3 ms·

That’s a question for legal to handle, unless you’re a two person shop.

by mc32 5y ago

CydeWeys 5y ago
You can escalate to legal for edge cases, but you should be able to handle base cases yourself. As an example, I work at Google on an Apache 2.0-licensed open source project, and we have dozens of third party dependencies: https://github.com/google/nomulus/blob/master/core/build.gradle https://github.com/google/nomulus/blob/master/core/build.gra... It wouldn't remotely scale across Google if we had to escalate to legal every single time we pulled in a new dependency. Instead, there's a company-wide allowlist of accepted software licenses, and you only need legal help for exceptions beyond that. So yes, we do have to know some basics of software licensing. It's just part of being a SWE.
- orf 5y ago
  So a SWE just needs to see if the set of allowed licenses contains the project license. That doesn’t require any knowledge of the license itself, other than “they exist”.
  - jdavis703 5y ago
    It does though. Like why waste time if you know a viral GPL-style license or a patent encumbered license would be a no go? This is akin to saying SWE’s don’t need to understand GDPR, COPA, HIPPA, DMCA or whatever. Obviously there might be cases where someone never touches code in a GDPR or HIPPA context. But any SWE working in those areas should damn well understand the basics of the law — at least enough to flag inadvertent, but none the less blatant violations.
    - phendrenad2 5y ago
      SWEs are all Star Wars trivia nerds, surely they can handle a few software licenses and GDPR rules and stuff.
Iolaum 5y ago
No, At serious BigCo's developers (and their managers) are undergoing training on how to evaluate OSS software and only accept dependencies according to the company policies. You don't develop complex software by having to go through legal for each of your dependencies.
deleted 5y ago
[deleted]
selfhoster11 5y ago
Licensing isn't brain surgery. There is a grand total of five or so licenses that are in broad use today, perhaps a couple more if you include the LGPL and AGPL families. It's perfectly possible to learn what each of them do, or limit yourself to only using the ones that you understand.
entropyie 5y ago
So legal is going to tell you which NPM package to use in your NodeJS project? Is legal going to be sitting beside you when you're surfing github and see an awesome library that just happens to have an Affero GPL license? If you're lucky, you'll have automated source scanning, legal will be informed after the fact, and you'll spend a week backing out the offending code and finding a replacement. What's more likely is that it will be shipped to production and sit there until someone notices or you get sued ;) Another one that likes to bite is the very not-open source Oracle extensions to open source Virtualbox / Vagrant... How many devs at big corps just click through that splash screen? Thinking legal is going to protect you is wishful thinking... Devs need to know the basics.
jrm4 5y ago
No response proves my original point better than "That's a question for legal to handle, unless you're a two person shop." Or perhaps even further -- it clearly demonstrates a reckless or willful ignorance of the entire topic.

That’s a question for legal to handle, unless you’re a two person shop.

by mc32 5y ago

That’s a question for legal to handle, unless you’re a two person shop.

You can escalate to legal for edge cases, but you should be able to handle base cases yourself. As an example, I work at Google on an Apache 2.0-licensed open source project, and we have dozens of third party dependencies: https://github.com/google/nomulus/blob/master/core/build.gradle https://github.com/google/nomulus/blob/master/core/build.gra... It wouldn't remotely scale across Google if we had to escalate to legal every single time we pulled in a new dependency. Instead, there's a company-wide allowlist of accepted software licenses, and you only need legal help for exceptions beyond that. So yes, we do have to know some basics of software licensing. It's just part of being a SWE.

orf 5y ago
So a SWE just needs to see if the set of allowed licenses contains the project license. That doesn’t require any knowledge of the license itself, other than “they exist”.
- jdavis703 5y ago
  It does though. Like why waste time if you know a viral GPL-style license or a patent encumbered license would be a no go? This is akin to saying SWE’s don’t need to understand GDPR, COPA, HIPPA, DMCA or whatever. Obviously there might be cases where someone never touches code in a GDPR or HIPPA context. But any SWE working in those areas should damn well understand the basics of the law — at least enough to flag inadvertent, but none the less blatant violations.
  - phendrenad2 5y ago
    SWEs are all Star Wars trivia nerds, surely they can handle a few software licenses and GDPR rules and stuff.

Iolaum 5y ago

No, At serious BigCo's developers (and their managers) are undergoing training on how to evaluate OSS software and only accept dependencies according to the company policies. You don't develop complex software by having to go through legal for each of your dependencies.

deleted 5y ago

[deleted]

selfhoster11 5y ago

Licensing isn't brain surgery. There is a grand total of five or so licenses that are in broad use today, perhaps a couple more if you include the LGPL and AGPL families. It's perfectly possible to learn what each of them do, or limit yourself to only using the ones that you understand.

entropyie 5y ago

So legal is going to tell you which NPM package to use in your NodeJS project? Is legal going to be sitting beside you when you're surfing github and see an awesome library that just happens to have an Affero GPL license? If you're lucky, you'll have automated source scanning, legal will be informed after the fact, and you'll spend a week backing out the offending code and finding a replacement. What's more likely is that it will be shipped to production and sit there until someone notices or you get sued ;) Another one that likes to bite is the very not-open source Oracle extensions to open source Virtualbox / Vagrant... How many devs at big corps just click through that splash screen? Thinking legal is going to protect you is wishful thinking... Devs need to know the basics.

jrm4 5y ago

No response proves my original point better than "That's a question for legal to handle, unless you're a two person shop." Or perhaps even further -- it clearly demonstrates a reckless or willful ignorance of the entire topic.