2 ms·

I highly doubt most devs check the license of every dependency 3 layers deep from their UI framework. create-react-app, vue-cli sets up several hundred dependen

by Macha 5y ago

I highly doubt most devs check the license of every dependency 3 layers deep from their UI framework. create-react-app, vue-cli sets up several hundred dependencies. If you tell me >50% of devs investigate each dependency manually, or run a license checker on that, I don't believe you. Where I work for we have automated license scanners for this reason. They would flag such a use. But this open source project, and apparently 467 other cases, missed that. Maybe the contributors assumed the author had done their due diligence, maybe they just don't check in general, it's hard to know.

still_grokking 5y ago
Automation is of course very helpful. But my point wasn't about transitive deps (directly). The point is about pulling something new into your project. At the point you include something that something needs to tell you the license for itself and for all its dependencies. If it doesn't that's already fishy in its own rights (and you should turn back or start investigating for real). You need to look at the provided license lists of course. Yes, I see more and more projects that don't list licenses for their deps. But that's usually already a license volition on its own! You can't use something like that, it's obviously problematic. Having some tools that download random stuff form the internet may be OK when you're doing something for yourself. But at the moment you want to publish that something you're obligated to check the licenses. That's a know thing. If you don't that's very shoddy work, and actually you could get sued for all resulting damages. So no matter what it's actually impossible to include code with a problematic license, given no botchers were involved anywhere deeper in the chain. And here we're at the core of what I've said: It's completely baffling to me how something like that could possibly happen. At least as long as I try to believe that no complete idiots work in the industry, people who aren't even capable of reading, and don't know even the most basic things about the job they try to do. People that therefore shouldn't be allowed to touch anything as they could create great danger for their surroundings and for themself! But OK, maybe I just have to accept that the software industry is not different to this here: https://www.youtube.com/watch?v=FfyPLTIn2D8 https://www.youtube.com/watch?v=FfyPLTIn2D8

by Macha 5y ago

still_grokking 5y ago

Automation is of course very helpful. But my point wasn't about transitive deps (directly). The point is about pulling something new into your project. At the point you include something that something needs to tell you the license for itself and for all its dependencies. If it doesn't that's already fishy in its own rights (and you should turn back or start investigating for real). You need to look at the provided license lists of course. Yes, I see more and more projects that don't list licenses for their deps. But that's usually already a license volition on its own! You can't use something like that, it's obviously problematic. Having some tools that download random stuff form the internet may be OK when you're doing something for yourself. But at the moment you want to publish that something you're obligated to check the licenses. That's a know thing. If you don't that's very shoddy work, and actually you could get sued for all resulting damages. So no matter what it's actually impossible to include code with a problematic license, given no botchers were involved anywhere deeper in the chain. And here we're at the core of what I've said: It's completely baffling to me how something like that could possibly happen. At least as long as I try to believe that no complete idiots work in the industry, people who aren't even capable of reading, and don't know even the most basic things about the job they try to do. People that therefore shouldn't be allowed to touch anything as they could create great danger for their surroundings and for themself! But OK, maybe I just have to accept that the software industry is not different to this here: https://www.youtube.com/watch?v=FfyPLTIn2D8 https://www.youtube.com/watch?v=FfyPLTIn2D8