4 ms·

Years ago, I interviewed a candidate for a role on my team. As usual, one of the ways I break the ice with candidates is to get them to talk "war stories". Th

Years ago, I interviewed a candidate for a role on my team. As usual, one of the ways I break the ice with candidates is to get them to talk "war stories". The team he'd worked on had produced a tool that was only ever intended to be used by the team to solve a particular problem they had. It contained proprietary code. Unknown to the team, word had spread about the tool, and others had started to use it, including solutions architects. Who started shipping it to customers to use, who absolutely loved it. That'd be fine except one of the core libraries it used was GPLv3 licensed, and there was non-open source proprietary code used in the tool. The nightmare scenario he found himself in was having to rapidly re-architect the tool around a non-GPLv3 licensed library, without breaking any functionality, all the while having to have regular sync up meetings with a furious CEO and Legal department (who, to be clear, were mad about the situation, not this particular developer or his team, who weren't to blame)

Aachen 5y ago
> having to rapidly re-architect the tool around a non-GPLv3 licensed library ... or just go with it and have it be open source? The old version is already open and free for anyone to request the code of. No rush at that point, you can withhold updates for a little while while you rearchitect this or take the situation as it is and have the next few bugfix releases also fall under GPL until you get around to replacing the core component (iff one insists that the future additions must absolutely be proprietary). Quickly removing the code doesn't change the previously released versions' license.
- Aeolun 5y ago
  It does hopefully prevent any of your customers from ever asking for it.
- alkonaut 5y ago
  > Quickly removing the code doesn't change the previously released versions' license. But would $BIG_CORP publish source on request for a proprietary product just because they built one version with a GPL library by mistake and later fixed it? Has this been successful, ever?
  - Macha 5y ago
    Isn't this how OpenWRT got started?
  - erosenbe0 5y ago
    Depends on the composition of CORP. If it is comprised of developers with strong respect for OSS or FS community they might not stand for non-disclosure. OTOH, plenty of orgs would be mainly folks without a strong opinion either way and would just follow executive direction.
- awwaiid 5y ago
  The license of the previous code didn't magically become the GPL altogether, instead it by default became un-distributable. They were required to (a) stop distribution of the existing code since it at best had no clear license, and (b) if they wanted, going forward remedy the license by clearly making it GPL or doing the rewrite of the dependency. Or even reach out to the library author and ask for an LGPL or other alternative - there is sometimes (often?) some flexibility there. The built-in conflict resolution in the GPL is no-distribution.
- rst 5y ago
  Depends who had rights to the proprietary code. If it was someone else's (for example, if the internal version had used both GPLed code and some proprietary third-party library), open sourcing the whole thing just might not be possible.
- Twirrim 5y ago
  > ... or just go with it and have it be open source? They didn't have the legal right to do so.
  - Aachen 5y ago
    How is that? The company added code to a GPL project, that means it is a derivative work and also comes with software freedoms, or at least that's how the story reads to me since there is no mention of other claims or parties to the mix. That means the company owns the copyright to the added code and is free to comply with the contract (license).
    - cowsandmilk 5y ago
      Company A writes library with commercial license. Company B uses that library and a GPL library in a product. They distribute the product. Company B has no right to relive se Company A’s commercially licensed library under the GPL. Hence, stop distribution and replace GPL library.
      - Aachen 5y ago
        See: > ... since there is no mention of other claims or parties to the mix [like company A]. That means the company [B] owns the copyright to the added code and is free to comply with the contract (license). I'm also not sure whether the confidentiality clause would weigh heavier than a 'must provide source on request' clause, perhaps it could be resolved by not distributing the part that's covered by the confidentiality clause since another standalone library is clearly not a derivative work of the GPL-licensed library. Then only B has to distribute what they made for everyone's benefit.
rusk 5y ago
An app so killer they're willing to rewrite a part of it. Nice problem to have!
duxup 5y ago
I worked in support and came up with a quick script to check for a very specific issue. It was super simple and really just applied to one customer to find one bug they encountered. It really didn't do much more than look through a bunch of counters and a bunch of if statements ... Next thing I knew someone had copied it and started running as a rule on every data set / customer they could get their hands on, and of course it was false positive city. Finally after lots of emails where I would just type "Don't use that script, it doesn't work." some engineer wandered up the stairs to support to talk to me. They were fielding escalation after escalation for these false positives. Support would run the script, see some flags, and turn their brain off and escalate. Management was so scared of this bug / issue that they would do the same. So he tells me to use a trick he used with a similar situation. I announced a new and improved script and management militantly demanded everyone use it, and that all escalation using the 'outdated ' script would be rejected. The new script just identified if it was the right customer for that script and set a bit if it wasn't. If that bit was set the engineer knew immediately they could ignore the output and would say that their analysis didn't find the problem in question and advised some basic troubleshooting next steps (copy and pasted mostly). The support soon realized that just running that script wasn't getting them much more than a few minutes of breathing room away from the case, management realized this too and saw all these next steps coming back and the focus switched to 'hey we should do these next steps all the time too'. That was also one of the ways I started to understand how the engineering team worked and really helped start a good relationship with them.
- SiempreViernes 5y ago
  That was a very valuable anecdote, thank you!
lurkerasdfh8 5y ago
> one of the core libraries it used was GPLv3 licensed it's still untested in the real world if gplv3 "taints" derivative work that broadly. Would they had to open source the entire solution? or just changes made to the library? nobody knows, and there's a lot of FUD to promote BSD licenses instead of sitting down and properly defining the limits in a practical way.

Aachen 5y ago

> having to rapidly re-architect the tool around a non-GPLv3 licensed library ... or just go with it and have it be open source? The old version is already open and free for anyone to request the code of. No rush at that point, you can withhold updates for a little while while you rearchitect this or take the situation as it is and have the next few bugfix releases also fall under GPL until you get around to replacing the core component (iff one insists that the future additions must absolutely be proprietary). Quickly removing the code doesn't change the previously released versions' license.

Aeolun 5y ago
It does hopefully prevent any of your customers from ever asking for it.
alkonaut 5y ago
> Quickly removing the code doesn't change the previously released versions' license. But would $BIG_CORP publish source on request for a proprietary product just because they built one version with a GPL library by mistake and later fixed it? Has this been successful, ever?
- Macha 5y ago
  Isn't this how OpenWRT got started?
- erosenbe0 5y ago
  Depends on the composition of CORP. If it is comprised of developers with strong respect for OSS or FS community they might not stand for non-disclosure. OTOH, plenty of orgs would be mainly folks without a strong opinion either way and would just follow executive direction.
awwaiid 5y ago
The license of the previous code didn't magically become the GPL altogether, instead it by default became un-distributable. They were required to (a) stop distribution of the existing code since it at best had no clear license, and (b) if they wanted, going forward remedy the license by clearly making it GPL or doing the rewrite of the dependency. Or even reach out to the library author and ask for an LGPL or other alternative - there is sometimes (often?) some flexibility there. The built-in conflict resolution in the GPL is no-distribution.
rst 5y ago
Depends who had rights to the proprietary code. If it was someone else's (for example, if the internal version had used both GPLed code and some proprietary third-party library), open sourcing the whole thing just might not be possible.
Twirrim 5y ago
> ... or just go with it and have it be open source? They didn't have the legal right to do so.
- Aachen 5y ago
  How is that? The company added code to a GPL project, that means it is a derivative work and also comes with software freedoms, or at least that's how the story reads to me since there is no mention of other claims or parties to the mix. That means the company owns the copyright to the added code and is free to comply with the contract (license).
  - cowsandmilk 5y ago
    Company A writes library with commercial license. Company B uses that library and a GPL library in a product. They distribute the product. Company B has no right to relive se Company A’s commercially licensed library under the GPL. Hence, stop distribution and replace GPL library.
    - Aachen 5y ago
      See: > ... since there is no mention of other claims or parties to the mix [like company A]. That means the company [B] owns the copyright to the added code and is free to comply with the contract (license). I'm also not sure whether the confidentiality clause would weigh heavier than a 'must provide source on request' clause, perhaps it could be resolved by not distributing the part that's covered by the confidentiality clause since another standalone library is clearly not a derivative work of the GPL-licensed library. Then only B has to distribute what they made for everyone's benefit.

rusk 5y ago

An app so killer they're willing to rewrite a part of it. Nice problem to have!

duxup 5y ago

I worked in support and came up with a quick script to check for a very specific issue. It was super simple and really just applied to one customer to find one bug they encountered. It really didn't do much more than look through a bunch of counters and a bunch of if statements ... Next thing I knew someone had copied it and started running as a rule on every data set / customer they could get their hands on, and of course it was false positive city. Finally after lots of emails where I would just type "Don't use that script, it doesn't work." some engineer wandered up the stairs to support to talk to me. They were fielding escalation after escalation for these false positives. Support would run the script, see some flags, and turn their brain off and escalate. Management was so scared of this bug / issue that they would do the same. So he tells me to use a trick he used with a similar situation. I announced a new and improved script and management militantly demanded everyone use it, and that all escalation using the 'outdated ' script would be rejected. The new script just identified if it was the right customer for that script and set a bit if it wasn't. If that bit was set the engineer knew immediately they could ignore the output and would say that their analysis didn't find the problem in question and advised some basic troubleshooting next steps (copy and pasted mostly). The support soon realized that just running that script wasn't getting them much more than a few minutes of breathing room away from the case, management realized this too and saw all these next steps coming back and the focus switched to 'hey we should do these next steps all the time too'. That was also one of the ways I started to understand how the engineering team worked and really helped start a good relationship with them.

SiempreViernes 5y ago
That was a very valuable anecdote, thank you!

lurkerasdfh8 5y ago

> one of the core libraries it used was GPLv3 licensed it's still untested in the real world if gplv3 "taints" derivative work that broadly. Would they had to open source the entire solution? or just changes made to the library? nobody knows, and there's a lot of FUD to promote BSD licenses instead of sitting down and properly defining the limits in a practical way.