3 ms·

Given that most software made today is a conflation of frameworks, libraries, cloud services, and yes, code snippets, it seems really trite to worry about the c

by jbob2000 6y ago

Given that most software made today is a conflation of frameworks, libraries, cloud services, and yes, code snippets, it seems really trite to worry about the copyright issues from copy and pasting a couple lines from a publically accessible forum. There’s no way to get a good take on the legality of a large enough codebase, why even bother?

whereistimbo 6y ago
From the highlighted answer: > A Short Story To Illustrate: > Someone else decides the code is a good solution for a problem they are facing, and decides to copy it into their open source GnuFizzBuzz project, covered by the GPL. Five years from now, someone is doing an open source audit on your code (maybe you are selling to a nervous customer, or your company is going public). > The open source audit finds the snippet of code you got from Stack Overflow, and recognizes it as originating in GnuFizzBuzz. > You are now stuck explaining how/why you have GPL code mixed into your commercial product, or proving that the code was actually from Stack Overflow. Can you prove that the person posting the code to Stack Overflow owned it to begin with (maybe they actually copied it from GnuFizzBuzz to begin wih).
- gruez 6y ago
  Isn't that easy to prove with timestamps?
  - TeMPOraL 6y ago
    If T(StackOverflow comment) < T(GPL use) < T(your use), you'll still get in trouble.
    - gruez 6y ago
      Why? Doesn't that prove the copyright belongs to the SO commenter (and therefore permissively licensed), not the GPL author?
      - TeMPOraL 6y ago
        But you now have to prove you actually got it from SO, not from the GPL project.
        gruez 6y ago
        Is that actually required, or it the legal team being overly cautious? AFAIK how GPL works is "here's my code. I own the copyright (by default), but I'll license it to you on the condition that you license it back to your users", but if you don't own the copyright to that snippet (as evidenced by someone posting it before you did), then you're not in a position to make demands. It'd be like demanding rent from tenants living in a building that you don't own.
smarx007 6y ago
Have you ever participated on an Apache or Eclipse project? Both have a rather robust IP due diligence. Our project scans all (+transitive) Maven deps via https://clearlydefined.io https://clearlydefined.io on every release.
- jbob2000 6y ago
  This just makes sure you’re using correctly licensed libraries, it’s punishment for honest people. I can circumvent this system by taking the snippet I need or just wholesale copying the library and changing around a few variables.

whereistimbo 6y ago

From the highlighted answer: > A Short Story To Illustrate: > Someone else decides the code is a good solution for a problem they are facing, and decides to copy it into their open source GnuFizzBuzz project, covered by the GPL. Five years from now, someone is doing an open source audit on your code (maybe you are selling to a nervous customer, or your company is going public). > The open source audit finds the snippet of code you got from Stack Overflow, and recognizes it as originating in GnuFizzBuzz. > You are now stuck explaining how/why you have GPL code mixed into your commercial product, or proving that the code was actually from Stack Overflow. Can you prove that the person posting the code to Stack Overflow owned it to begin with (maybe they actually copied it from GnuFizzBuzz to begin wih).

gruez 6y ago
Isn't that easy to prove with timestamps?
- TeMPOraL 6y ago
  If T(StackOverflow comment) < T(GPL use) < T(your use), you'll still get in trouble.
  - gruez 6y ago
    Why? Doesn't that prove the copyright belongs to the SO commenter (and therefore permissively licensed), not the GPL author?
    - TeMPOraL 6y ago
      But you now have to prove you actually got it from SO, not from the GPL project.
      - gruez 6y ago
        Is that actually required, or it the legal team being overly cautious? AFAIK how GPL works is "here's my code. I own the copyright (by default), but I'll license it to you on the condition that you license it back to your users", but if you don't own the copyright to that snippet (as evidenced by someone posting it before you did), then you're not in a position to make demands. It'd be like demanding rent from tenants living in a building that you don't own.

smarx007 6y ago

Have you ever participated on an Apache or Eclipse project? Both have a rather robust IP due diligence. Our project scans all (+transitive) Maven deps via https://clearlydefined.io https://clearlydefined.io on every release.

jbob2000 6y ago
This just makes sure you’re using correctly licensed libraries, it’s punishment for honest people. I can circumvent this system by taking the snippet I need or just wholesale copying the library and changing around a few variables.