4 ms·

In this case, Microsoft seized ownership of an open source project and modified the code without the permission of the person who still controls those copyright

In this case, Microsoft seized ownership of an open source project and modified the code without the permission of the person who still controls those copyright rights that they haven't specifically waived. Legally, shouldn't Microsoft limit themselves to banning the developer from npm and forking their repos under a new name?

that_guy_iain 5y ago
Didn’t they just revert it to a previous version? A version they are legally allowed to distribute? They are legally allowed to ban people and use whatever urls they want to host git repos. They are also legally allowed to give someone else permision to npm publishing under a specific package name. Seems like they did things they are allowed to do.
iakov 5y ago
profmonocle 5y ago
Microsoft isn't asserting any sort of ownership - colors.js is licensed under MIT. Microsoft is free to make whatever changes they like and redistribute said changes. (But as was already mentioned, they merely dropped the broken versions and set the last working version as "latest".)
- GeekyBear 5y ago
  > Microsoft isn't asserting any sort of ownership The person who holds the copyright isn't allowed to access the repo. Microsoft changed the code in their repo. Those things don't happen without Microsoft asserting ownership.
  - monkeybutton 5y ago
    Who owns repo? The author has a right to package code, but he doesn't want have the right to use other people's platforms to distribute it. This is a lot like twitter bans isn't it?
    - GeekyBear 5y ago
      Is Twitter allowed to change the text of your tweets? As mentioned in the original post, Microsoft had the right to ban the developer, and not host their projects in the future. They also had the right to fork the repos and change the fork in any way they liked. What I don't believe they have is the right to seize and modify somebody else's IP without permission.
      - Arnavion 5y ago
        If you edit a tweet I'm sure Twitter reserves the right to roll back your edit, yes. And I don't see why that would be illegal. Edit: re: reserving the right, https://twitter.com/en/tos https://twitter.com/en/tos does indeed grant Twitter the license to "adapt" and "modify" the content you post to it.
      - amyjess 5y ago
        The MIT license explicitly gives the entire world the right to distribute and modify and project licensed under it. The author isn't allowed any takesie-backsies. Everyone is well within their rights to host copies of faker and colors and any other MIT-licensed project in existence regardless of whether or not the author objects to it. If the author didn't want third parties redistributing copies of their code, they shouldn't have released it under the MIT license.
      - kall 5y ago
        Well I didn't explicitly license my tweets to allow that, so maybe not. But they probably are, anyway. What's really the difference between "fork the repos and change the fork" and "seize and modify somebody else's IP without permission". It just comes down to the specific reference/name on GitHub and npm. I don't think there are any IP issues involved. I am pretty sure that those platforms have given themselves unlimited rights to do whatever they want with the identifiers inside their platform. You don't "own" a username on social media. Maybe the worst that could be said is that they are impersonating someone, which might be illegal? IANAL as should be obvious.
        5y ago
  - bastawhiz 5y ago
    The person who holds the copyright doesn't own the storage for the repo. They agreed to a terms of service, which they almost certainly violated by pushing malicious code. Microsoft undid a change; that's not even derivative, it's literally the same code that the author published. To claim that Microsoft can't remove content from GitHub is wild.
    - GeekyBear 5y ago
      While I agree that Microsoft has every right to deny service to the developer, ban their account and remove all of their repos, that doesn't mean that Microsoft has the right to forcibly seize the developers IP.
      - bastawhiz 5y ago
        What action here constitutes the seizure of IP? The code was licensed under MIT. The developer is free to host it elsewhere and Microsoft retains no rights other than the ones explicitly granted to them.
  - profmonocle 5y ago
    Being the copyright owner of a piece of OSS doesn't give you control over every location where that software is hosted. For example, the developers of Python can't update the Python package in Debian's apt repo, Debian decides when to pull in new versions. (And if they want to add custom patches.) This doesn't mean Debian is declaring ownership of Python, they're simply distributing it in accordance with the license. Just because NPM allows developers to self-publish doesn't mean that's a guaranteed perpetual right, and it doesn't mean MIT-licensed packages can't be published on NPM against the developer's wishes. Licensing code under the MIT license (or any common FOSS license really) is the wrong move if you want to control where your software is distributed, and by who.
jopsen 5y ago
It's certainly setting a precedence that Microsoft can assume complete editorial powers over a package. Platforms (as oppose to distributed protocols) enable this, but most platform owners tend to avoid this because users would rightly think it unfair. Bold move by Microsoft, in this case though it's unlikely to backfire.
MattPalmer1086 5y ago
They don't need permission to modify the code under the terms of the license granted by the owner. The owner still owns the code and they can publish it or make it available where they like.
- MattPalmer1086 5y ago
  Although, I can see how altering a repo under someone else's name rather than forking it is problematic. In this case I can forgive them as the repo owner was clearly acting maliciously and causing major problems for many others. We do need to figure out how this sitation should be dealt with in a transparent way in future.
- GeekyBear 5y ago
  They were certainly granted the right to fork the code under the license chosen by the developer (and then make changes to the fork) but that isn't the same thing as changing the original.
  - MattPalmer1086 5y ago
    It's an interesting question as to what constitutes the "original" code. Presumably that exists on the developer's machine. It wasn't written on GitHub. But I do agree that the expectation is that the repo is controlled by the repo owner, and that expectation has been violated.
    - GeekyBear 5y ago
      Surely "the original code" would be the last code committed by the owner of the repo. As always, if we don't like the direction they have taken, the solution is to fork the project. I think it would be a mistake to set precedent based on how much you like or agree with this particular developer.
      - amyjess 5y ago
        The developer only owns the code, not the account. GitHub owns 100% of all accounts on their service.
rzwitserloot 5y ago
Github has a clickthrough license that probably gives them this right. If you are of the legal opinion that one cannot simply wish away some fairly fundamental rights through something as blazé as a clickthrough license, then that's a problem: It means the even-worse-than-clickthrough FOSS licenses that handwave away merchantability surely have no legal standing either. Then, if you are also of the legal opinion that the relationship between FOSS author and FOSS user is a vendor/buyer one, then what Marek did is _illegal_. At which point Github/microsoft surely regain their right to intervene. You are usually allowed to attack someone if they are about to commit a murder, even if that act would in all other circumstances be a slam-dunk assault case. You're now banking on the notion that the relationship between FOSS author and FOSS user is fundamentally not a vendor/buyer relationship even though github has a sponsors system, the FOSS license uses terms that relate to vendor/buyer relationships, and that nevertheless copyright law still does apply. That's possible, certainly, but that's a lot of coinflips that have to land correctly.
- GeekyBear 5y ago
  > Github has a clickthrough license that probably gives them this right. If Microsoft is asserting the right to seize control of anybodies open source project any time they choose, they are going to have much bigger issues than if they had simply made a mistake and overstepped their bounds.
  - chaostheory 5y ago
    In this case, we have a clear, bad actor. MS has a good reason to intervene on their own platform.
  - chii 5y ago
    > seize control of anybodies open source project any time they choose the platform the code is under belongs to microsoft. The only thing they cannot do is impersonate someone (e.g., pretend they were the author and make a commit), because that would be illegal. However, they can roll back a commit from being displayed - it is no different than only showing certain commits (it's a right that a website has - showing _anything_ they wish to). There's no claim of ownership (of the copyright), and there's no seizure of the code IP rights whatsoever (for an example of seizure, see the multitude of DMCA takedowns, which is a right specifically granted to them by the state). Presenting this case as a violation by microsoft is incorrect.

that_guy_iain 5y ago

Didn’t they just revert it to a previous version? A version they are legally allowed to distribute? They are legally allowed to ban people and use whatever urls they want to host git repos. They are also legally allowed to give someone else permision to npm publishing under a specific package name. Seems like they did things they are allowed to do.

iakov 5y ago

profmonocle 5y ago

Microsoft isn't asserting any sort of ownership - colors.js is licensed under MIT. Microsoft is free to make whatever changes they like and redistribute said changes. (But as was already mentioned, they merely dropped the broken versions and set the last working version as "latest".)

GeekyBear 5y ago
> Microsoft isn't asserting any sort of ownership The person who holds the copyright isn't allowed to access the repo. Microsoft changed the code in their repo. Those things don't happen without Microsoft asserting ownership.
- monkeybutton 5y ago
  Who owns repo? The author has a right to package code, but he doesn't want have the right to use other people's platforms to distribute it. This is a lot like twitter bans isn't it?
  - GeekyBear 5y ago
    Is Twitter allowed to change the text of your tweets? As mentioned in the original post, Microsoft had the right to ban the developer, and not host their projects in the future. They also had the right to fork the repos and change the fork in any way they liked. What I don't believe they have is the right to seize and modify somebody else's IP without permission.
    - Arnavion 5y ago
      If you edit a tweet I'm sure Twitter reserves the right to roll back your edit, yes. And I don't see why that would be illegal. Edit: re: reserving the right, https://twitter.com/en/tos https://twitter.com/en/tos does indeed grant Twitter the license to "adapt" and "modify" the content you post to it.
    - amyjess 5y ago
      The MIT license explicitly gives the entire world the right to distribute and modify and project licensed under it. The author isn't allowed any takesie-backsies. Everyone is well within their rights to host copies of faker and colors and any other MIT-licensed project in existence regardless of whether or not the author objects to it. If the author didn't want third parties redistributing copies of their code, they shouldn't have released it under the MIT license.
    - kall 5y ago
      Well I didn't explicitly license my tweets to allow that, so maybe not. But they probably are, anyway. What's really the difference between "fork the repos and change the fork" and "seize and modify somebody else's IP without permission". It just comes down to the specific reference/name on GitHub and npm. I don't think there are any IP issues involved. I am pretty sure that those platforms have given themselves unlimited rights to do whatever they want with the identifiers inside their platform. You don't "own" a username on social media. Maybe the worst that could be said is that they are impersonating someone, which might be illegal? IANAL as should be obvious.
      - 5y ago
- bastawhiz 5y ago
  The person who holds the copyright doesn't own the storage for the repo. They agreed to a terms of service, which they almost certainly violated by pushing malicious code. Microsoft undid a change; that's not even derivative, it's literally the same code that the author published. To claim that Microsoft can't remove content from GitHub is wild.
  - GeekyBear 5y ago
    While I agree that Microsoft has every right to deny service to the developer, ban their account and remove all of their repos, that doesn't mean that Microsoft has the right to forcibly seize the developers IP.
    - bastawhiz 5y ago
      What action here constitutes the seizure of IP? The code was licensed under MIT. The developer is free to host it elsewhere and Microsoft retains no rights other than the ones explicitly granted to them.
- profmonocle 5y ago
  Being the copyright owner of a piece of OSS doesn't give you control over every location where that software is hosted. For example, the developers of Python can't update the Python package in Debian's apt repo, Debian decides when to pull in new versions. (And if they want to add custom patches.) This doesn't mean Debian is declaring ownership of Python, they're simply distributing it in accordance with the license. Just because NPM allows developers to self-publish doesn't mean that's a guaranteed perpetual right, and it doesn't mean MIT-licensed packages can't be published on NPM against the developer's wishes. Licensing code under the MIT license (or any common FOSS license really) is the wrong move if you want to control where your software is distributed, and by who.

jopsen 5y ago

It's certainly setting a precedence that Microsoft can assume complete editorial powers over a package. Platforms (as oppose to distributed protocols) enable this, but most platform owners tend to avoid this because users would rightly think it unfair. Bold move by Microsoft, in this case though it's unlikely to backfire.

MattPalmer1086 5y ago

They don't need permission to modify the code under the terms of the license granted by the owner. The owner still owns the code and they can publish it or make it available where they like.

MattPalmer1086 5y ago
Although, I can see how altering a repo under someone else's name rather than forking it is problematic. In this case I can forgive them as the repo owner was clearly acting maliciously and causing major problems for many others. We do need to figure out how this sitation should be dealt with in a transparent way in future.
GeekyBear 5y ago
They were certainly granted the right to fork the code under the license chosen by the developer (and then make changes to the fork) but that isn't the same thing as changing the original.
- MattPalmer1086 5y ago
  It's an interesting question as to what constitutes the "original" code. Presumably that exists on the developer's machine. It wasn't written on GitHub. But I do agree that the expectation is that the repo is controlled by the repo owner, and that expectation has been violated.
  - GeekyBear 5y ago
    Surely "the original code" would be the last code committed by the owner of the repo. As always, if we don't like the direction they have taken, the solution is to fork the project. I think it would be a mistake to set precedent based on how much you like or agree with this particular developer.
    - amyjess 5y ago
      The developer only owns the code, not the account. GitHub owns 100% of all accounts on their service.

rzwitserloot 5y ago

Github has a clickthrough license that probably gives them this right. If you are of the legal opinion that one cannot simply wish away some fairly fundamental rights through something as blazé as a clickthrough license, then that's a problem: It means the even-worse-than-clickthrough FOSS licenses that handwave away merchantability surely have no legal standing either. Then, if you are also of the legal opinion that the relationship between FOSS author and FOSS user is a vendor/buyer one, then what Marek did is _illegal_. At which point Github/microsoft surely regain their right to intervene. You are usually allowed to attack someone if they are about to commit a murder, even if that act would in all other circumstances be a slam-dunk assault case. You're now banking on the notion that the relationship between FOSS author and FOSS user is fundamentally not a vendor/buyer relationship even though github has a sponsors system, the FOSS license uses terms that relate to vendor/buyer relationships, and that nevertheless copyright law still does apply. That's possible, certainly, but that's a lot of coinflips that have to land correctly.

GeekyBear 5y ago
> Github has a clickthrough license that probably gives them this right. If Microsoft is asserting the right to seize control of anybodies open source project any time they choose, they are going to have much bigger issues than if they had simply made a mistake and overstepped their bounds.
- chaostheory 5y ago
  In this case, we have a clear, bad actor. MS has a good reason to intervene on their own platform.
- chii 5y ago
  > seize control of anybodies open source project any time they choose the platform the code is under belongs to microsoft. The only thing they cannot do is impersonate someone (e.g., pretend they were the author and make a commit), because that would be illegal. However, they can roll back a commit from being displayed - it is no different than only showing certain commits (it's a right that a website has - showing _anything_ they wish to). There's no claim of ownership (of the copyright), and there's no seizure of the code IP rights whatsoever (for an example of seizure, see the multitude of DMCA takedowns, which is a right specifically granted to them by the state). Presenting this case as a violation by microsoft is incorrect.