18 ms·

Project includes a dependancy that has a license that forbids its use

213 points by withinboredom 5y ago

philipswood 5y ago
Quite an unusual, but effective, way to mark something as a proof of concept that's dangerous to use: From [1]: "This is as unsafe as it sounds and I don't recommend anyone do it outside of a testing environment." [1]: https://github.com/bouk/monkey#i-thought-that-monkeypatching-in-go-is-impossible https://github.com/bouk/monkey#i-thought-that-monkeypatching...
- wereHamster 5y ago
  > … I don't recommend anyone do it outside of a testing environment. … which is exactly dow it is used in dapr > This is only used in the test (and thus not.compiled and distributed in our binaries). (source: https://github.com/dapr/dapr/issues/3563#issuecomment-901563861 https://github.com/dapr/dapr/issues/3563#issuecomment-901563...)
  - mcguire 5y ago
    There's a teeny bit of a difference between using it to explore monkey patching a go executable and using in the test suite of a released project.
  - reificator 5y ago
    > > … I don't recommend anyone do it outside of a testing environment. > … which is exactly dow it is used in dapr Eh... There's a difference between "a testing environment" as used in that quote and "as part of an automated test" as you mean here. To me the former implies an experimental and/or ad-hoc environment, while the latter implies a stable, production environment.
- Fuzzeh 5y ago
  You don't have the right to use it, even in a testing environment. The license denys you the right to use it.
  - philipswood 5y ago
    Yes, but at the same time demonstrates the code clearly so you could implement it yourself. I'd say this is code sharing aiming at zero reuse.
Y_Y 5y ago
So there is no grant of copyright to distribute copies of the dependency, but what about useyright? The dependant project just uses the the dependency to run a test. Supposing it didn't distribute it as part of the release, is that still allowable?
- boomboomsubban 5y ago
  The conflicting license states >I do not give anyone permissions to use this tool for any purpose. Don't use it. So no use rights either.
  - TheCoelacanth 5y ago
    Copyright does not give authority over use, only over redistribution.
  - Y_Y 5y ago
    But the granting of rights to redistribute is governed by the applicable copyright law, as far as I know there is no equivalent body of law governing usage. You can't give someone information but attach conditions to its use, except in specific circumstances. You can certainly make someone sign a contract before agreeing to give them the information, but that's not what's occurring here.
    - JackFr 5y ago
      IANAL but these specific circumstances of ‘use’ typically include copyrighted music and drama, which cannot be performed in a public or commercial setting without permission or compensation. The Beatles may own Yesterday but they can’t stop me from whistling it. Where I think this case gets murky is that the item in question is not distributed or used by users of the software, but is part of the production process for it.
    - boomboomsubban 5y ago
      >You can't give someone information but attach conditions to its use, except in specific circumstances. Wouldn't that effectively bar the use of DRM? If I buy a blu-ray, I can't legally watch it unless I have a player capable of unlocking the content. That may be one of the "specific circumstances," as there is a law that specifically forbids bypassing DRM.
semitones 5y ago
License reads: > "Copyright Bouke van der Bijl I do not give anyone permissions to use this tool for any purpose. Don't use it. I’m not interested in changing this license. Please don’t ask. " Used by counter on GitHub is at 464. The way it's worded would imply that they are all violating the license? How can this be enforced for inconsequential small pet projects? Is this really something to worry about, particularly with what (seems to me) to be a sort-of spurious license?
- oaiey 5y ago
  Yes. You take something you do not own (even down the tree). You have to check if you are allowed to. It does not matter if it is a small pet project or the Linux Kernel. Sure you can ignore him and wait for him to lawyer up and make your life miserable. Considering that IT specialists which have capacity to contribute to open source are typically not poor or have idealogical interests, I would not take the bets. Respect the wishes of the people you take code from. License checking is like code coverage. If you are a professional you take care of it.
  - concordDance 5y ago
    > You have to check if you are allowed to. It does not matter if it is a small pet project or the Linux Kernel. Actually it does matter and you don't have to. In practice pet projects are basically never going to be sued, it's simply not worth it. As a side note, a lot of techy people struggle to separate the law as written with the law as practiced. The ethics question is more interesting, but for something like this which is clearly satirical? No harm, no foul.
    - oaiey 5y ago
      The "pet project" was the dependency in my example which license would be violated. The contextual author does not care for sure. But generally it is an ethical problem like you said but also a practical one. Once you stack enough pet (or should I say lpad) projects together something bigger comes out. And the liability is hidden three layers down the dependency tree.
hypertele-Xii 5y ago
GitHub terms of service [1]: "If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking)." I think these override it? [1] https://docs.github.com/en/github/site-policy/github-terms-of-service#5-license-grant-to-other-users https://docs.github.com/en/github/site-policy/github-terms-o...
- oaiey 5y ago
  No it does not. This statement is exclusively for the fact that GitHub and a reader is not liable for showing/reading your copyrighted code. The only weak spot is GitHub Actions/Code spaces/etc for dev tools I guess. Because that falls under "GitHub service" and is a functionality of it.
  - bscphil 5y ago
    No, this would also seem to protect users who click the "fork" button on Github. It would not, however, allow them to clone the software to their local computer or use it for any other purpose.
    - SeanLuke 5y ago
      The Github terms do not indicate that the license is transferable. Github can display the code, but even if someone downloads from Github, they still can't use it.
gpm 5y ago
I am not a lawyer... There may be an argument here that 1. GitHub has a valid license to distribute it (as a result of their TOS) 2. Running the downloaded code is not copyright infringement (or not obviously so, and hasn't been established as so in any court that I am aware of) 3. Using the APIs is not copyright infringement (see Oracle v Google, if that was fair use this almost certainly is) Thus no copyright infringement has occurred. Still, keeping this in the codebase is at best boobytrapping your code to create accidental future instances of copyright infringement, and it's an interesting case of people not checking licenses (since it's pretty clear they didn't realize this in advance).
- HomeDeLaPot 5y ago
  I think GitHub gives you the right to download or fork the repo, but the license explicitly states that you can't use the code. That might mean running it on its own is technically illegal. The license literally says "you can't use this". How are so many people confused about the license in this thread?
  - gpm 5y ago
    > That might mean running it on its own is technically illegal. Based on what law/authority? Copyright law forbids making copies, derivative works, etc. Not using things. You're allowed to read a book without a license. Moreover copyright law makes an explicit exception for the copies required to run a computer program on a machine that aren't used in other ways (i.e. copying it to ram/registers): https://www.law.cornell.edu/uscode/text/17/117 https://www.law.cornell.edu/uscode/text/17/117 The author may say "you can't use this", but it is not clear to me that he has any legal authority to do so.
    - inopinatus 5y ago
      Quite so. As written, it's a null statement. To be enforceable, a license has to be written by one party such that another party may acquire rights in exchange for accepting the terms. This is how licenses become contracts. Simply reading the words "Don't use it" does not bind you, because there is no grant of use; there is no offer or exchange of value, so no contract has been formed, and the statement is at best advisory. It is equal to writing "All rights reserved", which is to say, you retain whatever rights pre-existed under statutory and common law, such as right of fair use and so forth, and anything due to Github's ToS. Engineers often fall into the trap of thinking the law is a programming language. It isn't, mercifully.
gpas 5y ago
From the explaining blog post [0] > If you’re not interested in how it works and you just want to do monkey patching, then you can find the library here. Also > Wrapping it up in a nice library > I took the above code and put it in an easy to use library. It supports 32 bit, reversing patches, and patching instance methods. I wrote a couple of examples and put those in the README. Then in the README[1]: > Make sure you read the notes at the bottom of the README if you intend to use this library. Either the author is confused or has decided that he doesn't want to maintain an hack. Anyway license is pretty clear. There was an HN thread[2] when it was released. [0] https://bou.ke/blog/monkey-patching-in-go/ https://bou.ke/blog/monkey-patching-in-go/ [1] https://github.com/bouk/monkey https://github.com/bouk/monkey [2] https://news.ycombinator.com/item?id=9290917 https://news.ycombinator.com/item?id=9290917
- bouk 5y ago
  It's satirical
  - eurasiantiger 5y ago
    Have you checked how many projects depend on Monkey? It seems the blog post has been translated and reposted many times. Satire does not translate well.
  - gpas 5y ago
    It crossed my mind... Thanks for chiming in and clear the misunderstanding.
  - nextaccountic 5y ago
    It seems that you're not interested in suing anyone over this. However, you still don't give people permission to use, not even in small throwaway tests. Which is fair. But your blog post[0] language suggests that you are okay with and even incentivizes people trying this out (even if trying it out might be technically illegal, because it infringes your rights). I think you should have mentioned something about the license in your blog post. As it stands, "If you’re not interested in how it works and you just want to do monkey patching, then you can find the library here." is misleading. If the user wants to do monkey patching, they better not look at your code and program their own solution. [0] https://bou.ke/blog/monkey-patching-in-go/ https://bou.ke/blog/monkey-patching-in-go/
somehnacct3757 5y ago
No problem, just start typing code like it and let Github Copilot handle the rest
- CyberRabbi 5y ago
  Even better, Fairuseify[1] will repackage a fair-use version of the library for you automatically. [1]: https://fairuseify.ml/ https://fairuseify.ml/
  - still_grokking 5y ago
    Ingenious! It only needs some build-in YouTube and Getty-Images browser to select fairuseify targets. (It should work for all kind of media, of course). I think we've solved the copyright issue right now finally for good, didn't we?
bouk 5y ago
I love that all the discussion here is about the license I wrote and not about the actual project, which is a completely terrible idea and something I created as a lark. Why did I not spell this out in the blog post? For my own amusement. I also think it shows that licenses really don't matter all that much as some people think, they are not computer code.
- zdw 5y ago
  I've considered making a license that is basically MIT/BSD, but requires that anyone using an automated license checking/compliance system (any corporate users) to pay a fee to use the software.
  - josephcsible 5y ago
    Instead of doing that, why not dual-license your program under CC-BY-NC and AGPLv3, and then sell exceptions?
    - nzmsv 5y ago
      A lot of legal departments have a mental image of AGPL (and GPL) as a bogeyman that will steal all the company's code if allowed anywhere near the building. I've sat through a presentation one time that tried to paint these licenses as something only basement dwellers use for personal projects. I spoke to the presenter afterwards and told them about projects like Linux and Mongo, and how even AGPL is not as scary as they thought. The lawyer seemed genuinely surprised and said they would read up on it. I'm pretty sure my bringing this up in a friendly manner caused them to question their assumptions. Had I picked a fight during the presentation I'd just be labeled a basement dweller. However, this lawyer also told me something interesting. To some extent it doesn't matter whether I was able to change his mind. As long as other lawyers in the field have this bogeyman concept in mind, the use of GPL will get flagged in due diligence, etc. and it's easier to simply not use a component with strong copyleft when developing a product (unless it's as irreplaceable as Linux). This is a long-winded way of saying that selling exceptions will likely scare off potential purchasers long before they are in a position to consider the purchase. Most shops have a blanket "no GPL ever" policy and a dev won't even bother with the component even for a prototype.
foreigner 5y ago
This is just mean! The documentation definitely reads like the library is meant for use, but the author forbids all use in the license.
- elric 5y ago
  Why is it mean? The author can use whatever license they like. If you don't like it, you're more than welcome to release your own code under a more permissive license.
  - Macha 5y ago
    It's misleading to present the project as being for use by others and then forbid any use in the legal print?
    - Thiez 5y ago
      Is it misleading to present a project as free and then have the (A)GPL license? Here I thought it was free, now suddenly there are all these conditions... The "legal print" in this case is five lines long, written in (contrary to most licenses) very plain english, located in the root of the repository, in a file named 'LICENSE.md'. It's not exactly hidden where a reasonable person might overlook it. "We didn't know" isn't a very convincing defense.
      - DangitBobby 5y ago
        Yes. It is misleading to advertise software as Free and Open when it's actually Copy Left.
      - Macha 5y ago
        Normally such fact is advertised in the readme, and the github sidebar will recognise and display the title of such a license in the sidebar. It's commonly understood that open source software may be copyleft. I think not mentioning a license that says "No use permitted" amongst some instructions on how to use it is deceptive. > "We didn't know" isn't a very convincing defense. Good thing "mean", is a matter of subjective perception and not of law, then. Or do you suggest everything legal is automatically good?
wheybags 5y ago
Side note, but for all the people saying this is absolutely godawful and the license is OK because no one in their right mind would use it in production, this project from MS does basically the same thing: https://www.microsoft.com/en-us/research/project/detours/ https://www.microsoft.com/en-us/research/project/detours/ Recently open sourced, but has been used for twenty years in real products from MS and others. It's not so crazy as you might think! An example of a real use I had for it: redirecting messages from OutputDebugString to a log file. AFAIK that is the best way to do it, when you only want the output from your one process. "Why not just call a proper logging function directly instead?" Because the OutputDebugString calls were coming from inside my GPU driver. Real life is not some ivory tower of perfection. An imperfect world requires imperfect solutions.
- woodruffw 5y ago
  The key difference being that Detours is a library written by Microsoft engineers with access to the Win32 team and the ability (if not drive) to ensure that Detours functions correctly as changes are made. Those changes are also probably pretty rare, given Win32’s famously stable ABI. This library patches a third party runtime, one that explicitly forbids this kind of instrumentation and has a famously unstable ABI. You can do whatever you want to get your job done, and this is certainly one way to do it, but it’s absolutely a dangerous hack.
- tptacek 5y ago
  I've done a lot of work with Detours and have written my own trampoline injection thingies in Python and Ruby, and this approach is not really a reasonable way to build production software. A proof-of-concept Detours implementation posted as an illustration for an amusing blog post may be the most perfect possible use case for a "you are not allowed to use this for anything" license, maybe rivaled only by the code you post for a cipher you designed yourself.
- reificator 5y ago
  To anyone else confused as I was, "this project from MS does basically the same thing" is referring to monkeypatching a running executable, not having a license that forbids use of the software.
avodonosov 5y ago
Is the "I do not give anyone permissions to use this tool for any purpose. Don't use it." actually a forbidding, strictly speaking?
- Filligree 5y ago
  The default is that you’re not allowed to use it. There needs to be an explicit grant of license to change that, and there’s not.
  - avodonosov 5y ago
    Do you refer any specific law?
    - bouk 5y ago
      It's called 'Copyright'
- inopinatus 5y ago
  No. It's probably intended satirically, but in practice it's a null statement since there's no grant of anything nor an exchange of value. It's equivalent to the default of "All rights reserved". This includes any fair use rights you might have, however, and any rights due to Github's ToS, so you can likely review and discuss the code, and quote from it, but if incorporated into a product or service then it's actionable; the author has the option of asserting their rights. There's no assertion that the method is patented so you'd probably be free to also use the technique, as long as you don't reuse or incorporate the original work. If your code consequently looks like the author's then that's usually fine too, c.f. NEC v. Intel (1989), although actually relying on this precedent is a question balancing your access to legal resources vs how much the author really gives a shit.
pessimizer 5y ago
I never imagined that there would be a license designed so that only copyright violators have access to your project, but I support it and will probably use it. Any project I write that I think would be useful but is bad and I would never want to see shitting up Debian repos might get this. I like a license that says that I reserve the right to sue whoever I feel like suing. If you use it, make sure I don't feel like suing you (e.g. make no money) or that I can't catch you (i.e. be an outlaw.)
- DangitBobby 5y ago
  One of the best things about people in software is (in my perception) they tend to want to share and share alike with open source and open licenses. Paid licenses also make sense to me, but it really bums me out in a way that I can't fully atriculate that the "neener neener" license is also apparently appealing to some people.
wejick 5y ago
Copyright Bouke van der Bijl I do not give anyone permissions to use this tool for any purpose. Don't use it. I’m not interested in changing this license. Please don’t ask.
- Groxx 5y ago
  If it keeps this out of production in even a handful of companies, that's probably a good thing in aggregate. It's a neat blog post, shows interesting internals, and no - you should not do it.
- BiteCode_dev 5y ago
  Somebody with codepilot to check it out?
- DangitBobby 5y ago
  https://github.com/bouk/monkey/blob/master/LICENSE.md https://github.com/bouk/monkey/blob/master/LICENSE.md Then why publish the blog post and put it into a package??
  - deleted 5y ago
    [deleted]
  - WesolyKubeczek 5y ago
    Look, don’t touch.
  - whateveracct 5y ago
    clearly satire
    - DangitBobby 5y ago
      Which part and in what way? Clearly the blog post is not satire, since the method works, and the license cannot be satire as it seems like it would be legally sufficient to prevent people from using it, which is exactly the stated purpose of the license. It's also implied that the author has received requests to change the license so others can use the package, which have been denied. The author even went so far as to remind people in this comment thread that they don't want it to be used! The license is serious on its face and in practice. Where is the joke?
CrazyPyroLinux 5y ago
This feels like "Left-pad 2: Electric Boogaloo" edit: Although, "This is only used in the test (and thus not.compiled and distributed in our binaries)." https://github.com/dapr/dapr/issues/3563#issuecomment-901563861 https://github.com/dapr/dapr/issues/3563#issuecomment-901563...
still_grokking 5y ago
I'm completely baffled how people work. Something like that can't actually happen. At least if you assume people working on software can read. But it seems not even this can be safely assumed nowadays. How can someone include some dependency without checking the license? That's actually the very first thing to do, before you can even consider using something! Not doing this is extremely unprofessional. Additionally it's stupid and very dangerous: You can bring yourself and/or your company into serous trouble. Really serous trouble. Do people really pull in some random stuff without even looking a little bit what it is? This would make the old write-up¹ about someone placing the ultimate backdoor everywhere a certainty by now. Sorry for ranting but this whole thing is a real-world satire, imho. The license was a joke, OK. But that it didn't fool only some random hobby hacker but alleged professionals at big corps is truly egregious. I can't stop shaking my head… ¹ https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://medium.com/hackernoon/im-harvesting-credit-card-numb...
- mdoms 5y ago
  A valid license does nothing to prevent supply chain attacks.
- gpas 5y ago
  The npm circus is crazy. How anyone can consider himself a dev and then depend on packages like is-odd, 486.139 downloads weekly is-even, 206.628 is-windows, 17.329.418 is-empty, 176.643 true, 504 too many false, circa 700 is-number, 46.806.043 (!!!) is-promise, 10.282.368 left-pad, 3.014.769 These are the one I hate more, but it's full of unnecessary one-line packages. Some of them are even used by the big players. I just don't understand...
- Macha 5y ago
  I highly doubt most devs check the license of every dependency 3 layers deep from their UI framework. create-react-app, vue-cli sets up several hundred dependencies. If you tell me >50% of devs investigate each dependency manually, or run a license checker on that, I don't believe you. Where I work for we have automated license scanners for this reason. They would flag such a use. But this open source project, and apparently 467 other cases, missed that. Maybe the contributors assumed the author had done their due diligence, maybe they just don't check in general, it's hard to know.
mgraczyk 5y ago
A long time ago I implemented a similar (less flexible) thing for C, also as a sort of goofy learning experience: https://github.com/mgraczyk/fast_check_once/blob/master/fast_check.h https://github.com/mgraczyk/fast_check_once/blob/master/fast... There's something really appealing about replacing code at runtime to "hack" the bypass normal behavior of the language. For testing/mocking this can even be useful.
mdoms 5y ago
It's crazy to me that people would intentionally introduce monkey patching into a language where it's not supported.
- DangitBobby 5y ago
  I dont know how that could be surprising as sometimes monkey patching is the best (only?) way to do something.
dragonwriter 5y ago
Technically, that is not a license, since a license is something that grants permissions and that statement expressly does not.
SergeAx 5y ago
Using monkey patching is an awful idea and always means your code architecture is bad. Will not be surprised if this message was the original author's intent. Edit: it actually was: https://news.ycombinator.com/item?id=28265605 https://news.ycombinator.com/item?id=28265605
hnarn 5y ago
What worries me the most about these comments is: 1) how many software developers that do not understand how licenses and copyright work 2) how many software developers that feel entitled to use someone else's code and default to feeling offended when they feel they've been mislead 3) how many software developers that are not focusing on the most important thing, which is how embarrassed you should be that you imported this code in your codebase to begin with.
- braabe 5y ago
  I wholeheartedly agree. It feels a bit like a debate about speed limits: "I'm really only a couple kph/mph over it. The speed limit here is stupid anyway." I am however glad this issue came up. The author does not appear to want to screw anyone over legally on this - so why not take it as a lesson learned and go from there?
patrickdevivo 5y ago
This post inspired me to try writing some SQL that downloads all the LICENSE files of declared go mod dependencies: https://askgit.substack.com/p/query-for-go-dependency-licenses https://askgit.substack.com/p/query-for-go-dependency-licens... using a project I maintain. Some flaws, but was able to download a bunch of licenses :)

213 points by withinboredom 5y ago

Quite an unusual, but effective, way to mark something as a proof of concept that's dangerous to use: From [1]: "This is as unsafe as it sounds and I don't recommend anyone do it outside of a testing environment." [1]: https://github.com/bouk/monkey#i-thought-that-monkeypatching-in-go-is-impossible https://github.com/bouk/monkey#i-thought-that-monkeypatching...

wereHamster 5y ago
> … I don't recommend anyone do it outside of a testing environment. … which is exactly dow it is used in dapr > This is only used in the test (and thus not.compiled and distributed in our binaries). (source: https://github.com/dapr/dapr/issues/3563#issuecomment-901563861 https://github.com/dapr/dapr/issues/3563#issuecomment-901563...)
- mcguire 5y ago
  There's a teeny bit of a difference between using it to explore monkey patching a go executable and using in the test suite of a released project.
- reificator 5y ago
  > > … I don't recommend anyone do it outside of a testing environment. > … which is exactly dow it is used in dapr Eh... There's a difference between "a testing environment" as used in that quote and "as part of an automated test" as you mean here. To me the former implies an experimental and/or ad-hoc environment, while the latter implies a stable, production environment.
Fuzzeh 5y ago
You don't have the right to use it, even in a testing environment. The license denys you the right to use it.
- philipswood 5y ago
  Yes, but at the same time demonstrates the code clearly so you could implement it yourself. I'd say this is code sharing aiming at zero reuse.

Y_Y 5y ago

So there is no grant of copyright to distribute copies of the dependency, but what about useyright? The dependant project just uses the the dependency to run a test. Supposing it didn't distribute it as part of the release, is that still allowable?

boomboomsubban 5y ago
The conflicting license states >I do not give anyone permissions to use this tool for any purpose. Don't use it. So no use rights either.
- TheCoelacanth 5y ago
  Copyright does not give authority over use, only over redistribution.
- Y_Y 5y ago
  But the granting of rights to redistribute is governed by the applicable copyright law, as far as I know there is no equivalent body of law governing usage. You can't give someone information but attach conditions to its use, except in specific circumstances. You can certainly make someone sign a contract before agreeing to give them the information, but that's not what's occurring here.
  - JackFr 5y ago
    IANAL but these specific circumstances of ‘use’ typically include copyrighted music and drama, which cannot be performed in a public or commercial setting without permission or compensation. The Beatles may own Yesterday but they can’t stop me from whistling it. Where I think this case gets murky is that the item in question is not distributed or used by users of the software, but is part of the production process for it.
  - boomboomsubban 5y ago
    >You can't give someone information but attach conditions to its use, except in specific circumstances. Wouldn't that effectively bar the use of DRM? If I buy a blu-ray, I can't legally watch it unless I have a player capable of unlocking the content. That may be one of the "specific circumstances," as there is a law that specifically forbids bypassing DRM.

semitones 5y ago

License reads: > "Copyright Bouke van der Bijl I do not give anyone permissions to use this tool for any purpose. Don't use it. I’m not interested in changing this license. Please don’t ask. " Used by counter on GitHub is at 464. The way it's worded would imply that they are all violating the license? How can this be enforced for inconsequential small pet projects? Is this really something to worry about, particularly with what (seems to me) to be a sort-of spurious license?

oaiey 5y ago
Yes. You take something you do not own (even down the tree). You have to check if you are allowed to. It does not matter if it is a small pet project or the Linux Kernel. Sure you can ignore him and wait for him to lawyer up and make your life miserable. Considering that IT specialists which have capacity to contribute to open source are typically not poor or have idealogical interests, I would not take the bets. Respect the wishes of the people you take code from. License checking is like code coverage. If you are a professional you take care of it.
- concordDance 5y ago
  > You have to check if you are allowed to. It does not matter if it is a small pet project or the Linux Kernel. Actually it does matter and you don't have to. In practice pet projects are basically never going to be sued, it's simply not worth it. As a side note, a lot of techy people struggle to separate the law as written with the law as practiced. The ethics question is more interesting, but for something like this which is clearly satirical? No harm, no foul.
  - oaiey 5y ago
    The "pet project" was the dependency in my example which license would be violated. The contextual author does not care for sure. But generally it is an ethical problem like you said but also a practical one. Once you stack enough pet (or should I say lpad) projects together something bigger comes out. And the liability is hidden three layers down the dependency tree.

hypertele-Xii 5y ago

GitHub terms of service [1]: "If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking)." I think these override it? [1] https://docs.github.com/en/github/site-policy/github-terms-of-service#5-license-grant-to-other-users https://docs.github.com/en/github/site-policy/github-terms-o...

oaiey 5y ago
No it does not. This statement is exclusively for the fact that GitHub and a reader is not liable for showing/reading your copyrighted code. The only weak spot is GitHub Actions/Code spaces/etc for dev tools I guess. Because that falls under "GitHub service" and is a functionality of it.
- bscphil 5y ago
  No, this would also seem to protect users who click the "fork" button on Github. It would not, however, allow them to clone the software to their local computer or use it for any other purpose.
  - SeanLuke 5y ago
    The Github terms do not indicate that the license is transferable. Github can display the code, but even if someone downloads from Github, they still can't use it.

gpm 5y ago

I am not a lawyer... There may be an argument here that 1. GitHub has a valid license to distribute it (as a result of their TOS) 2. Running the downloaded code is not copyright infringement (or not obviously so, and hasn't been established as so in any court that I am aware of) 3. Using the APIs is not copyright infringement (see Oracle v Google, if that was fair use this almost certainly is) Thus no copyright infringement has occurred. Still, keeping this in the codebase is at best boobytrapping your code to create accidental future instances of copyright infringement, and it's an interesting case of people not checking licenses (since it's pretty clear they didn't realize this in advance).

HomeDeLaPot 5y ago
I think GitHub gives you the right to download or fork the repo, but the license explicitly states that you can't use the code. That might mean running it on its own is technically illegal. The license literally says "you can't use this". How are so many people confused about the license in this thread?
- gpm 5y ago
  > That might mean running it on its own is technically illegal. Based on what law/authority? Copyright law forbids making copies, derivative works, etc. Not using things. You're allowed to read a book without a license. Moreover copyright law makes an explicit exception for the copies required to run a computer program on a machine that aren't used in other ways (i.e. copying it to ram/registers): https://www.law.cornell.edu/uscode/text/17/117 https://www.law.cornell.edu/uscode/text/17/117 The author may say "you can't use this", but it is not clear to me that he has any legal authority to do so.
  - inopinatus 5y ago
    Quite so. As written, it's a null statement. To be enforceable, a license has to be written by one party such that another party may acquire rights in exchange for accepting the terms. This is how licenses become contracts. Simply reading the words "Don't use it" does not bind you, because there is no grant of use; there is no offer or exchange of value, so no contract has been formed, and the statement is at best advisory. It is equal to writing "All rights reserved", which is to say, you retain whatever rights pre-existed under statutory and common law, such as right of fair use and so forth, and anything due to Github's ToS. Engineers often fall into the trap of thinking the law is a programming language. It isn't, mercifully.

gpas 5y ago

From the explaining blog post [0] > If you’re not interested in how it works and you just want to do monkey patching, then you can find the library here. Also > Wrapping it up in a nice library > I took the above code and put it in an easy to use library. It supports 32 bit, reversing patches, and patching instance methods. I wrote a couple of examples and put those in the README. Then in the README[1]: > Make sure you read the notes at the bottom of the README if you intend to use this library. Either the author is confused or has decided that he doesn't want to maintain an hack. Anyway license is pretty clear. There was an HN thread[2] when it was released. [0] https://bou.ke/blog/monkey-patching-in-go/ https://bou.ke/blog/monkey-patching-in-go/ [1] https://github.com/bouk/monkey https://github.com/bouk/monkey [2] https://news.ycombinator.com/item?id=9290917 https://news.ycombinator.com/item?id=9290917

bouk 5y ago
It's satirical
- eurasiantiger 5y ago
  Have you checked how many projects depend on Monkey? It seems the blog post has been translated and reposted many times. Satire does not translate well.
- gpas 5y ago
  It crossed my mind... Thanks for chiming in and clear the misunderstanding.
- nextaccountic 5y ago
  It seems that you're not interested in suing anyone over this. However, you still don't give people permission to use, not even in small throwaway tests. Which is fair. But your blog post[0] language suggests that you are okay with and even incentivizes people trying this out (even if trying it out might be technically illegal, because it infringes your rights). I think you should have mentioned something about the license in your blog post. As it stands, "If you’re not interested in how it works and you just want to do monkey patching, then you can find the library here." is misleading. If the user wants to do monkey patching, they better not look at your code and program their own solution. [0] https://bou.ke/blog/monkey-patching-in-go/ https://bou.ke/blog/monkey-patching-in-go/

somehnacct3757 5y ago

No problem, just start typing code like it and let Github Copilot handle the rest

CyberRabbi 5y ago
Even better, Fairuseify[1] will repackage a fair-use version of the library for you automatically. [1]: https://fairuseify.ml/ https://fairuseify.ml/
- still_grokking 5y ago
  Ingenious! It only needs some build-in YouTube and Getty-Images browser to select fairuseify targets. (It should work for all kind of media, of course). I think we've solved the copyright issue right now finally for good, didn't we?

bouk 5y ago

I love that all the discussion here is about the license I wrote and not about the actual project, which is a completely terrible idea and something I created as a lark. Why did I not spell this out in the blog post? For my own amusement. I also think it shows that licenses really don't matter all that much as some people think, they are not computer code.

zdw 5y ago
I've considered making a license that is basically MIT/BSD, but requires that anyone using an automated license checking/compliance system (any corporate users) to pay a fee to use the software.
- josephcsible 5y ago
  Instead of doing that, why not dual-license your program under CC-BY-NC and AGPLv3, and then sell exceptions?
  - nzmsv 5y ago
    A lot of legal departments have a mental image of AGPL (and GPL) as a bogeyman that will steal all the company's code if allowed anywhere near the building. I've sat through a presentation one time that tried to paint these licenses as something only basement dwellers use for personal projects. I spoke to the presenter afterwards and told them about projects like Linux and Mongo, and how even AGPL is not as scary as they thought. The lawyer seemed genuinely surprised and said they would read up on it. I'm pretty sure my bringing this up in a friendly manner caused them to question their assumptions. Had I picked a fight during the presentation I'd just be labeled a basement dweller. However, this lawyer also told me something interesting. To some extent it doesn't matter whether I was able to change his mind. As long as other lawyers in the field have this bogeyman concept in mind, the use of GPL will get flagged in due diligence, etc. and it's easier to simply not use a component with strong copyleft when developing a product (unless it's as irreplaceable as Linux). This is a long-winded way of saying that selling exceptions will likely scare off potential purchasers long before they are in a position to consider the purchase. Most shops have a blanket "no GPL ever" policy and a dev won't even bother with the component even for a prototype.

foreigner 5y ago

This is just mean! The documentation definitely reads like the library is meant for use, but the author forbids all use in the license.

elric 5y ago
Why is it mean? The author can use whatever license they like. If you don't like it, you're more than welcome to release your own code under a more permissive license.
- Macha 5y ago
  It's misleading to present the project as being for use by others and then forbid any use in the legal print?
  - Thiez 5y ago
    Is it misleading to present a project as free and then have the (A)GPL license? Here I thought it was free, now suddenly there are all these conditions... The "legal print" in this case is five lines long, written in (contrary to most licenses) very plain english, located in the root of the repository, in a file named 'LICENSE.md'. It's not exactly hidden where a reasonable person might overlook it. "We didn't know" isn't a very convincing defense.
    - DangitBobby 5y ago
      Yes. It is misleading to advertise software as Free and Open when it's actually Copy Left.
    - Macha 5y ago
      Normally such fact is advertised in the readme, and the github sidebar will recognise and display the title of such a license in the sidebar. It's commonly understood that open source software may be copyleft. I think not mentioning a license that says "No use permitted" amongst some instructions on how to use it is deceptive. > "We didn't know" isn't a very convincing defense. Good thing "mean", is a matter of subjective perception and not of law, then. Or do you suggest everything legal is automatically good?

wheybags 5y ago

Side note, but for all the people saying this is absolutely godawful and the license is OK because no one in their right mind would use it in production, this project from MS does basically the same thing: https://www.microsoft.com/en-us/research/project/detours/ https://www.microsoft.com/en-us/research/project/detours/ Recently open sourced, but has been used for twenty years in real products from MS and others. It's not so crazy as you might think! An example of a real use I had for it: redirecting messages from OutputDebugString to a log file. AFAIK that is the best way to do it, when you only want the output from your one process. "Why not just call a proper logging function directly instead?" Because the OutputDebugString calls were coming from inside my GPU driver. Real life is not some ivory tower of perfection. An imperfect world requires imperfect solutions.

woodruffw 5y ago
The key difference being that Detours is a library written by Microsoft engineers with access to the Win32 team and the ability (if not drive) to ensure that Detours functions correctly as changes are made. Those changes are also probably pretty rare, given Win32’s famously stable ABI. This library patches a third party runtime, one that explicitly forbids this kind of instrumentation and has a famously unstable ABI. You can do whatever you want to get your job done, and this is certainly one way to do it, but it’s absolutely a dangerous hack.
tptacek 5y ago
I've done a lot of work with Detours and have written my own trampoline injection thingies in Python and Ruby, and this approach is not really a reasonable way to build production software. A proof-of-concept Detours implementation posted as an illustration for an amusing blog post may be the most perfect possible use case for a "you are not allowed to use this for anything" license, maybe rivaled only by the code you post for a cipher you designed yourself.
reificator 5y ago
To anyone else confused as I was, "this project from MS does basically the same thing" is referring to monkeypatching a running executable, not having a license that forbids use of the software.

avodonosov 5y ago

Is the "I do not give anyone permissions to use this tool for any purpose. Don't use it." actually a forbidding, strictly speaking?

Filligree 5y ago
The default is that you’re not allowed to use it. There needs to be an explicit grant of license to change that, and there’s not.
- avodonosov 5y ago
  Do you refer any specific law?
  - bouk 5y ago
    It's called 'Copyright'
inopinatus 5y ago
No. It's probably intended satirically, but in practice it's a null statement since there's no grant of anything nor an exchange of value. It's equivalent to the default of "All rights reserved". This includes any fair use rights you might have, however, and any rights due to Github's ToS, so you can likely review and discuss the code, and quote from it, but if incorporated into a product or service then it's actionable; the author has the option of asserting their rights. There's no assertion that the method is patented so you'd probably be free to also use the technique, as long as you don't reuse or incorporate the original work. If your code consequently looks like the author's then that's usually fine too, c.f. NEC v. Intel (1989), although actually relying on this precedent is a question balancing your access to legal resources vs how much the author really gives a shit.

pessimizer 5y ago

I never imagined that there would be a license designed so that only copyright violators have access to your project, but I support it and will probably use it. Any project I write that I think would be useful but is bad and I would never want to see shitting up Debian repos might get this. I like a license that says that I reserve the right to sue whoever I feel like suing. If you use it, make sure I don't feel like suing you (e.g. make no money) or that I can't catch you (i.e. be an outlaw.)

DangitBobby 5y ago
One of the best things about people in software is (in my perception) they tend to want to share and share alike with open source and open licenses. Paid licenses also make sense to me, but it really bums me out in a way that I can't fully atriculate that the "neener neener" license is also apparently appealing to some people.

wejick 5y ago

Copyright Bouke van der Bijl I do not give anyone permissions to use this tool for any purpose. Don't use it. I’m not interested in changing this license. Please don’t ask.

Groxx 5y ago
If it keeps this out of production in even a handful of companies, that's probably a good thing in aggregate. It's a neat blog post, shows interesting internals, and no - you should not do it.
BiteCode_dev 5y ago
Somebody with codepilot to check it out?
DangitBobby 5y ago
https://github.com/bouk/monkey/blob/master/LICENSE.md https://github.com/bouk/monkey/blob/master/LICENSE.md Then why publish the blog post and put it into a package??
- deleted 5y ago
  [deleted]
- WesolyKubeczek 5y ago
  Look, don’t touch.
- whateveracct 5y ago
  clearly satire
  - DangitBobby 5y ago
    Which part and in what way? Clearly the blog post is not satire, since the method works, and the license cannot be satire as it seems like it would be legally sufficient to prevent people from using it, which is exactly the stated purpose of the license. It's also implied that the author has received requests to change the license so others can use the package, which have been denied. The author even went so far as to remind people in this comment thread that they don't want it to be used! The license is serious on its face and in practice. Where is the joke?

CrazyPyroLinux 5y ago

This feels like "Left-pad 2: Electric Boogaloo" edit: Although, "This is only used in the test (and thus not.compiled and distributed in our binaries)." https://github.com/dapr/dapr/issues/3563#issuecomment-901563861 https://github.com/dapr/dapr/issues/3563#issuecomment-901563...

still_grokking 5y ago

I'm completely baffled how people work. Something like that can't actually happen. At least if you assume people working on software can read. But it seems not even this can be safely assumed nowadays. How can someone include some dependency without checking the license? That's actually the very first thing to do, before you can even consider using something! Not doing this is extremely unprofessional. Additionally it's stupid and very dangerous: You can bring yourself and/or your company into serous trouble. Really serous trouble. Do people really pull in some random stuff without even looking a little bit what it is? This would make the old write-up¹ about someone placing the ultimate backdoor everywhere a certainty by now. Sorry for ranting but this whole thing is a real-world satire, imho. The license was a joke, OK. But that it didn't fool only some random hobby hacker but alleged professionals at big corps is truly egregious. I can't stop shaking my head… ¹ https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://medium.com/hackernoon/im-harvesting-credit-card-numb...

mdoms 5y ago
A valid license does nothing to prevent supply chain attacks.
gpas 5y ago
The npm circus is crazy. How anyone can consider himself a dev and then depend on packages like is-odd, 486.139 downloads weekly is-even, 206.628 is-windows, 17.329.418 is-empty, 176.643 true, 504 too many false, circa 700 is-number, 46.806.043 (!!!) is-promise, 10.282.368 left-pad, 3.014.769 These are the one I hate more, but it's full of unnecessary one-line packages. Some of them are even used by the big players. I just don't understand...
Macha 5y ago
I highly doubt most devs check the license of every dependency 3 layers deep from their UI framework. create-react-app, vue-cli sets up several hundred dependencies. If you tell me >50% of devs investigate each dependency manually, or run a license checker on that, I don't believe you. Where I work for we have automated license scanners for this reason. They would flag such a use. But this open source project, and apparently 467 other cases, missed that. Maybe the contributors assumed the author had done their due diligence, maybe they just don't check in general, it's hard to know.

mgraczyk 5y ago

A long time ago I implemented a similar (less flexible) thing for C, also as a sort of goofy learning experience: https://github.com/mgraczyk/fast_check_once/blob/master/fast_check.h https://github.com/mgraczyk/fast_check_once/blob/master/fast... There's something really appealing about replacing code at runtime to "hack" the bypass normal behavior of the language. For testing/mocking this can even be useful.

mdoms 5y ago

It's crazy to me that people would intentionally introduce monkey patching into a language where it's not supported.

DangitBobby 5y ago
I dont know how that could be surprising as sometimes monkey patching is the best (only?) way to do something.

dragonwriter 5y ago

Technically, that is not a license, since a license is something that grants permissions and that statement expressly does not.

SergeAx 5y ago

Using monkey patching is an awful idea and always means your code architecture is bad. Will not be surprised if this message was the original author's intent. Edit: it actually was: https://news.ycombinator.com/item?id=28265605 https://news.ycombinator.com/item?id=28265605

hnarn 5y ago

What worries me the most about these comments is: 1) how many software developers that do not understand how licenses and copyright work 2) how many software developers that feel entitled to use someone else's code and default to feeling offended when they feel they've been mislead 3) how many software developers that are not focusing on the most important thing, which is how embarrassed you should be that you imported this code in your codebase to begin with.

braabe 5y ago
I wholeheartedly agree. It feels a bit like a debate about speed limits: "I'm really only a couple kph/mph over it. The speed limit here is stupid anyway." I am however glad this issue came up. The author does not appear to want to screw anyone over legally on this - so why not take it as a lesson learned and go from there?

patrickdevivo 5y ago

This post inspired me to try writing some SQL that downloads all the LICENSE files of declared go mod dependencies: https://askgit.substack.com/p/query-for-go-dependency-licenses https://askgit.substack.com/p/query-for-go-dependency-licens... using a project I maintain. Some flaws, but was able to download a bunch of licenses :)