5 ms·

Because you have to make the source code available to people who receive your distribution of the library.

by grahamlee 5y ago

rndgermandude 5y ago
So? Maybe malwarebytes are doing that?
- deelowe 5y ago
  Are they? I got the sense that this is the issue.
jcun4128 5y ago
I'll have to brush up on this, GPL that's not seen by people say it does something in messaging or part of DNS or something, it would still have to be public? Use case is part of some web-app that isn't installed.
- dfatduck 5y ago
  I am quite sure that you only need to publish the source if you are distributing the GPLed code.
- singlow 5y ago
  If its running on your server, then you aren't distributing it. There are licenses like AGPL that do try to limit that usage but GPL does not. Now if it is a web app that has client code that gets executed in the browser, that is distributed to the end user and GPL would apply, so you would need to include license notifications for that within your app or as part of the source code distributed. In that case you are already distributing source but you may need to make an unobfuscated source available if your distribution is minified/uglified.
  - jcun4128 5y ago
    YANAL ha, but I was curious even if we did have to disclose the specific GPL piece of software, do we only have to release that part? Not the entire app. > web app that has client code that gets executed in the browser, That's the technicality stuff, the client triggers an event, that then uses this GPL piece of code that is on the server. I went through our stuff (mostly NPM) and they all are either Apache/MIT but there was one piece like ahh... Anyway not making money yet but will bring this up for review with legal. Thanks
veeti 5y ago
Did you ask?
- teddyh 5y ago
  You shouldn’t have to ask. The GPL requires that the distributor either sends the source code alongside the binaries, or that the distributor sends along an explicit written offer to send the source code. If you, as a recipient of binaries, did not get such an offer, and no source code was sent along the binaries either, the GPL was violated. There is no recovery from this, even if the distributor sends the source code on request.
  - kgwxd 5y ago
    Can you point to where in the GPL it says that it must be explicitly offered? I don't remember ever reading anything that gave me that impression, or anyone even informally mentioning that was the case. I ask because I'd be in violation. I've attached the GPL to a bunch of dinky little projects I haven't bother hosting a public repository for because I don't think anyone else in the 'verse really cares. In most cases I know I'm the only user, but there are a few that some other people have at least downloaded (probably bots or mistakes, but downloaded nonetheless).
    - scbrg 5y ago
      Section 6 pretty much lets you choose between: - Bundling the source with the program (a) - Letting people download the source from the same place as they can download the program (d) - A written offer to hand over the source on request (b, c, e) https://www.gnu.org/licenses/gpl-3.0.en.html https://www.gnu.org/licenses/gpl-3.0.en.html
    - teddyh 5y ago
      You’re not in violation. If people download the binaries, and you offer the source code at the same download site, and they choose not to download the source code, that’s on them; you are off the hook. I also did not mention (because it was not relevant to the parties being discussed) one other option: If you received the binaries from someone else, with a written offer for source code, and you are distributing the binaries non-commercially, you can simply forward a copy of the written offer of source code you received. The section of the GPL 2 you want is section 3, and in GPL 3 it’s section 6.

Because you have to make the source code available to people who receive your distribution of the library.

rndgermandude 5y ago

So? Maybe malwarebytes are doing that?

deelowe 5y ago
Are they? I got the sense that this is the issue.

jcun4128 5y ago

I'll have to brush up on this, GPL that's not seen by people say it does something in messaging or part of DNS or something, it would still have to be public? Use case is part of some web-app that isn't installed.

dfatduck 5y ago
I am quite sure that you only need to publish the source if you are distributing the GPLed code.
singlow 5y ago
If its running on your server, then you aren't distributing it. There are licenses like AGPL that do try to limit that usage but GPL does not. Now if it is a web app that has client code that gets executed in the browser, that is distributed to the end user and GPL would apply, so you would need to include license notifications for that within your app or as part of the source code distributed. In that case you are already distributing source but you may need to make an unobfuscated source available if your distribution is minified/uglified.
- jcun4128 5y ago
  YANAL ha, but I was curious even if we did have to disclose the specific GPL piece of software, do we only have to release that part? Not the entire app. > web app that has client code that gets executed in the browser, That's the technicality stuff, the client triggers an event, that then uses this GPL piece of code that is on the server. I went through our stuff (mostly NPM) and they all are either Apache/MIT but there was one piece like ahh... Anyway not making money yet but will bring this up for review with legal. Thanks

veeti 5y ago

Did you ask?

teddyh 5y ago
You shouldn’t have to ask. The GPL requires that the distributor either sends the source code alongside the binaries, or that the distributor sends along an explicit written offer to send the source code. If you, as a recipient of binaries, did not get such an offer, and no source code was sent along the binaries either, the GPL was violated. There is no recovery from this, even if the distributor sends the source code on request.
- kgwxd 5y ago
  Can you point to where in the GPL it says that it must be explicitly offered? I don't remember ever reading anything that gave me that impression, or anyone even informally mentioning that was the case. I ask because I'd be in violation. I've attached the GPL to a bunch of dinky little projects I haven't bother hosting a public repository for because I don't think anyone else in the 'verse really cares. In most cases I know I'm the only user, but there are a few that some other people have at least downloaded (probably bots or mistakes, but downloaded nonetheless).
  - scbrg 5y ago
    Section 6 pretty much lets you choose between: - Bundling the source with the program (a) - Letting people download the source from the same place as they can download the program (d) - A written offer to hand over the source on request (b, c, e) https://www.gnu.org/licenses/gpl-3.0.en.html https://www.gnu.org/licenses/gpl-3.0.en.html
  - teddyh 5y ago
    You’re not in violation. If people download the binaries, and you offer the source code at the same download site, and they choose not to download the source code, that’s on them; you are off the hook. I also did not mention (because it was not relevant to the parties being discussed) one other option: If you received the binaries from someone else, with a written offer for source code, and you are distributing the binaries non-commercially, you can simply forward a copy of the written offer of source code you received. The section of the GPL 2 you want is section 3, and in GPL 3 it’s section 6.