4 ms·
The situation is worse than presented. The person posting the code to SO as an answer may not own the copyright to the code they're sharing, despite the SO TOS
by Quarrel 6y ago
The situation is worse than presented.
The person posting the code to SO as an answer may not own the copyright to the code they're sharing, despite the SO TOS requiring them to. So even a link to SO isn't a total solution if lawyers are getting involved.
All in all in CAN be a shitshow, in practice it mostly works out.
This also is largely ignoring what fair use means in different jurisdictions, let alone what licenses work where. Many tech companies operate globally from day one, so all sorts of issues can come up. In reality, ignore almost all of them and solve them if you ever actually start making money.
- lol768 6y agoIs there a defence to using the code because you had a good faith belief it was licensed in such a way that would have been fine, if the original author did have the right to grant said license?
- smarx007 6y agoI think it is (sort of) and the best signal may be not a legal analysis alone but the actual shift in the enterprise-backed communities. Ever since https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._International_Business_Machines_Corp https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._Internation.... Eclipse Foundation required what they call "Type B" IP scan for all projects (Eclipse F. is not just an IDE but a competitor to the Apache F.), essentially a deep scan of the code searching for any bits of GPL (our Eclipse project had a dojox dependency flagged because its MIT-licensed code contained a small snippet of GPL, that was the only time we got a rejection of a library). In late 2019, the change was made to make "Type A", a deep scan of the licenses only, to be the default (https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-ip-due-diligence-process https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-...). To me it signals that the common sense in the enterprise community now is that there is not much risk in that scenario, worst case would be that the original IP holder can force you to remove their code if they convince the court the developer had no right to publish it as opposed to getting crazy amounts awarded. I think it is also judged that the likelihood and the amount of trouble are relatively small compared to full code scan of all deps transitively at all times (incl lost productivity).
- Quarrel 6y agoSort of. Blatant infringement is typically punished worse by judges / legislation. You still can be fined, have injunctions bought against products etc without it being wilful. There have been a bunch of song examples of this, where someone alleges a small riff is taken unknowingly or not from another song, and the songwriter losing all royalties to the song.
- mytailorisrich 6y ago[deleted]
- resoluteteeth 6y ago> That's exactly the example in the SO answer: someone posts a code snippet that they copy-pasted from a GPL'd OSS project. You use that snippet in your closed-source commercial software. Audit detects GPL'd code in your code base. No it's not. The example in the SO answer is that the SO snippet is copied both into your software and a GPL'd open-source project.
- mytailorisrich 6y agoThanks, deleted. Although it must be said that the scenario whereby someone posts a code snippet for which they do not own the copyright, perhaps indeed because they copy-pasted it from an OSS project, is an obvious one and less sneaky than the example.
- Quarrel 6y agoI think the other obvious worry is that people post well meaning answers on the job, but it turns out that their contract says their employer owns the copyright to all code they write on the job. They have no ownership over the copyright to give.