10 ms·

This Program is Illegally Packaged in 14 Distributions

153 points by xena 4y ago

cyclotron3k 4y ago
GitHub deserves better that comic sans
- nextaccountic 4y ago
  LOL!! In all seriousness, Comic Sans is actually a great font for people with dyslexia, because the unique shapes make it easier to distinguish letters. http://omgfacts.com/comic-sans-helps-people-with-dyslexia/ http://omgfacts.com/comic-sans-helps-people-with-dyslexia/ (a font like Open Dyslexic is probably even better https://opendyslexic.org/ https://opendyslexic.org/ but I guess it's a matter of taste and familiarity)
metadat 4y ago
This reads like an old lady harping over nothing consequence. Did the author of TFA try to contact the Gentoo folks about this discrepancy before writing this incendiary blog post assuming negative/incompetent/ignorant intent? People are doing their level best to be respectful of other's wishes, but it's tough to account for every edge case. Is the author of the unlicensed code upset? It doesn't seem so. Why not be part of the solution? Oh wait, being part of the solution doesn't generate attention. Thanks for posting this, xena.
- dijit 4y ago
  I think we read a different article. How I read it: The author is surprised that when packaging their program for Gentoo; they discovered (while following the licensing guidelines) that there was a dependency in their chain that had no license, which makes the result not open source. Gentoos packaging guidelines aren't arbitrary when it comes to licensing, they're precisely right that statically linked binaries are licensed with _all_ dependencies, so any distro shipping his program is doing so illegally. Technically.
  - metadat 4y ago
    Revision: thanks for the feedback, I'm going to bed. Goodnight HN friends!
    - dijit 4y ago
      Why did you read it as inflammatory? I read it more of a "oh shit, I just discovered this issue in code I was packaging; maybe you, reader, have the same issue in your code!"
    - KerrAvon 4y ago
      I read it the same way as dijit. I would also add that it’s an interesting view into how licensing is supposed to be declared in modern Linux distributions and what happens when that breaks a little bit. I‘be only lightly used Linux since somewhere around 2002, mostly Raspbian, so it may not be as interesting to others?
  - judge2020 4y ago
    To add, as the article says, the GH issue[0] was posted on Dec 18, 2020 by Norwin @noerw who is a member of the Gitea GitHub organization[1], so Gitea is definitely well-intentioned on clarifying the license of code it uses. 0: https://github.com/seletskiy/godiff/issues/4 https://github.com/seletskiy/godiff/issues/4 1: https://github.com/orgs/go-gitea/people?query=noerw https://github.com/orgs/go-gitea/people?query=noerw
- xdavidliu 4y ago
  Parent comment instantly reminded me of Paul Graham's essay "How to disagree" [1]. Parent comment seems to get up to DH2 but not much further. [1] http://www.paulgraham.com/disagree.html http://www.paulgraham.com/disagree.html
- emptyparadise 4y ago
  Last time I saw such disregard for software licenses, it was packaged up and branded as GitHub Copilot.
  - deleted 4y ago
    [deleted]
thombles 4y ago
RE: the N/A in ripgrep dependencies specifically, it's a little clearer on my machine (newer version of cargo-license maybe?). Slightly complicated but still above board https://github.com/hsivonen/encoding_rs#licensing https://github.com/hsivonen/encoding_rs#licensing > Custom License File (1): encoding_rs
deleted 4y ago
[deleted]
iamcorpix 4y ago
Haha, this is why I am using Unlicense license for almost everything. Licenses create unnecessary fuzz. As a technician I have no interest in them
- tadfisher 4y ago
  It's my cursory understanding that the Unlicense is equivalent to "© iamcorpix, All rights reserved" in jurisdictions that don't have a legal mechanism to completely disclaim copyright (e.g. the United States). Essentially, you can dedicate your copyright interest to the public domain, but you will always retain the ability to revoke that dedication as the original author of the work. It's much easier to just use MIT, which is functionally the same, but in legal terms you are granting a perpetual license that can't be revoked.
  - naniwaduni 4y ago
    While there is legitimate variation in how jurisdictions will treat a public domain dedication (e.g. wrt rights which can be relinquished vs can't be relinquished vs must be explicitly forgone, which a public domain dedication doesn't necessarily achieve), realistically (a) you're pretty unlikely to get sued by someone who tried to dedicate their thing to the public domain (b) the intersection of "jurisdictions that will read a foreign litigant's public domain dedication as All rights reserved" and "jurisdictions whose opinions anyone particularly cares about" is approximately empty.
  - MatthiasPortzel 4y ago
    While the OSI doesn't particularly like the Unlicense, they say > There was some discussion about the legal effectiveness of the document, in particular how it would operate in a jurisdiction where one cannot dedicate a work to the public domain. The lawyers who opined on the issue, both US and non-US, agreed that the document would most likely be interpreted as a license and that the license met the OSD. And for that reason, the Unlicense is an approved open source license. https://lists.opensource.org/pipermail/license-review_lists.opensource.org/2020-June/004890.html https://lists.opensource.org/pipermail/license-review_lists....
  - 4y ago
jahewson 4y ago
Indeed they are not a lawyer. A lawyer would know that this is not illegal. It violates the rights of the copyright holder, but that’s not a crime.
- na85 4y ago
  edit: I stand corrected
  - deleted 4y ago
    [deleted]
  - zb 4y ago
    Lawyers make a distinction between "illegal" (crimes) and "unlawful" (torts) that is mostly lost on the general public.
    - kube-system 4y ago
      And some acts, like copyright infringement, can be both criminal and civil violations.
      - eru 4y ago
        See also 'wrongful death'. https://en.wikipedia.org/wiki/Wrongful_death_claim https://en.wikipedia.org/wiki/Wrongful_death_claim
    - LudwigNagasena 4y ago
      Do you have any references? That doesn’t sound true. From dictionary.law.com: illegal adj. in violation of statute, regulation or ordinance, which may be criminal or merely not in conformity. Thus, an armed robbery is illegal, and so is an access road which is narrower than the county allows, but the violation is not criminal. unlawful adj. referring to any action which is in violation of a statute, federal or state constitution, or established legal precedents
  - kube-system 4y ago
IvanAchlaqullah 4y ago
At least it's just unlicensed, not something worse like AGPL /s Yes, it's a joke and it's funny when several companies, including Google [1] are very scared of that license. [1] https://opensource.google/documentation/reference/using/agpl-policy https://opensource.google/documentation/reference/using/agpl...
- charcircuit 4y ago
  Having no license is worse than AGPL to companies like Google.
  - judge2020 4y ago
    No license is inherently "All Rights Reserved", so you're correct.
burntsushi 4y ago
Author of ripgrep here. Maybe, umm, don't depend on auto-detection tools as the ultimate source of whether something is appropriately licensed or not? encoding_rs is clearly licensed, otherwise I wouldn't have used it in ripgrep: https://github.com/hsivonen/encoding_rs https://github.com/hsivonen/encoding_rs Take it up with the auto-detection tools. Or at least do your due diligence before claiming ripgrep is using "unlicensed" code. The Debian copyright notice is correct for ripgrep.
- jsmith45 4y ago
  The encoding part is one concern, but what about ryu? Is “Apache-2.0 OR BSL-1.0” not accurate? Neither of those showed up in the grep for license lines? Sure, BSL is an obviously free license that is basically just a wording variant of MIT, but it is not showing up in that grep. Note: I’ve not actually read the copyright file, So perhaps It is clearly accounted for there, but is just not formatted in a way that the grep query used can find it.
  - dwaite 4y ago
    https://github.com/dtolnay/ryu https://github.com/dtolnay/ryu lists that choice of license in its README, in its Cargo.toml, and includes the license texts in its repository.
  - jsmith45 4y ago
    I have verified that ryu is a dependency of json_serde, which is a dependency of ripgrep. Apache-2.0 OR BSL-1.0 is indeed the correct license for ryu. It is not included in the Debian copyright file. I suppose this is because the library is not included in the source package, and the BSL does not mandate notice preservation for a binary output. And Debian policy for the copyright file is that only notices or info that must be preserved are required to be present in the file.
    - Aissen 4y ago
      Funny, I initially thought that BSL was the infamous Business Source License, a proprietary source-available license with an automatic switch to (usually) Apache 2.0 four years after each release. But no, it was the Boost Software License. https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BUSL-1.1.html https://spdx.org/licenses/BUSL-1.1.html
ornel 4y ago
I wish I hadn't followed the link to turducken. I can't unsee it now
seri4l 4y ago
This makes me wonder: has any judge ruled in favor of a plaintiff seeking compensation from people that used or redistributed software that he published on the internet for free without any copyright notice or disclaimer?
- topkai22 4y ago
  I was thinking the same. It being published on GitHub makes it especially difficult to claim damages for reuse, as I think it’s fair to say the very act of publishing to GitHub implies a desire to share the code. The real issue would be if the author decides they want to close source it later, updates the license, and then demands everyone stop using it.
  - lionkor 4y ago
    > the very act of publishing to GitHub implies a desire to share the code. No. Thats like saying the very act of sharing pictures online implies you want someone else to use them, or that printing your book and selling it somehow implies you want the world to copy it. You share on GitHub because its a source control platform, and your code may be interesting to others. This does NOT mean that you are okay with someone taking the code and using it in their (potentially commercial) program. That is NOT implied, and thats why licenses exist. You could even argue that, as GitHub has license detection etc. built in, sharing and reading code there should mean you are aware of licensing.
    - ormaaj 4y ago
      > No. Thats like saying the very act of sharing pictures online implies you want someone else to use them, or that printing your book and selling it somehow implies you want the world to copy it. Please explain how you are viewing this unlicensed reply without downloading it. > You share on GitHub because its a source control platform, and your code may be interesting to others. This does NOT mean that you are okay with someone taking the code and using it in their (potentially commercial) program. Please explain how HN is not taking my unlicensed reply and using it in their commercial HTML code sent to your web browser.
crepetartar 4y ago
personally, i believe that comic neue would be the far better option better license too!
tentacleuno 4y ago
The title feels very cheesy and reeks of clickbait. The fact that it claims the distribution of the program is illegal, and then rushes in with "I am not a lawyer." to signal uncertainty, does not leave a very good taste in my mouth.
- judge2020 4y ago
  This saying is generally best-practice to CYA in case anyone reading the statement thinks you might be giving them actual legal advice [0] - although for something as benign as this, it might be overkill. 0: https://en.wikipedia.org/wiki/IANAL https://en.wikipedia.org/wiki/IANAL
xupybd 4y ago
> Can someone please tell me what the fuck is going on with licensing because I am losing my goddamn mind. This seems like a storm in a tea cup to me. Distros are made of thousands of packages. The maintainers are supposed to get the license details correct but sometimes humans error. When these errors get buried deep into things and no one is auditing them, they go unnoticed. No need for anyone to lose their mind over that. It's life.
- rroot 4y ago
  Its not a storm in a tea cup. A lot of people had relaxed attitude towards licensing text. Then SCO came a long, partially funded by Microsoft and threatened everyone using Linux due to alleged licensing issues. This was a major issue. https://en.m.wikipedia.org/wiki/SCO%E2%80%93Linux_disputes https://en.m.wikipedia.org/wiki/SCO%E2%80%93Linux_disputes
  - jchw 4y ago
    That is quite a different beast in numerous ways, and I'm failing to see the connection.
    - rroot 4y ago
      Yes, because the beast grew to a behemoth. But the fundamental issue is the same: code with unknown/issues with licensing. There is absolutely no reason to take that lightly. Yes it might turn into absolutely nothing. What happens if years down the line someone like Oracle acquires code that 1000s of projects depend on?
      - jchw 4y ago
        Because it can be fixed trivially, eliminating the threat? Literally, it already happened here: https://github.com/seletskiy/godiff/commit/865648740d705a24a9cf927dfa73f458322141d9 https://github.com/seletskiy/godiff/commit/865648740d705a24a... Just as described, the problem was raised and then fixed. Now let's assume someone like Oracle goes and acquires 1000 unlicensed tiny open source projects, just to be a dick, and closes their source and begins copyright trolling. Here's what happens: people switch off of those projects. I'm not trying to diminish the usefulness of godiff; it is useful! But it's not literally irreplaceable; there may even already be other options in the ecosystem, and if there's not, it's not something that can't be removed temporarily, and replaced long-term. This blog post is a little alarmist IMO, but people who do this kind of sleuthing are doing a service to the open source community, because yes, issues like this can just be mitigated.
3np 4y ago
Where and how would this be illegal? Besides "it seems like it should be". I'm not aware of any precedence or regulation here and would appreciate links if anyone else is. > So, to recap, we’ve got distributions of a go package that includes entirely unlicensed code, which I will remind you does NOT mean you get to just use it because you feel like it. It also does not automatically mean you do not get to use it. It may be illegal and it may not be, depending on multiple factors. It's prudent to be conservative and require proper licenses like the policies of the distributions state but that does not make it illegal. What's considered "fair use" and what that entails differs a lot from place to place. I'm fairly certain that even in jurisdictions where stuff like this would be problematic, a judge or jury would not rule guilty. Intent matters. Now, if the copyright holder contacted the distributions, made them aware of the situation, and asked them to stop distributing it or amend the license situation, and the distributions don't comply in a timely manner, that would be a completely different story. IANAL anyway and I fully agree slip-ups like these are not a good look and should all be addressed but I have a strong hunch that the main claim in OP is false.
hlieberman 4y ago
Some distributions take this more seriously than others. Debian, historically, is the largest stickler about this. I've had to delay packaging things for licensing problems[1], written 1000+ line d/copyright files[2], etc. Not all distributions will take the investigations that seriously. I'm not saying that Debian always gets it right either! Just, there's an emphasis on doing so. [1]: https://github.com/openstenoproject/plover/issues/560 https://github.com/openstenoproject/plover/issues/560 [2]: https://metadata.ftp-master.debian.org/changelogs//main/a/ansible/ansible_5.5.0-1_copyright https://metadata.ftp-master.debian.org/changelogs//main/a/an...
- nextaccountic 4y ago
  On the other hand, once Debian does due diligence, people can link up the findings on discussions of other distros. Most distros don't care about investigating those issues, but most distros also don't want to distribute code with clear legal issues. Also it's usually pretty straightforward to solve most of those problems. Cease distribution and contact the authors, and if they are unresponsive either replace the troublesome code (if it's trivial), or patch the program to not use the code (if it's not the main thing the program is about), or give up packaging the program in the official repositories.
deleted 4y ago
[deleted]
frebdo 4y ago
I am not a lawyer either, but as a practical matter, it's not illegal unless a judge says so. reminder
approxim8ion 4y ago
Anything unlicensed should be treated as coming with a permissive license. If you care so much about protecting your IP, take the effort to write up a license or make it proprietary. I am aware that is not how it is now, but in my opinion that is how it should be.
- goerz 4y ago
  While I might agree that it would be nice that code without a license was public domain, that's most certainly not the legal situation we have right now. If there's no license, you can't redistribute it at all.
- UncleEntity 4y ago
  The law says the exact opposite of this advice, it is a good way to get to know some lawyers though.
- lionkor 4y ago
  You almost certainly do not want to have this, because countries like Germany have very strict copyright law. Youd end up having to check which law applies, from which country, etc.
tex0 4y ago
Welcome to dependency hell. But then many packages are so trivial that they shouldn't even require a license. Same goes for abandoned projects.
darthrupert 4y ago
It cannot be the responsibility of the distro packager to make sure the licenses of the software aren't lies. That's just not going to happen.
ormaaj 4y ago
Funny they specifically point to Gentoo. Gentoo, organizations hosting mirrors, and users are probably least likely of all to be affected by such a situation (binhosts aside) as gentoo only distributes the verbatim source for which the uploader (assuming same as copyright holder) has granted an implied license by way of publishing their work to github. It would be very difficult to claw back their intent to offer the code for public use given the context of a forum principally devoted to collaborative development of open-source works. Also no clue why the author believes static linking or any technical means of linkage of the compiled binaries would be in any way relevant to distribution of the unlicensed source code. No doubt all of this work is unregistered too. Have fun arguing for actual damages caused by a clearly deliberate publishing and distribution of an unregistered work.
- nextaccountic 4y ago
  The implied license you give when uploading to Github is this https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#4-license-grant-to-us https://docs.github.com/en/site-policy/github-terms/github-t... > 4. License Grant to Us > We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video. > This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service, except that as part of the right to archive Your Content, GitHub may permit our partners to store and archive Your Content in public repositories in connection with the GitHub Arctic Code Vault and GitHub Archive Program. Unfortunately this implied license is only granted to Github itself. Maybe this could work if Github created their own version of Gentoo though.
  - ormaaj 4y ago
    That is a contract, not a license. Or more accurately it's a contract with a copyright license embedded within its terms. This is an agreement with github to grant it an explicit license. Implied license is an implicit license. It may exist irrespective to any such agreements. Its implicit creation is an affirmative defense determined entirely by other factors and context. The bar for this as a defense can be quite high, as it requires a clear intention to license the work as determined by a judge or jury. Independent to the implied license doctrine there exists doctrine which governs mirroring, caching, and transferring of that content by 3rd parties and intermediaries. The combination of these is largely what makes sharing anything on the internet in lieu of licenses possible. "user agreements" or "terms of use" are contracts that are essentially a redundant measure that gives parties like github much stronger protection, so that it doesn't have to rely upon any risky affirmative defense tactics that require meeting high legal thresholds.
londons_explore 4y ago
I often deliberately publish code with no license. It means any hobbyist can play around with it, but no company with a legal team will touch it. It appears as an oversight rather than a deliberate decision to restrict who can do what. And often that's exactly what I want.
- irdc 4y ago
  > It means any hobbyist can play around with it Not in legal terms it doesn't. In the absence of a licence, a copyrighted work may not be distributed in any way. So you could theoretically sue those hobbyists. Just bite the bullet and pick any of the common licenses. Sounds like you'd want one of CC-*-NC or perhaps AGPL.
  - londons_explore 4y ago
    Except no hobbyist seems to worry about such things. Occasionally I get messages asking me about the license, and I usually reply to them asking what they want to do/build and then I give them permission for whatever it is they want to make (for free).
    - irdc 4y ago
      > Except no hobbyist seems to worry about such things. The hobbyists that you know or have contacted you don't seem to worry about these things. I can assure you this hobbyist takes licensing very seriously, and I'm not the only one. I may at some point want to distribute my work, and having a dependency without a license makes that pretty much impossible.
    - pseudalopex 4y ago
      The 2nd sentence sounds like hobbyists worrying about such things.
- wink 4y ago
  I don't think that's helpful, because that's just not how licenses work. Please at least add that sentence to the repo then. Unless your definition of "hobbyist playing around with it" also includes "oh, I accidentally made something useful which uses your code, but now I have to rewrite it because I can't in turn use a useful license".
di4na 4y ago
On "what is happening here". The legal rules of licensing and copyright are basically a pita for everyone and nearly impossible to apply them at scale. So everyone in this field, IP holders and users have all tacitly agreed on a social contract that is quite different from the reality of the law. This small niche of society is small enough and poor enough that the law have not had to catch up to it yet. This is a ... typical thing to happen. If it grows big enough, the law may catch up. Or the social contract may have to catch up. Or more probably a mix. This is usually painful. Consider that Free and Open Source Licences are kind of a hack to paper over that gap. It has been enough so far to keep the two worlds from colliding too hard. But it is a fundamentally limited way to bridge it.
seletskiy 4y ago
'seletskiy/godiff' author here. In my judgment, the problem has been overstated. At the very least, with the 'tea,' it could be easily resolved by contacting me directly via e-mail, as mentioned in my GitHub profile. I never intended for this code to be used by anyone else (there is no even a README file). But I'm delighted it helped someone attain their goals. Anyway, I've stated that my code is MIT licensed.
imrejonk 4y ago
The author of the Go diff library has just released it under the MIT license: https://github.com/seletskiy/godiff/commit/865648740d705a24a9cf927dfa73f458322141d9 https://github.com/seletskiy/godiff/commit/865648740d705a24a...
h2odragon 4y ago
Anyone think the new "SBoM" efforts won't have this problem? I don't. I think the SBoM's are likely to be full of horseshit entered by people just trying to get a job done, and rarely if ever reviewed and corrected.
eclipseo76 4y ago
As one packaging Go daily for a distro, this doesn't surprise me (though thanks God we are not affected, probably because we unbundle everything and the license for each lib is then verified). Contrary to the Rust ecosystem, there is no central repo location or Cargo.toml that easily allow to parse the licenses used. So no cargo license commands. For static binaries we build, we don't have the entire set of licenses because the chain of dependencies can reach up to 650 packages.

153 points by xena 4y ago

cyclotron3k 4y ago

GitHub deserves better that comic sans

nextaccountic 4y ago
LOL!! In all seriousness, Comic Sans is actually a great font for people with dyslexia, because the unique shapes make it easier to distinguish letters. http://omgfacts.com/comic-sans-helps-people-with-dyslexia/ http://omgfacts.com/comic-sans-helps-people-with-dyslexia/ (a font like Open Dyslexic is probably even better https://opendyslexic.org/ https://opendyslexic.org/ but I guess it's a matter of taste and familiarity)

metadat 4y ago

This reads like an old lady harping over nothing consequence. Did the author of TFA try to contact the Gentoo folks about this discrepancy before writing this incendiary blog post assuming negative/incompetent/ignorant intent? People are doing their level best to be respectful of other's wishes, but it's tough to account for every edge case. Is the author of the unlicensed code upset? It doesn't seem so. Why not be part of the solution? Oh wait, being part of the solution doesn't generate attention. Thanks for posting this, xena.

dijit 4y ago
I think we read a different article. How I read it: The author is surprised that when packaging their program for Gentoo; they discovered (while following the licensing guidelines) that there was a dependency in their chain that had no license, which makes the result not open source. Gentoos packaging guidelines aren't arbitrary when it comes to licensing, they're precisely right that statically linked binaries are licensed with _all_ dependencies, so any distro shipping his program is doing so illegally. Technically.
- metadat 4y ago
  Revision: thanks for the feedback, I'm going to bed. Goodnight HN friends!
  - dijit 4y ago
    Why did you read it as inflammatory? I read it more of a "oh shit, I just discovered this issue in code I was packaging; maybe you, reader, have the same issue in your code!"
  - KerrAvon 4y ago
    I read it the same way as dijit. I would also add that it’s an interesting view into how licensing is supposed to be declared in modern Linux distributions and what happens when that breaks a little bit. I‘be only lightly used Linux since somewhere around 2002, mostly Raspbian, so it may not be as interesting to others?
- judge2020 4y ago
  To add, as the article says, the GH issue[0] was posted on Dec 18, 2020 by Norwin @noerw who is a member of the Gitea GitHub organization[1], so Gitea is definitely well-intentioned on clarifying the license of code it uses. 0: https://github.com/seletskiy/godiff/issues/4 https://github.com/seletskiy/godiff/issues/4 1: https://github.com/orgs/go-gitea/people?query=noerw https://github.com/orgs/go-gitea/people?query=noerw
xdavidliu 4y ago
Parent comment instantly reminded me of Paul Graham's essay "How to disagree" [1]. Parent comment seems to get up to DH2 but not much further. [1] http://www.paulgraham.com/disagree.html http://www.paulgraham.com/disagree.html
emptyparadise 4y ago
Last time I saw such disregard for software licenses, it was packaged up and branded as GitHub Copilot.
- deleted 4y ago
  [deleted]

thombles 4y ago

RE: the N/A in ripgrep dependencies specifically, it's a little clearer on my machine (newer version of cargo-license maybe?). Slightly complicated but still above board https://github.com/hsivonen/encoding_rs#licensing https://github.com/hsivonen/encoding_rs#licensing > Custom License File (1): encoding_rs

deleted 4y ago

[deleted]

iamcorpix 4y ago

Haha, this is why I am using Unlicense license for almost everything. Licenses create unnecessary fuzz. As a technician I have no interest in them

tadfisher 4y ago
It's my cursory understanding that the Unlicense is equivalent to "© iamcorpix, All rights reserved" in jurisdictions that don't have a legal mechanism to completely disclaim copyright (e.g. the United States). Essentially, you can dedicate your copyright interest to the public domain, but you will always retain the ability to revoke that dedication as the original author of the work. It's much easier to just use MIT, which is functionally the same, but in legal terms you are granting a perpetual license that can't be revoked.
- naniwaduni 4y ago
  While there is legitimate variation in how jurisdictions will treat a public domain dedication (e.g. wrt rights which can be relinquished vs can't be relinquished vs must be explicitly forgone, which a public domain dedication doesn't necessarily achieve), realistically (a) you're pretty unlikely to get sued by someone who tried to dedicate their thing to the public domain (b) the intersection of "jurisdictions that will read a foreign litigant's public domain dedication as All rights reserved" and "jurisdictions whose opinions anyone particularly cares about" is approximately empty.
- MatthiasPortzel 4y ago
  While the OSI doesn't particularly like the Unlicense, they say > There was some discussion about the legal effectiveness of the document, in particular how it would operate in a jurisdiction where one cannot dedicate a work to the public domain. The lawyers who opined on the issue, both US and non-US, agreed that the document would most likely be interpreted as a license and that the license met the OSD. And for that reason, the Unlicense is an approved open source license. https://lists.opensource.org/pipermail/license-review_lists.opensource.org/2020-June/004890.html https://lists.opensource.org/pipermail/license-review_lists....
- 4y ago

jahewson 4y ago

Indeed they are not a lawyer. A lawyer would know that this is not illegal. It violates the rights of the copyright holder, but that’s not a crime.

na85 4y ago
edit: I stand corrected
- deleted 4y ago
  [deleted]
- zb 4y ago
  Lawyers make a distinction between "illegal" (crimes) and "unlawful" (torts) that is mostly lost on the general public.
  - kube-system 4y ago
    And some acts, like copyright infringement, can be both criminal and civil violations.
    - eru 4y ago
      See also 'wrongful death'. https://en.wikipedia.org/wiki/Wrongful_death_claim https://en.wikipedia.org/wiki/Wrongful_death_claim
  - LudwigNagasena 4y ago
    Do you have any references? That doesn’t sound true. From dictionary.law.com: illegal adj. in violation of statute, regulation or ordinance, which may be criminal or merely not in conformity. Thus, an armed robbery is illegal, and so is an access road which is narrower than the county allows, but the violation is not criminal. unlawful adj. referring to any action which is in violation of a statute, federal or state constitution, or established legal precedents
- kube-system 4y ago

IvanAchlaqullah 4y ago

At least it's just unlicensed, not something worse like AGPL /s Yes, it's a joke and it's funny when several companies, including Google [1] are very scared of that license. [1] https://opensource.google/documentation/reference/using/agpl-policy https://opensource.google/documentation/reference/using/agpl...

charcircuit 4y ago
Having no license is worse than AGPL to companies like Google.
- judge2020 4y ago
  No license is inherently "All Rights Reserved", so you're correct.

burntsushi 4y ago

Author of ripgrep here. Maybe, umm, don't depend on auto-detection tools as the ultimate source of whether something is appropriately licensed or not? encoding_rs is clearly licensed, otherwise I wouldn't have used it in ripgrep: https://github.com/hsivonen/encoding_rs https://github.com/hsivonen/encoding_rs Take it up with the auto-detection tools. Or at least do your due diligence before claiming ripgrep is using "unlicensed" code. The Debian copyright notice is correct for ripgrep.

jsmith45 4y ago
The encoding part is one concern, but what about ryu? Is “Apache-2.0 OR BSL-1.0” not accurate? Neither of those showed up in the grep for license lines? Sure, BSL is an obviously free license that is basically just a wording variant of MIT, but it is not showing up in that grep. Note: I’ve not actually read the copyright file, So perhaps It is clearly accounted for there, but is just not formatted in a way that the grep query used can find it.
- dwaite 4y ago
  https://github.com/dtolnay/ryu https://github.com/dtolnay/ryu lists that choice of license in its README, in its Cargo.toml, and includes the license texts in its repository.
- jsmith45 4y ago
  I have verified that ryu is a dependency of json_serde, which is a dependency of ripgrep. Apache-2.0 OR BSL-1.0 is indeed the correct license for ryu. It is not included in the Debian copyright file. I suppose this is because the library is not included in the source package, and the BSL does not mandate notice preservation for a binary output. And Debian policy for the copyright file is that only notices or info that must be preserved are required to be present in the file.
  - Aissen 4y ago
    Funny, I initially thought that BSL was the infamous Business Source License, a proprietary source-available license with an automatic switch to (usually) Apache 2.0 four years after each release. But no, it was the Boost Software License. https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BUSL-1.1.html https://spdx.org/licenses/BUSL-1.1.html

ornel 4y ago

I wish I hadn't followed the link to turducken. I can't unsee it now

seri4l 4y ago

This makes me wonder: has any judge ruled in favor of a plaintiff seeking compensation from people that used or redistributed software that he published on the internet for free without any copyright notice or disclaimer?

topkai22 4y ago
I was thinking the same. It being published on GitHub makes it especially difficult to claim damages for reuse, as I think it’s fair to say the very act of publishing to GitHub implies a desire to share the code. The real issue would be if the author decides they want to close source it later, updates the license, and then demands everyone stop using it.
- lionkor 4y ago
  > the very act of publishing to GitHub implies a desire to share the code. No. Thats like saying the very act of sharing pictures online implies you want someone else to use them, or that printing your book and selling it somehow implies you want the world to copy it. You share on GitHub because its a source control platform, and your code may be interesting to others. This does NOT mean that you are okay with someone taking the code and using it in their (potentially commercial) program. That is NOT implied, and thats why licenses exist. You could even argue that, as GitHub has license detection etc. built in, sharing and reading code there should mean you are aware of licensing.
  - ormaaj 4y ago
    > No. Thats like saying the very act of sharing pictures online implies you want someone else to use them, or that printing your book and selling it somehow implies you want the world to copy it. Please explain how you are viewing this unlicensed reply without downloading it. > You share on GitHub because its a source control platform, and your code may be interesting to others. This does NOT mean that you are okay with someone taking the code and using it in their (potentially commercial) program. Please explain how HN is not taking my unlicensed reply and using it in their commercial HTML code sent to your web browser.

crepetartar 4y ago

personally, i believe that comic neue would be the far better option better license too!

tentacleuno 4y ago

The title feels very cheesy and reeks of clickbait. The fact that it claims the distribution of the program is illegal, and then rushes in with "I am not a lawyer." to signal uncertainty, does not leave a very good taste in my mouth.

judge2020 4y ago
This saying is generally best-practice to CYA in case anyone reading the statement thinks you might be giving them actual legal advice [0] - although for something as benign as this, it might be overkill. 0: https://en.wikipedia.org/wiki/IANAL https://en.wikipedia.org/wiki/IANAL

xupybd 4y ago

> Can someone please tell me what the fuck is going on with licensing because I am losing my goddamn mind. This seems like a storm in a tea cup to me. Distros are made of thousands of packages. The maintainers are supposed to get the license details correct but sometimes humans error. When these errors get buried deep into things and no one is auditing them, they go unnoticed. No need for anyone to lose their mind over that. It's life.

rroot 4y ago
Its not a storm in a tea cup. A lot of people had relaxed attitude towards licensing text. Then SCO came a long, partially funded by Microsoft and threatened everyone using Linux due to alleged licensing issues. This was a major issue. https://en.m.wikipedia.org/wiki/SCO%E2%80%93Linux_disputes https://en.m.wikipedia.org/wiki/SCO%E2%80%93Linux_disputes
- jchw 4y ago
  That is quite a different beast in numerous ways, and I'm failing to see the connection.
  - rroot 4y ago
    Yes, because the beast grew to a behemoth. But the fundamental issue is the same: code with unknown/issues with licensing. There is absolutely no reason to take that lightly. Yes it might turn into absolutely nothing. What happens if years down the line someone like Oracle acquires code that 1000s of projects depend on?
    - jchw 4y ago
      Because it can be fixed trivially, eliminating the threat? Literally, it already happened here: https://github.com/seletskiy/godiff/commit/865648740d705a24a9cf927dfa73f458322141d9 https://github.com/seletskiy/godiff/commit/865648740d705a24a... Just as described, the problem was raised and then fixed. Now let's assume someone like Oracle goes and acquires 1000 unlicensed tiny open source projects, just to be a dick, and closes their source and begins copyright trolling. Here's what happens: people switch off of those projects. I'm not trying to diminish the usefulness of godiff; it is useful! But it's not literally irreplaceable; there may even already be other options in the ecosystem, and if there's not, it's not something that can't be removed temporarily, and replaced long-term. This blog post is a little alarmist IMO, but people who do this kind of sleuthing are doing a service to the open source community, because yes, issues like this can just be mitigated.

3np 4y ago

Where and how would this be illegal? Besides "it seems like it should be". I'm not aware of any precedence or regulation here and would appreciate links if anyone else is. > So, to recap, we’ve got distributions of a go package that includes entirely unlicensed code, which I will remind you does NOT mean you get to just use it because you feel like it. It also does not automatically mean you do not get to use it. It may be illegal and it may not be, depending on multiple factors. It's prudent to be conservative and require proper licenses like the policies of the distributions state but that does not make it illegal. What's considered "fair use" and what that entails differs a lot from place to place. I'm fairly certain that even in jurisdictions where stuff like this would be problematic, a judge or jury would not rule guilty. Intent matters. Now, if the copyright holder contacted the distributions, made them aware of the situation, and asked them to stop distributing it or amend the license situation, and the distributions don't comply in a timely manner, that would be a completely different story. IANAL anyway and I fully agree slip-ups like these are not a good look and should all be addressed but I have a strong hunch that the main claim in OP is false.

hlieberman 4y ago

Some distributions take this more seriously than others. Debian, historically, is the largest stickler about this. I've had to delay packaging things for licensing problems[1], written 1000+ line d/copyright files[2], etc. Not all distributions will take the investigations that seriously. I'm not saying that Debian always gets it right either! Just, there's an emphasis on doing so. [1]: https://github.com/openstenoproject/plover/issues/560 https://github.com/openstenoproject/plover/issues/560 [2]: https://metadata.ftp-master.debian.org/changelogs//main/a/ansible/ansible_5.5.0-1_copyright https://metadata.ftp-master.debian.org/changelogs//main/a/an...

nextaccountic 4y ago
On the other hand, once Debian does due diligence, people can link up the findings on discussions of other distros. Most distros don't care about investigating those issues, but most distros also don't want to distribute code with clear legal issues. Also it's usually pretty straightforward to solve most of those problems. Cease distribution and contact the authors, and if they are unresponsive either replace the troublesome code (if it's trivial), or patch the program to not use the code (if it's not the main thing the program is about), or give up packaging the program in the official repositories.

deleted 4y ago

[deleted]

frebdo 4y ago

I am not a lawyer either, but as a practical matter, it's not illegal unless a judge says so. reminder

approxim8ion 4y ago

Anything unlicensed should be treated as coming with a permissive license. If you care so much about protecting your IP, take the effort to write up a license or make it proprietary. I am aware that is not how it is now, but in my opinion that is how it should be.

goerz 4y ago
While I might agree that it would be nice that code without a license was public domain, that's most certainly not the legal situation we have right now. If there's no license, you can't redistribute it at all.
UncleEntity 4y ago
The law says the exact opposite of this advice, it is a good way to get to know some lawyers though.
lionkor 4y ago
You almost certainly do not want to have this, because countries like Germany have very strict copyright law. Youd end up having to check which law applies, from which country, etc.

tex0 4y ago

Welcome to dependency hell. But then many packages are so trivial that they shouldn't even require a license. Same goes for abandoned projects.

darthrupert 4y ago

It cannot be the responsibility of the distro packager to make sure the licenses of the software aren't lies. That's just not going to happen.

ormaaj 4y ago

Funny they specifically point to Gentoo. Gentoo, organizations hosting mirrors, and users are probably least likely of all to be affected by such a situation (binhosts aside) as gentoo only distributes the verbatim source for which the uploader (assuming same as copyright holder) has granted an implied license by way of publishing their work to github. It would be very difficult to claw back their intent to offer the code for public use given the context of a forum principally devoted to collaborative development of open-source works. Also no clue why the author believes static linking or any technical means of linkage of the compiled binaries would be in any way relevant to distribution of the unlicensed source code. No doubt all of this work is unregistered too. Have fun arguing for actual damages caused by a clearly deliberate publishing and distribution of an unregistered work.

nextaccountic 4y ago
The implied license you give when uploading to Github is this https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#4-license-grant-to-us https://docs.github.com/en/site-policy/github-terms/github-t... > 4. License Grant to Us > We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video. > This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service, except that as part of the right to archive Your Content, GitHub may permit our partners to store and archive Your Content in public repositories in connection with the GitHub Arctic Code Vault and GitHub Archive Program. Unfortunately this implied license is only granted to Github itself. Maybe this could work if Github created their own version of Gentoo though.
- ormaaj 4y ago
  That is a contract, not a license. Or more accurately it's a contract with a copyright license embedded within its terms. This is an agreement with github to grant it an explicit license. Implied license is an implicit license. It may exist irrespective to any such agreements. Its implicit creation is an affirmative defense determined entirely by other factors and context. The bar for this as a defense can be quite high, as it requires a clear intention to license the work as determined by a judge or jury. Independent to the implied license doctrine there exists doctrine which governs mirroring, caching, and transferring of that content by 3rd parties and intermediaries. The combination of these is largely what makes sharing anything on the internet in lieu of licenses possible. "user agreements" or "terms of use" are contracts that are essentially a redundant measure that gives parties like github much stronger protection, so that it doesn't have to rely upon any risky affirmative defense tactics that require meeting high legal thresholds.

londons_explore 4y ago

I often deliberately publish code with no license. It means any hobbyist can play around with it, but no company with a legal team will touch it. It appears as an oversight rather than a deliberate decision to restrict who can do what. And often that's exactly what I want.

irdc 4y ago
> It means any hobbyist can play around with it Not in legal terms it doesn't. In the absence of a licence, a copyrighted work may not be distributed in any way. So you could theoretically sue those hobbyists. Just bite the bullet and pick any of the common licenses. Sounds like you'd want one of CC-*-NC or perhaps AGPL.
- londons_explore 4y ago
  Except no hobbyist seems to worry about such things. Occasionally I get messages asking me about the license, and I usually reply to them asking what they want to do/build and then I give them permission for whatever it is they want to make (for free).
  - irdc 4y ago
    > Except no hobbyist seems to worry about such things. The hobbyists that you know or have contacted you don't seem to worry about these things. I can assure you this hobbyist takes licensing very seriously, and I'm not the only one. I may at some point want to distribute my work, and having a dependency without a license makes that pretty much impossible.
  - pseudalopex 4y ago
    The 2nd sentence sounds like hobbyists worrying about such things.
wink 4y ago
I don't think that's helpful, because that's just not how licenses work. Please at least add that sentence to the repo then. Unless your definition of "hobbyist playing around with it" also includes "oh, I accidentally made something useful which uses your code, but now I have to rewrite it because I can't in turn use a useful license".

di4na 4y ago

On "what is happening here". The legal rules of licensing and copyright are basically a pita for everyone and nearly impossible to apply them at scale. So everyone in this field, IP holders and users have all tacitly agreed on a social contract that is quite different from the reality of the law. This small niche of society is small enough and poor enough that the law have not had to catch up to it yet. This is a ... typical thing to happen. If it grows big enough, the law may catch up. Or the social contract may have to catch up. Or more probably a mix. This is usually painful. Consider that Free and Open Source Licences are kind of a hack to paper over that gap. It has been enough so far to keep the two worlds from colliding too hard. But it is a fundamentally limited way to bridge it.

seletskiy 4y ago

'seletskiy/godiff' author here. In my judgment, the problem has been overstated. At the very least, with the 'tea,' it could be easily resolved by contacting me directly via e-mail, as mentioned in my GitHub profile. I never intended for this code to be used by anyone else (there is no even a README file). But I'm delighted it helped someone attain their goals. Anyway, I've stated that my code is MIT licensed.

imrejonk 4y ago

The author of the Go diff library has just released it under the MIT license: https://github.com/seletskiy/godiff/commit/865648740d705a24a9cf927dfa73f458322141d9 https://github.com/seletskiy/godiff/commit/865648740d705a24a...

h2odragon 4y ago

Anyone think the new "SBoM" efforts won't have this problem? I don't. I think the SBoM's are likely to be full of horseshit entered by people just trying to get a job done, and rarely if ever reviewed and corrected.

eclipseo76 4y ago

As one packaging Go daily for a distro, this doesn't surprise me (though thanks God we are not affected, probably because we unbundle everything and the license for each lib is then verified). Contrary to the Rust ecosystem, there is no central repo location or Cargo.toml that easily allow to parse the licenses used. So no cargo license commands. For static binaries we build, we don't have the entire set of licenses because the chain of dependencies can reach up to 650 packages.