5 ms·

Do I have to worry about copyright issues for code posted on Stack Overflow?

48 points by whereistimbo 6y ago

jbob2000 6y ago
Given that most software made today is a conflation of frameworks, libraries, cloud services, and yes, code snippets, it seems really trite to worry about the copyright issues from copy and pasting a couple lines from a publically accessible forum. There’s no way to get a good take on the legality of a large enough codebase, why even bother?
- whereistimbo 6y ago
  From the highlighted answer: > A Short Story To Illustrate: > Someone else decides the code is a good solution for a problem they are facing, and decides to copy it into their open source GnuFizzBuzz project, covered by the GPL. Five years from now, someone is doing an open source audit on your code (maybe you are selling to a nervous customer, or your company is going public). > The open source audit finds the snippet of code you got from Stack Overflow, and recognizes it as originating in GnuFizzBuzz. > You are now stuck explaining how/why you have GPL code mixed into your commercial product, or proving that the code was actually from Stack Overflow. Can you prove that the person posting the code to Stack Overflow owned it to begin with (maybe they actually copied it from GnuFizzBuzz to begin wih).
  - gruez 6y ago
    Isn't that easy to prove with timestamps?
    - TeMPOraL 6y ago
      If T(StackOverflow comment) < T(GPL use) < T(your use), you'll still get in trouble.
      - gruez 6y ago
        Why? Doesn't that prove the copyright belongs to the SO commenter (and therefore permissively licensed), not the GPL author?
        TeMPOraL 6y ago
        But you now have to prove you actually got it from SO, not from the GPL project.
        gruez 6y ago
        Is that actually required, or it the legal team being overly cautious? AFAIK how GPL works is "here's my code. I own the copyright (by default), but I'll license it to you on the condition that you license it back to your users", but if you don't own the copyright to that snippet (as evidenced by someone posting it before you did), then you're not in a position to make demands. It'd be like demanding rent from tenants living in a building that you don't own.
- smarx007 6y ago
  Have you ever participated on an Apache or Eclipse project? Both have a rather robust IP due diligence. Our project scans all (+transitive) Maven deps via https://clearlydefined.io https://clearlydefined.io on every release.
  - jbob2000 6y ago
    This just makes sure you’re using correctly licensed libraries, it’s punishment for honest people. I can circumvent this system by taking the snippet I need or just wholesale copying the library and changing around a few variables.
bergstromm466 6y ago
[removed]
- throwaway2245 6y ago
  In general, the code - as you have written it - is your property, and the smart idea is not. By submitting the code to StackOverflow, you are exercising a right of ownership. According to their terms, you give them irrevocable rights to publish and license the code onwards, etc.
  - jacquesm 6y ago
    The problem is that you may have not had the right to grant that license in the first place.
    - throwaway2245 6y ago
      Agreed.
brown 6y ago
Previous company went through source code audit during acquisition. Auditor inevitably found code from Stack Overflow. Their guidance, which got us a passing grade, was to just include links to the SO answer and link to CC in a nearby comment in the code. This is not legal advice, just sharing our story.
- zvr 6y ago
  That's strange. By including the link you satisfy the "BY" obligation of the license; but what about the "SA" one? Unless your code was being released under an open source license. As parent said, this is not legal advice -- ask someone qualified to answer.
- whereistimbo 6y ago
  I wonder how this applies on proprietary code? Should the attribution be added in documentation or third party notices?
- shishy 6y ago
  Out of curiosity, how does the audit work? Do they have automated tools to check against open source code bases and SO snippets or is it manual? Interesting nonetheless...
  - zvr 6y ago
    Yes, there are a number of tools that analyze source code and compare it with "all known source code on the Internet". They usually produce list of matches. For less-than-complete-file matches, usually human review and decision is needed.
Quarrel 6y ago
The situation is worse than presented. The person posting the code to SO as an answer may not own the copyright to the code they're sharing, despite the SO TOS requiring them to. So even a link to SO isn't a total solution if lawyers are getting involved. All in all in CAN be a shitshow, in practice it mostly works out. This also is largely ignoring what fair use means in different jurisdictions, let alone what licenses work where. Many tech companies operate globally from day one, so all sorts of issues can come up. In reality, ignore almost all of them and solve them if you ever actually start making money.
- lol768 6y ago
  Is there a defence to using the code because you had a good faith belief it was licensed in such a way that would have been fine, if the original author did have the right to grant said license?
  - smarx007 6y ago
    I think it is (sort of) and the best signal may be not a legal analysis alone but the actual shift in the enterprise-backed communities. Ever since https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._International_Business_Machines_Corp https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._Internation.... Eclipse Foundation required what they call "Type B" IP scan for all projects (Eclipse F. is not just an IDE but a competitor to the Apache F.), essentially a deep scan of the code searching for any bits of GPL (our Eclipse project had a dojox dependency flagged because its MIT-licensed code contained a small snippet of GPL, that was the only time we got a rejection of a library). In late 2019, the change was made to make "Type A", a deep scan of the licenses only, to be the default (https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-ip-due-diligence-process https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-...). To me it signals that the common sense in the enterprise community now is that there is not much risk in that scenario, worst case would be that the original IP holder can force you to remove their code if they convince the court the developer had no right to publish it as opposed to getting crazy amounts awarded. I think it is also judged that the likelihood and the amount of trouble are relatively small compared to full code scan of all deps transitively at all times (incl lost productivity).
jacquesm 6y ago
Yes.
- burnthrow 6y ago
  Why is this downvoted? The submission title is idiotic. If a colleague asked me this, I'd want to find another job. It's something somebody fresh out of a "Boot Camp" would ask.
  - NobodyNada 6y ago
    > It's something somebody fresh out of a "Boot Camp" would ask. That’s the idea...the linked post is a part of Stack Exchange’s FAQ library. Perhaps a better title could provide a slightly more useful summary of the content, but HN guidelines discourage editorializing submission titles.
joshuaissac 6y ago
Another factor not addressed by the Stack Exchange answers is that even where the poster had the legal rights to post the code, it may not be under the licence that Stack Overflow says it is. Stack Exchange retroactively "changed" the licence from CC-BY-SA 2.5 to 3.0 in 2011,[1] and from 3.0 to 4.0 in 2018,[2] without getting permission from the people who own the rights. So the code actually remains under the original licence. If the code is used verbatim, it must be released under the same version of the CC-BY-SA licence (unless permitted by the copyright holder), but adapting it would let you put the new work under a later version.[3] But there is also a jurisdiction-dependent question of what constitutes an adaptation, and how much of the larger codebase could be considered an adaptation of the CC'd work (and would therefore be covered by the same licence).[4] 1. https://meta.stackexchange.com/questions/74867/should-stack-exchange-switch-to-cc-by-sa-3-0/95033#95033 https://meta.stackexchange.com/questions/74867/should-stack-... 2. https://meta.stackexchange.com/questions/333089/stack-exchange-and-stack-overflow-have-moved-to-cc-by-sa-4-0/333094#333094 https://meta.stackexchange.com/questions/333089/stack-exchan... 3. https://opensource.stackexchange.com/questions/7430/can-i-upgrade-the-version-of-cc-by-sa-from-3-0-to-4-0-in-my-modification/7431#7431 https://opensource.stackexchange.com/questions/7430/can-i-up... 4. https://wiki.creativecommons.org/index.php?title=ShareAlike_interpretation&oldid=100807#Examples https://wiki.creativecommons.org/index.php?title=ShareAlike_...
- NobodyNada 6y ago
  Note that SE finally backtracked on the 4.0 relicense in March [0], after two years of continuous objections from the community. Now, content posted before the 2018 license change is licensed under CC-BY-SA 3.0, whereas content posted after is licensed under 4.0. You can see the licensing history for a post by clicking the “timeline” icon under the voting arrows. [0]: https://meta.stackexchange.com/q/344491 https://meta.stackexchange.com/q/344491

48 points by whereistimbo 6y ago

jbob2000 6y ago

Given that most software made today is a conflation of frameworks, libraries, cloud services, and yes, code snippets, it seems really trite to worry about the copyright issues from copy and pasting a couple lines from a publically accessible forum. There’s no way to get a good take on the legality of a large enough codebase, why even bother?

whereistimbo 6y ago
From the highlighted answer: > A Short Story To Illustrate: > Someone else decides the code is a good solution for a problem they are facing, and decides to copy it into their open source GnuFizzBuzz project, covered by the GPL. Five years from now, someone is doing an open source audit on your code (maybe you are selling to a nervous customer, or your company is going public). > The open source audit finds the snippet of code you got from Stack Overflow, and recognizes it as originating in GnuFizzBuzz. > You are now stuck explaining how/why you have GPL code mixed into your commercial product, or proving that the code was actually from Stack Overflow. Can you prove that the person posting the code to Stack Overflow owned it to begin with (maybe they actually copied it from GnuFizzBuzz to begin wih).
- gruez 6y ago
  Isn't that easy to prove with timestamps?
  - TeMPOraL 6y ago
    If T(StackOverflow comment) < T(GPL use) < T(your use), you'll still get in trouble.
    - gruez 6y ago
      Why? Doesn't that prove the copyright belongs to the SO commenter (and therefore permissively licensed), not the GPL author?
      - TeMPOraL 6y ago
        But you now have to prove you actually got it from SO, not from the GPL project.
        gruez 6y ago
        Is that actually required, or it the legal team being overly cautious? AFAIK how GPL works is "here's my code. I own the copyright (by default), but I'll license it to you on the condition that you license it back to your users", but if you don't own the copyright to that snippet (as evidenced by someone posting it before you did), then you're not in a position to make demands. It'd be like demanding rent from tenants living in a building that you don't own.
smarx007 6y ago
Have you ever participated on an Apache or Eclipse project? Both have a rather robust IP due diligence. Our project scans all (+transitive) Maven deps via https://clearlydefined.io https://clearlydefined.io on every release.
- jbob2000 6y ago
  This just makes sure you’re using correctly licensed libraries, it’s punishment for honest people. I can circumvent this system by taking the snippet I need or just wholesale copying the library and changing around a few variables.

bergstromm466 6y ago

[removed]

throwaway2245 6y ago
In general, the code - as you have written it - is your property, and the smart idea is not. By submitting the code to StackOverflow, you are exercising a right of ownership. According to their terms, you give them irrevocable rights to publish and license the code onwards, etc.
- jacquesm 6y ago
  The problem is that you may have not had the right to grant that license in the first place.
  - throwaway2245 6y ago
    Agreed.

brown 6y ago

Previous company went through source code audit during acquisition. Auditor inevitably found code from Stack Overflow. Their guidance, which got us a passing grade, was to just include links to the SO answer and link to CC in a nearby comment in the code. This is not legal advice, just sharing our story.

zvr 6y ago
That's strange. By including the link you satisfy the "BY" obligation of the license; but what about the "SA" one? Unless your code was being released under an open source license. As parent said, this is not legal advice -- ask someone qualified to answer.
whereistimbo 6y ago
I wonder how this applies on proprietary code? Should the attribution be added in documentation or third party notices?
shishy 6y ago
Out of curiosity, how does the audit work? Do they have automated tools to check against open source code bases and SO snippets or is it manual? Interesting nonetheless...
- zvr 6y ago
  Yes, there are a number of tools that analyze source code and compare it with "all known source code on the Internet". They usually produce list of matches. For less-than-complete-file matches, usually human review and decision is needed.

Quarrel 6y ago

The situation is worse than presented. The person posting the code to SO as an answer may not own the copyright to the code they're sharing, despite the SO TOS requiring them to. So even a link to SO isn't a total solution if lawyers are getting involved. All in all in CAN be a shitshow, in practice it mostly works out. This also is largely ignoring what fair use means in different jurisdictions, let alone what licenses work where. Many tech companies operate globally from day one, so all sorts of issues can come up. In reality, ignore almost all of them and solve them if you ever actually start making money.

lol768 6y ago
Is there a defence to using the code because you had a good faith belief it was licensed in such a way that would have been fine, if the original author did have the right to grant said license?
- smarx007 6y ago
  I think it is (sort of) and the best signal may be not a legal analysis alone but the actual shift in the enterprise-backed communities. Ever since https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._International_Business_Machines_Corp https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._Internation.... Eclipse Foundation required what they call "Type B" IP scan for all projects (Eclipse F. is not just an IDE but a competitor to the Apache F.), essentially a deep scan of the code searching for any bits of GPL (our Eclipse project had a dojox dependency flagged because its MIT-licensed code contained a small snippet of GPL, that was the only time we got a rejection of a library). In late 2019, the change was made to make "Type A", a deep scan of the licenses only, to be the default (https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-ip-due-diligence-process https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-...). To me it signals that the common sense in the enterprise community now is that there is not much risk in that scenario, worst case would be that the original IP holder can force you to remove their code if they convince the court the developer had no right to publish it as opposed to getting crazy amounts awarded. I think it is also judged that the likelihood and the amount of trouble are relatively small compared to full code scan of all deps transitively at all times (incl lost productivity).

jacquesm 6y ago

Yes.

burnthrow 6y ago
Why is this downvoted? The submission title is idiotic. If a colleague asked me this, I'd want to find another job. It's something somebody fresh out of a "Boot Camp" would ask.
- NobodyNada 6y ago
  > It's something somebody fresh out of a "Boot Camp" would ask. That’s the idea...the linked post is a part of Stack Exchange’s FAQ library. Perhaps a better title could provide a slightly more useful summary of the content, but HN guidelines discourage editorializing submission titles.

joshuaissac 6y ago

Another factor not addressed by the Stack Exchange answers is that even where the poster had the legal rights to post the code, it may not be under the licence that Stack Overflow says it is. Stack Exchange retroactively "changed" the licence from CC-BY-SA 2.5 to 3.0 in 2011,[1] and from 3.0 to 4.0 in 2018,[2] without getting permission from the people who own the rights. So the code actually remains under the original licence. If the code is used verbatim, it must be released under the same version of the CC-BY-SA licence (unless permitted by the copyright holder), but adapting it would let you put the new work under a later version.[3] But there is also a jurisdiction-dependent question of what constitutes an adaptation, and how much of the larger codebase could be considered an adaptation of the CC'd work (and would therefore be covered by the same licence).[4] 1. https://meta.stackexchange.com/questions/74867/should-stack-exchange-switch-to-cc-by-sa-3-0/95033#95033 https://meta.stackexchange.com/questions/74867/should-stack-... 2. https://meta.stackexchange.com/questions/333089/stack-exchange-and-stack-overflow-have-moved-to-cc-by-sa-4-0/333094#333094 https://meta.stackexchange.com/questions/333089/stack-exchan... 3. https://opensource.stackexchange.com/questions/7430/can-i-upgrade-the-version-of-cc-by-sa-from-3-0-to-4-0-in-my-modification/7431#7431 https://opensource.stackexchange.com/questions/7430/can-i-up... 4. https://wiki.creativecommons.org/index.php?title=ShareAlike_interpretation&oldid=100807#Examples https://wiki.creativecommons.org/index.php?title=ShareAlike_...

NobodyNada 6y ago
Note that SE finally backtracked on the 4.0 relicense in March [0], after two years of continuous objections from the community. Now, content posted before the 2018 license change is licensed under CC-BY-SA 3.0, whereas content posted after is licensed under 4.0. You can see the licensing history for a post by clicking the “timeline” icon under the voting arrows. [0]: https://meta.stackexchange.com/q/344491 https://meta.stackexchange.com/q/344491