3 ms·

Not to be rude (not a fan of Facebook), but what exactly are you alleging by them drawing strong inspiration from your code? You repository does not seem that p

by belval 6y ago

Not to be rude (not a fan of Facebook), but what exactly are you alleging by them drawing strong inspiration from your code? You repository does not seem that popular and I see little actual code overlap between the two. I would assume that the dev simply had a similar idea and put it on GitHub actions before you did? Edit: Actually looking at your repo it hasn't seen any update since 2019, GitHub actions were released about a month later. Why did you expect this developer to hold off from publishing if you hadn't done it already?

johannes1234321 6y ago
The article states that Facebook was using the author's implementation at first and only then created their own solution under the same name.
- belval 6y ago
  Look we can argue about it all we want, but this is a 3-files <1000 LOC project which they seem to have rewritten internally. I am not saying that this is a nice move but I fail to see what FB should have done differently here? Register their new actions under a new name even though the original project maintainer was not actually using the name on the marketplace?
  - that_guy_iain 6y ago
    > I am not saying that this is a nice move but I fail to see what FB should have done differently here? Use a different name than the project you're taking inspiration from. I would have thought that was open source 101.
    - belval 6y ago
      I am the maintainer of a library called "pdf2image" on GitHub, I've been maintaining it for well over 3 years now. At some point in the past a few other projects with the same name appeared for different languages. I didn't go on a long rant on HN about how other people where taking my "IP" because it's a generic name. On top of that, GitHub Actions have been up since November 2019 and as such, OP had around 11 months to register his project. The name being generic it's only expected that someone ended up taking it. Now the only thing that makes people all up in arms is that FB is the employer of the dev that did this. Since we all hate Facebook, we support the underdog in this. Repost the exact same post while removing the name of the company and it would not even be close to trending.
      - dilyevsky 6y ago
        Good for you then. Perhaps original author was using it as their portfolio project and now has to explain that no he didn’t steal it from fb - they did. Don’t assume what works for you is acceptable to everyone.
        belval 6y ago
        Except the FB project is a complete rewrite, done by one of their employee. There is no "stealing" here. You wouldn't tell someone who wrote a link bit.ly clone that he "stole" the idea from the original website. Even if they had copy and pasted OP's code (which they didn't), it's MIT-licensed and only minimal restrictions apply. There are things that are wrong with how these big corporation operate, but this is not one of them. This is more akin to a small shop called "Play Store" not registering a domain name and then making a post on HN when Google registers it for Android.
        dilyevsky 6y ago
        Yes it is more of “Abibas” knockoffs you can by somewhere in asia/middle east except you know that fact that it’s trillion dollar corporation doing it
        mafuy 6y ago
        You have to differentiate between a rewrite with vs without looking at the original. A clean room rewrite is generally accepted (i.e. derive spec from original, then have the spec implemented by someone who does not know the original). Looking at the source while writing some kind of copy of it is a violation (legal and ethical). As per the thread there, the FB person did indeed see the original.
        belval 6y ago
        In this case the code is licensed under MIT so I really fail to see what you mean by a legal or moral violation. There is a subset of the open source community that seems to default to the MIT license and then act surprised when their project is used in a way that is not what they had in mind.
    - edoceo 6y ago
      I mean, label-actions-ng is open so is ya-label-actions
      - warkdarrior 6y ago
        I'd suggest label-actions-OG
- NathanKP 6y ago
  Any large company is going to frown heavily on using references to some sketchy third party dev's repo. Large companies don't like that and it rightfully raises all kinds of appsec concerns because @dessant could easily change their Github Action to do something malicious. Here's how I'd guess this entire process went: 1. FB appsec: "wtf are you doing referencing this guy's Github Action in our codebase? We don't own that and if he chooses to change something we get hacked" 2. FB employee: "okay fine I'll fix it" 3. FB employee: creates official version for FB to use, that can't be mutated outside of FB oversight
  - jen20 6y ago
    If this was how things went down, it was a terrible implementation of a fix - you'd expect it to be under a Facebook namespace rather than the employee's personal account - if the employee leaves, they instantly become a "sketchy third party dev".
    - baby 6y ago
      That’s a problem for facebook though
    - afro88 6y ago
      You'd also expect them to simply fork it and maintain that fork, selectively pulling in changes.
  - baby 6y ago
    Yup, this dependency seemed like a pretty big risk
Master_Odin 6y ago
Yeah, the author had plenty of time to convert their GH app to a GH action, and given their comment about how they rely on it for monetization, one would think the author is incentivized to do just that

by belval 6y ago

johannes1234321 6y ago

The article states that Facebook was using the author's implementation at first and only then created their own solution under the same name.

belval 6y ago
Look we can argue about it all we want, but this is a 3-files <1000 LOC project which they seem to have rewritten internally. I am not saying that this is a nice move but I fail to see what FB should have done differently here? Register their new actions under a new name even though the original project maintainer was not actually using the name on the marketplace?
- that_guy_iain 6y ago
  > I am not saying that this is a nice move but I fail to see what FB should have done differently here? Use a different name than the project you're taking inspiration from. I would have thought that was open source 101.
  - belval 6y ago
    I am the maintainer of a library called "pdf2image" on GitHub, I've been maintaining it for well over 3 years now. At some point in the past a few other projects with the same name appeared for different languages. I didn't go on a long rant on HN about how other people where taking my "IP" because it's a generic name. On top of that, GitHub Actions have been up since November 2019 and as such, OP had around 11 months to register his project. The name being generic it's only expected that someone ended up taking it. Now the only thing that makes people all up in arms is that FB is the employer of the dev that did this. Since we all hate Facebook, we support the underdog in this. Repost the exact same post while removing the name of the company and it would not even be close to trending.
    - dilyevsky 6y ago
      Good for you then. Perhaps original author was using it as their portfolio project and now has to explain that no he didn’t steal it from fb - they did. Don’t assume what works for you is acceptable to everyone.
      - belval 6y ago
        Except the FB project is a complete rewrite, done by one of their employee. There is no "stealing" here. You wouldn't tell someone who wrote a link bit.ly clone that he "stole" the idea from the original website. Even if they had copy and pasted OP's code (which they didn't), it's MIT-licensed and only minimal restrictions apply. There are things that are wrong with how these big corporation operate, but this is not one of them. This is more akin to a small shop called "Play Store" not registering a domain name and then making a post on HN when Google registers it for Android.
        dilyevsky 6y ago
        Yes it is more of “Abibas” knockoffs you can by somewhere in asia/middle east except you know that fact that it’s trillion dollar corporation doing it
        mafuy 6y ago
        You have to differentiate between a rewrite with vs without looking at the original. A clean room rewrite is generally accepted (i.e. derive spec from original, then have the spec implemented by someone who does not know the original). Looking at the source while writing some kind of copy of it is a violation (legal and ethical). As per the thread there, the FB person did indeed see the original.
        belval 6y ago
        In this case the code is licensed under MIT so I really fail to see what you mean by a legal or moral violation. There is a subset of the open source community that seems to default to the MIT license and then act surprised when their project is used in a way that is not what they had in mind.
  - edoceo 6y ago
    I mean, label-actions-ng is open so is ya-label-actions
    - warkdarrior 6y ago
      I'd suggest label-actions-OG
NathanKP 6y ago
Any large company is going to frown heavily on using references to some sketchy third party dev's repo. Large companies don't like that and it rightfully raises all kinds of appsec concerns because @dessant could easily change their Github Action to do something malicious. Here's how I'd guess this entire process went: 1. FB appsec: "wtf are you doing referencing this guy's Github Action in our codebase? We don't own that and if he chooses to change something we get hacked" 2. FB employee: "okay fine I'll fix it" 3. FB employee: creates official version for FB to use, that can't be mutated outside of FB oversight
- jen20 6y ago
  If this was how things went down, it was a terrible implementation of a fix - you'd expect it to be under a Facebook namespace rather than the employee's personal account - if the employee leaves, they instantly become a "sketchy third party dev".
  - baby 6y ago
    That’s a problem for facebook though
  - afro88 6y ago
    You'd also expect them to simply fork it and maintain that fork, selectively pulling in changes.
- baby 6y ago
  Yup, this dependency seemed like a pretty big risk

Master_Odin 6y ago

Yeah, the author had plenty of time to convert their GH app to a GH action, and given their comment about how they rely on it for monetization, one would think the author is incentivized to do just that