaction, it's the deceit. They said that they had conducted a complete rewrite. There is no reason to do this other than to mislead and create a self-serving false narrative.
- laughinghan 6y ago
  And what is the malicious act? To get rich off of the highly profitable code in those pull requests? The "deceit" is saying whatever to get people to go away, not to hurt anyone, or to profit off of anyone else's hard work. The right thing to do is just to ask people to assign copyright (see eg https://news.ycombinator.com/item?id=24954772 https://news.ycombinator.com/item?id=24954772 ), but lacking the maturity do what a responsible adult needs to do is just immaturity, not malice.

postit 6y ago

If you are the sole copyright holder, you are not bound by any licensing terms.

533474 6y ago
It is not so simple I'm afraid; he allowed outside contribution from people who thought they were contributing to free software. He deserves the backlash. If he wanted to make money, he could have created a sub-project using octotree binaries and extended modules under new licensing terms.
jeremyjh 6y ago
They are not the sole copyright holder, there were many contributions under the AGPL license. Unless there was an explicit copyright assignment signed by each of them then they are also copyright holders and would have to approve any change in license. The other contributors were mentioned in the issue before it was sterilized: https://cdn.discordapp.com/attachments/571775195745091624/772164944489480212/unknown.png https://cdn.discordapp.com/attachments/571775195745091624/77...
maffydub 6y ago
As covered elsewhere, they're not the sole copyright holder.

how2draw 6y ago

There is still the last AGPL version. The most effective retaliation is to make a fork that is much, much better than the closed version. Less drama, more work, I know.

josephcsible 6y ago
Given the original maintainer's attitude toward copyright, I wouldn't be surprised if he just took the changes anyway, thus putting us back in the same situation we're in now, where only a DMCA takedown will stop him.
- how2draw 6y ago
  He may do that, but users will use the free version. Since it is free software, many user-friendly changes are possible that tend to conflict with commercial interests. (Indeed, someone already made a post about the author's privacy policy changes, making the commercial software less valuable with zero lines of code.) While the author may make a few bucks, that kind of thing will not pass any due diligence, so his success may be quite limited.

syabro 6y ago

Can someone explain me like I'm five what's going on and where is the problem? Is author using his own old AGPL license version of code or it contains 3rd-party AGPL licensed code?

anuila 6y ago
The code allegedly includes third-party code as well as contributions that were initially accepted into AGPL code, which from what I understand are technically owned by the contributor and licensed to use under AGPL. What the guy here did is to disregard all of this and relicense it autonomously.
- garmaine 6y ago
  You mean “unilaterally.”

julianlam 6y ago

It seems like the problem here stems from the project owner taking the source code as-is and essentially re-licensing it as proprietary, which is a big no-no. For context, when NodeBB faced this possibility, we simply contacted every single contributor and asked nicely if they'd assign over their ownership of their contribution to us (note the use of the word "assign", not "license", a license is revocable, an assignment is not). Future contributions by new parties required signing of the same Contributor Assignment Agreement. Here's the CAA if you're interested in reading legalese: https://cla-assistant.io/NodeBB/NodeBB https://cla-assistant.io/NodeBB/NodeBB All in all it took us under a week to secure the assignments, and any who did not sign we simply rewrote their lines of code, or we would have, but everybody signed. The bar of effort to clear is so low to avoid this kind of controversy! Reason we went this route: we wanted the flexibility to deliver a proprietary version of NodeBB for those clients that needed it. We get asked often whether there's a difference between the proprietary version and the open source version, but there isn't, it's just for legal reasons.

avmich 6y ago
> and any who did not sign we simply rewrote their lines of code, or we would have Why wouldn't you rewrite all lines of code instead?
- gilrain 6y ago
  You seem to be asking "why not do something harder instead of something easier." If that's not what you mean, try rephrasing? If it is what you mean, the answer should be obvious.
  - avmich 6y ago
    No, this is not what I meant. Alternatively, I'd consider full rewrite as potentially an easier action than untangling individual rights. Imagine a person A worked on a project together with persons B, C..., and over time they all have dependence on each other code. If B, C etc. at some moment changed licensing of their code, but person A didn't, 1) A's work will become at least partially meaningless, as it depends on B, C... work 2) B, C... would be in violation of previous agreement with A (as at least some of their code depends on A's code). Even worse, assume A doesn't want to significantly modify the project structure, and starts talking with B, C... asking them not to change the license. While it's formally possible to find last modifier for each line, it doesn't usually make much sense from programming logic point of view. So, NodeBB seem to get quite lucky getting everybody - at least everybody with complex contribution - simultaneously changing their license terms in accord. I'd assume in general it could be easier to rewrite all code.

ltbarcly3 6y ago

Congratulations, if you are reading this you are the 17 billionth person to participate in an open source license drama thread. You win: -- hearing about a project you've never heard of -- reading the same misconceptions about open source which have been repeated for the last 20 years -- reading comments that are way too emotional written by people who have never contributed to open source and only use free software by accident

deleted 6y ago

[deleted]

Tsarbomb 6y ago

As someone who works on open source AGPL'd products it is pretty obvious to me what is going on. He has someone sniffing around to buy the entirety of the intellectual property. He wants to cash out.

stratosgear 6y ago

I already uninstalled Octotree and as mentioned in another comment here, https://github.com/EnixCoda/Gitako https://github.com/EnixCoda/Gitako seems to be doing exactly the same thing. This whole thing left a very sour taste in my mouth...

agustif 6y ago
Thanks was looking for this
lasagnaphil 6y ago
Wow, the plugin feels way faster than Octotree. Thanks for the suggestion!

mehrdadn 6y ago

I'm confused, is there anyone with a stake/standing in this who is complaining, or did some outsider just come and accuse a random project owner of breaching a contributor's license? If that's the case, this raises two questions: (a) How do they know a priori that the project owner hasn't cleared the license (maybe via a contract that they have no interest in publicly disclosing, or by believing [for whatever reason] they're too minor/fair use), and (b) Why are so many bystanders piling on and stirring up conflict in public trying to cancel this guy? Wouldn't it make sense to just let concerned contributors speak for themselves?

jhardy54 6y ago
The context is that someone asked for source and the maintainer lied: https://github.com/ovity/octotree/issues/1038#issuecomment-717571135 https://github.com/ovity/octotree/issues/1038#issuecomment-7... 1. That wasn't what was being challenged. The challenge was whether there was, in fact, a "complete rewrite", since the output files matched the AGPL source 1:1. 2. Do you mean me (Christian Bundy)? I asked a question because I was unhappy seeing the maintainer lie to one of my friends about the "complete rewrite". Lies bad, truth good. The licensing is the reason for the lie, not the reason for the investigation.
- mehrdadn 6y ago
  First, it's far from clear to me he's lied (which is not equivalent to saying he didn't). So far as I see, it may well have been that (a) he honestly forgot there were some old lines still remaining that they didn't rewrite, (b) or he did know that, but he felt any vestiges of old code were insignificant and not enough to justify changing the sentence. If he rewrote like ~99% of the code, you might disagree about whether the remaining <1% was insignificant or not to justify calling it a "complete" rewrite, but surely you can also understand this might not be an instance of bad faith, but rather an instance of merely having a different threshold for "complete" than you? Second, let's just assume he had bad faith and lied about it being a complete rewrite; I don't know, but for all I know he might have. It's possible he's been trolled a lot by other people recently (sounds like he has, though I haven't checked the history) and he thought lying would get people to stop. Or maybe he's an awful guy. I have no idea. In any case, unless they had a dependency with a viral license, have distributed something based on that dependency, and that dependency's license required them to provide source code with it... they simply don't have any obligation to provide you with any source code, in which case you still wouldn't get anywhere, right? Are there such grounds for you being entitled to the source code at all? If there are, it seems this should be mentioned explicitly in the beginning so he understands he has an actual obligation he's not already fulfilling? > 2. Do you mean me (Christian Bundy)? I asked a question because I was unhappy seeing the maintainer lie to one of my friends about the "complete rewrite". Lies bad, truth good. In (2) you're referring to (b) in my post, right? I actually didn't mean you (I meant everyone else on the internet who just piled onto your post afterward), because I didn't think that's something you had control over, but now I'm seeing you're the one who specifically went out of your say to submit the post on HN too... which is begging for people to pile on and cancel this guy because you (or I guess your friend) didn't get the source code you wanted. All because you (who apparently aren't even the person who was wronged?) are upset because you think he lied to one of your friends, and you think contributors who might be ones to have a stake in this might also be on your side and might want you (whom they don't even know) to seek vigilante justice on their behalf? Isn't this how Twitter justice works...? Do we really need this on HN? Is this kind of public cancellation really making the world a better place?

eecc 6y ago

Original authors have natural non revocable ownership of their intellectual work. Now IANAL, but the original author can always - assuming they didn’t sign away all exploitation rights (because that’s all you can give away) - take their ball and walk away. Anyone is free to continue with the last GPL drop, but from that point on they’re on their own

gspr 6y ago
But this software is not just the work of this clown. That's the issue.

deng 6y ago

Contrary to most people here, I don't think the author of Octotree has much to worry about. While there is a long list of contributors to the project, only 10 have contributed 10 lines of code or more. My understanding is that a change consisting of less than 10 lines of code can be seen as trivial and hence does not need a copyright assignment (at least that's how the FSF handles it, and they're pretty strict with this stuff). Of these ten people, six were hired to work on Octotree, so he should have copyright for those. The other four together wrote less than 100 lines of code. If he has removed or rewritten these lines, he should be fine. (Even if he hasn't, I would consider this a very minor violation.)

gspr 6y ago
Maybe he could indeed pull off the relicensing for the reasons you suggest. He's still in deep shit: nobody will touch this project with a 3 m pole anymore, and any forks based on the last AGPL version will have a field day of attention. Soon enough, the original project will be irrelevant. Independently of whether he's right or not, this guy just killed his project (or his control of the project).
- deng 6y ago
  Oh, he handles this situation very poorly, no question about that. That doesn't change the fact that he and his team wrote the vast majority of the original code. The long list of contributors does not reflect that.
  - lasagnaphil 6y ago
    And from the latest comment on this issue (https://github.com/christianbundy/octotree/issues/1#issuecomment-720027778 https://github.com/christianbundy/octotree/issues/1#issuecom...): It seems that the project switched from MIT to AGPL around 2016, so all the contributor commits before that doesn't matter. Excluding those, there's only 10 commits from people outside the team, which frankly isn't a big deal. Anyways, it's frustrating that the author is kinda acting a bit scummy for something that might not have been even a problem. If he was a bit patient and had just got permission from those people beforehand... (I don't really think any of those 10 people would object to it since the commits aren't that big, unless one of them is a free software movement purist perhaps) And people generally agree on Mozilla's "95% author coverage" line so I think this controversy might have been a bit overblown.

deleted 6y ago

[deleted]

darking 6y ago

The git blame loc: for f in $(git ls-files); do git blame --line-porcelain $f | sed -n 's/^author //p'; done | sort | uniq -c | sort -rn 53442 Buu Nguyen 1730 NDQ 102 Phi Nguyen 77 Fahme Bnchi 57 An Le Phu Nguyen 52 Will Simons 30 Jacob Dreesen 18 Danh Nguyen 11 Samvel Abrahamyan 10 Rico 10 duylam 6 Xiao Tan 6 Fiete Börner 5 Steven Noto 4 Ahmed El Sayegh 3 GyuYong Jung 3 Duy Lam 2 Yuichi Tanikawa 2 Andrew Levine 1 Zac Anger 1 Kevin Conaway 1 Ephemera 1 Brightcells This is a witch hunt if you ask me.

nimbius 6y ago

5 hours later buunguyen's absolutely puerile response to the issue is worth considering. Instead of addressing the concern directly he attributes the issue to trolling, locks the issue as spam, and deletes all comments but the initial issue (likely because you cannot delete it) on the grounds that people are "trolling" him for his choice of license. The behavior strongly suggests the code is stolen.

classics2 6y ago

Fruit of the poisoned tree and the toxic entitled people that come with it.

syrrim 6y ago

Poor guy. Must be very hard. Lesson learned regarding source licenses tho: only use copy-left licenses if you don't enjoy getting paid for your work.

II2II 6y ago
The lesson learned should be that copyright still applies to copyleft code. If you plan on changing the license, ensure that you have the rights to all of the code that you are changing the license for. People will still complain, but they won't have a leg to stand on. There are also lessons to be learned about conflict resolution, particularly about the consequences of escalating a conflict.
Cloudef 6y ago
It's possible to sell software even with copy-left license.

j1elo 6y ago

Tangentially to this, I submitted an Ask HN about enforcing CLAs on a big Open-Source initiative that encompasses a large number of projects, to get some insights about how good or bad are the Harmony CLAs: https://news.ycombinator.com/item?id=24906816 https://news.ycombinator.com/item?id=24906816 Would it be OK to re-submit it?

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

OJFord 6y ago

@sircmpwn Sort of implies [0] he'd need a contributor in order to fund a lawsuit (really puts his money where his mouth is on open source & privacy issues, at least, truly admirable) - but is that actually the case? Doesn't AGPL grant the user (casual observer even?) the right to view the source, not just the contributor to have it be available? (Perhaps he just means that he's supportive but doesn't care enough to pursue it alone - absolutely fair enough if that's the case, not trying to suggest he should do something, just checking my understanding.) [0] - https://github.com/christianbundy/octotree/issues/1#issuecomment-720002351 https://github.com/christianbundy/octotree/issues/1#issuecom...

csande17 6y ago
The AGPL says, roughly, that in order to be allowed to use the code you have to give all users the right to see the source. If they refuse to do this, the legal problem is that they're not allowed to use the code anymore -- in other words, they're violating the contributors' copyright. And to sue for copyright infringement, the plaintiff needs to be someone who holds the copyright. That's my non-lawyer understanding of why Drew needs a contributor to start a lawsuit.
- OJFord 6y ago
  I meant user of the (erroneously) proprietary version - aren't they supposed to receive/be enabled to access the source code for the original work and by extension the derivative (erroneously proprietary) work in their own right?
  - csande17 6y ago
    According to the AGPL, yes! But the only way to enforce the AGPL in a lawsuit is for a contributor to claim their copyright was infringed.
    - OJFord 6y ago
      Ah, I see now, thanks!

Sephr 6y ago

I can't say that this behavior surprises me. The author of this repo has blocked me from using GitHub's native fork functionality because I so much as suggested that I planned to fork Octotree due to the author retroactively making existing features paid.

Arnavion 6y ago
Getting blocked from a repo does that too? I figured it just made the repo read-only in terms of PRs and issues.
- jhardy54 6y ago
  Can confirm, after being blocked from the org I can't fork the project via GitHub.

VoxPelli 6y ago

Yes, AGPL is crazy, never get close to it and if you do, then be prepared to take the consequences. (To be fair though, in this case AGPL and GPL would function the same)

nednar 6y ago

You can relicense your code at any time, but if I have an AGPL licensed copy of your source code of that version I can still share it under that license, right?

gurjeet 6y ago

Obviously, this is a complicated topic but I was wondering about how well are the projects like Postgres protected when people make contributions to them? They don't require any CLA signing etc, and their only defense seems to be "you should have read our policy", which isn't obvious to a casual contributor, or easy to discover (it's mentioned in a policy regarding archival of emails [1]). > Additionally, source code submissions to mailing lists such as pgsql-hackers are considered submissions to the PostgreSQL project, falling under the project's PostgreSQL licence. Please make sure you have permission to share information with these lists before sending your message. Not requiring CLA signing greatly lowers the barrier to contributing. As a conscientious employee I had to get my company's lawyers' permission when one project asked me to sign their CLA-like document. I can only imagine how hard it can get for a prolific contributor, if they also happen to start care about legal issues. [1]: https://www.postgresql.org/about/policies/archives/ https://www.postgresql.org/about/policies/archives/

hamilyon2 6y ago

Someone should fork last aglp licensed code and make a better commercial plugin out of it. And then, if sued, coutersue for breaching agpl.

justinclift 6y ago

Wonder if "fair use" could potentially be applied to the 0.1% of the code the original author didn't create? I mean "fair use" is an acceptable thing (situation dependent) for other copyright things (music, video, books). Wonder if it might be application to software code for some situations?

dang 6y ago

We got a user request to change the URL from https://github.com/ovity/octotree/issues/1040 https://github.com/ovity/octotree/issues/1040, so I've belatedly done so.