6 ms·

> One thing that’s a little disappointing: Ghost uses the MIT license, one of the most permissive OSS licenses there is. Essentially, anyone can do anything the

> One thing that’s a little disappointing: Ghost uses the MIT license, one of the most permissive OSS licenses there is. Essentially, anyone can do anything they want with our code, with ONE basic requirement: You must include copyright attribution. Which they have not. For a SaaS app, wouldn't that copyright attribution be on the server side, where the code is (hidden from the end user)? Is John stating he expects that copyright attribution to be in the "view source" of the HTML or some other user accessible location? What happens if that HTML/JS is minified/stripped/"compiled"? IANAL: but I'm genuinely curious how this situation is handled. https://twitter.com/JohnONolan/status/1602330414269472769 https://twitter.com/JohnONolan/status/1602330414269472769

kolaente 4y ago
As far as I understand it, MIT only requires you to include the attribution next to the binary so ias you guessed next to the source code on the server. However, the js shipped to clients is usually minified and transformed which means it may count as "compiled" and thus the same rules as for binaries would apply. Cases like these are the reason why the AGPL exists.
- makkesk8 4y ago
  I highly doubt you can count minified as "compiled" Minification is a form of compression. Compilation is a form of conversion from a high level to a lower level interpretation and that is fundamentally different. But then again I'm not a lawyer :)
  - jdsully 4y ago
    The intent is for attribution to be kept with the code. If your minifier removes the attribution you’re likely in violation.
    - bombcar 4y ago
      And the minifier’s job is to remove things like comments which is right where the attribution is likely to be. Now if a third party thing like a cloudflare CDN were minifyer for you and removed it then who violated the license?
      - jdsully 4y ago
        If the CDN is just a part of your architecture that you voluntarily setup then you’re likely the one violating. Even if not the CDN very likely has an indemnification clause in their contract which would shift that liability back to you.
      - shawnz 4y ago
        There is an informal standard in which copyright notices are annotated with a leading "/*!” to let minifiers know that they should be preserved. See https://stackoverflow.com/questions/11248363/the-purpose-of-starting-an-initial-comment-with-in-javascript-and-css-files https://stackoverflow.com/questions/11248363/the-purpose-of-...
  - thomasballinger 4y ago
    I figure compilation is a big tent and this counts, but imagine --rename-properties WARNING: renaming properties requires deeper analysis, considered compilation in the US
  - jairajs89 4y ago
    Hey, Substack CTO here. We actually don't minify or modify the files in question at all and simply link to the versions hosted on the public jsdelivr CDN (which includes a link to the license right at the top of the file)
  - cxr 4y ago
    First off: weird take, and one that would be unlikely to hold up. But secondly: what is that supposed to matter, anyway? That is, why are you litigating the definition of the word "compiled"? No finding, whether for or against your argument, would have any bearing on questions about compliance with the terms of the MIT license, so the word's definition and its significance is null. It's a total red herring and a distraction to bring up in any discussion on the topic.
- shafyy 4y ago
  > Cases like these are the reason why the AGPL exists Exactly. Not sure why they Ghost doesn't use AGPL. Still, it would have been kind of fair from Substack to approach this more open and collaboratively...
  - freedomben 4y ago
    Because AGPL probably would have made it a no-go for substack to use. They seem to genuinely want to collaborate: https://twitter.com/JohnONolan/status/1602330416643702784 https://twitter.com/JohnONolan/status/1602330416643702784
    - shafyy 4y ago
      Why would AGPL have made it a no-go for Substack? Also, it looks like Ghost wants to collab but there's nothing from Substack in the Twitter thread you linekd?
      - ushakov 4y ago
        > Ghost wants to collab but there's nothing from Substack Substack doesn't have to "collaborate" do they?
      - giantrobot 4y ago
        Because AGPL infects their entire service. You'll be hard pressed to find any commercial service adopting AGPL projects. Even the GPLv3 is often immiscible with commercial services. At least GPLv3 can be contained to only part of your stack.
      - wil93 4y ago
        IANAL but I think integrating AGPL code would affect the license of the rest of the codebase too: Substack would be forced to release the rest of their codebase as AGPL too. This is why AGPL is considered a "viral" license.
  - none_to_remain 4y ago
    If I use some MIT licensed dependency to power a service at work, I don't beg permission from the maintainers first
- bambax 4y ago
  Minified versions of most JS libraries include a copyright notice as a top or bottom comment. How hard is it to respect this basic requirement?
  - coldtea 4y ago
    Quite hard. Isn't the whole point of the minification to remove non functional parts to make the size smaller?
    - zerocrates 4y ago
      Not really hard... for one there's a convention of putting an exclamation point at the start of comments that should survive the minification/compilation process, for this very purpose.
    - bambax 4y ago
      Not hard at all. A couple of comments won't make any difference. Here's the minified version of one of react components for example: https://unpkg.com/react@18.2.0/umd/react.production.min.js https://unpkg.com/react@18.2.0/umd/react.production.min.js
  - jairajs89 4y ago
    Hey, Substack CTO here. We actually link directly to the jsdeliver CDN to use the files that get built for distribution in the sodo-search npm library. We make no modifications to the files (including not minifying them anymore than they are). The files actually do have a link at the top to the license file, which is hosted in the same directory on jsdeliver.
    - srt72910 4y ago
      understood
    - bakkoting 4y ago
      > The files actually do have a link at the top to the license file That's not actually the license for the file; it's the license for the resources it includes. The license for the file is available elsewhere but is not directly linked. See my comment at https://news.ycombinator.com/item?id=33959622 https://news.ycombinator.com/item?id=33959622
_fat_santa 4y ago
The way I do it in my SaaS app is there is an "attributions" page. On it I have a list of all OSS software I've used in both frontend and backend.
- blacksmith_tb 4y ago
  I like it - though it'd be hard to resist aliasing /attributions.txt to /lawyers.txt ...
- agluszak 4y ago
  Unfortunately a mention in the "attributions" page won't pay the OSS developers' rent.
  - nerdawson 4y ago
    It's more acknowledgement than is required to use most OSS. If the OSS developers want to generate revenue, there are plenty of paths they can follow.
  - jrochkind1 4y ago
    If you want people who use the software you develop to pay you to use it, you should not release your software under an open source license. You probably already knew this, I don't mean to point out the obvious. I am just confused by your comment, and others like it that frequently come up on HN these days. People saying or implying that there is something unfair about using open source software under the license terms that its developers have chosen to release it.
samtho 4y ago
> For a SaaS app, wouldn't that copyright attribution be on the server side (hidden to the end user)? I agree and my take on this is based on the way compilers generate binaries. I would not expect a compiler to inject random copyright notices in sdtout, for example. Ghost, in this case, is acting like "compiler" and the HTML can be thought of as the "output" akin to a binary generated by a traditional compiler. The MIT license (and similarly permissive ones) do not dictate software usage and thus it's output is not required to have any attribution, only source code.
- sdedovic 4y ago
  Ah you may find it interesting, the GPL3 license actually does prescribe showing copyright notices in stdout [1]. > If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode ... > The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”. This is to say it is not entire unusual to have copyright notices in output. [1] https://www.gnu.org/licenses/gpl-3.0.en.html https://www.gnu.org/licenses/gpl-3.0.en.html
  - taeric 4y ago
    This feels silly. Not a single one of my userland tools does this, but they are clearly all GNU...
    - bombcar 4y ago
      Note the “interactive mode” - this means like starting an editor or nslookup kind of thing.
      - taeric 4y ago
        Less is interactive, and does no such thing. I mean, I get it. This will be nigh impossible to codify, such that there will be reasons things can and cannot work in certain situations. This line of attack here, though, is feeling overly forced and would actually sway me to never use such licensed stuff. And I'm pretty heavy on the open source support.
sn0wf1re 4y ago
Would be nice if upstream Ghost made this easier for users. I just checked my blog and it has a default footer with a link "powered by ghost", they could just as easily have a link to the license.
__derek__ 4y ago
> For a SaaS app, wouldn't that copyright attribution be on the server side, where the code is (hidden from the end user)? I'm curious about this because the end user's browser is where the (copied) code is run, not on the server. That's why they need to hot-load additional code from Ghost's CDN, rather than doing so on build servers.
greenthrow 4y ago
They are shipping Ghost client side javascript. That should have the mentioned notice on it.
- jairajs89 4y ago
  Hey Substack CTO here. We actually don't host, modify, or minify the client side library in question. We link directly to the jsdelivr CDN for it and the distributed files from there have a license link at the top
Waterluvian 4y ago
I think I'm safe just having a .txt file you can somehow discover and read from the same server that hosts the website. But in order to do what feels right, I always put it into an "About" section somewhere.

kolaente 4y ago

As far as I understand it, MIT only requires you to include the attribution next to the binary so ias you guessed next to the source code on the server. However, the js shipped to clients is usually minified and transformed which means it may count as "compiled" and thus the same rules as for binaries would apply. Cases like these are the reason why the AGPL exists.

makkesk8 4y ago
I highly doubt you can count minified as "compiled" Minification is a form of compression. Compilation is a form of conversion from a high level to a lower level interpretation and that is fundamentally different. But then again I'm not a lawyer :)
- jdsully 4y ago
  The intent is for attribution to be kept with the code. If your minifier removes the attribution you’re likely in violation.
  - bombcar 4y ago
    And the minifier’s job is to remove things like comments which is right where the attribution is likely to be. Now if a third party thing like a cloudflare CDN were minifyer for you and removed it then who violated the license?
    - jdsully 4y ago
      If the CDN is just a part of your architecture that you voluntarily setup then you’re likely the one violating. Even if not the CDN very likely has an indemnification clause in their contract which would shift that liability back to you.
    - shawnz 4y ago
      There is an informal standard in which copyright notices are annotated with a leading "/*!” to let minifiers know that they should be preserved. See https://stackoverflow.com/questions/11248363/the-purpose-of-starting-an-initial-comment-with-in-javascript-and-css-files https://stackoverflow.com/questions/11248363/the-purpose-of-...
- thomasballinger 4y ago
  I figure compilation is a big tent and this counts, but imagine --rename-properties WARNING: renaming properties requires deeper analysis, considered compilation in the US
- jairajs89 4y ago
  Hey, Substack CTO here. We actually don't minify or modify the files in question at all and simply link to the versions hosted on the public jsdelivr CDN (which includes a link to the license right at the top of the file)
- cxr 4y ago
  First off: weird take, and one that would be unlikely to hold up. But secondly: what is that supposed to matter, anyway? That is, why are you litigating the definition of the word "compiled"? No finding, whether for or against your argument, would have any bearing on questions about compliance with the terms of the MIT license, so the word's definition and its significance is null. It's a total red herring and a distraction to bring up in any discussion on the topic.
shafyy 4y ago
> Cases like these are the reason why the AGPL exists Exactly. Not sure why they Ghost doesn't use AGPL. Still, it would have been kind of fair from Substack to approach this more open and collaboratively...
- freedomben 4y ago
  Because AGPL probably would have made it a no-go for substack to use. They seem to genuinely want to collaborate: https://twitter.com/JohnONolan/status/1602330416643702784 https://twitter.com/JohnONolan/status/1602330416643702784
  - shafyy 4y ago
    Why would AGPL have made it a no-go for Substack? Also, it looks like Ghost wants to collab but there's nothing from Substack in the Twitter thread you linekd?
    - ushakov 4y ago
      > Ghost wants to collab but there's nothing from Substack Substack doesn't have to "collaborate" do they?
    - giantrobot 4y ago
      Because AGPL infects their entire service. You'll be hard pressed to find any commercial service adopting AGPL projects. Even the GPLv3 is often immiscible with commercial services. At least GPLv3 can be contained to only part of your stack.
    - wil93 4y ago
      IANAL but I think integrating AGPL code would affect the license of the rest of the codebase too: Substack would be forced to release the rest of their codebase as AGPL too. This is why AGPL is considered a "viral" license.
- none_to_remain 4y ago
  If I use some MIT licensed dependency to power a service at work, I don't beg permission from the maintainers first
bambax 4y ago
Minified versions of most JS libraries include a copyright notice as a top or bottom comment. How hard is it to respect this basic requirement?
- coldtea 4y ago
  Quite hard. Isn't the whole point of the minification to remove non functional parts to make the size smaller?
  - zerocrates 4y ago
    Not really hard... for one there's a convention of putting an exclamation point at the start of comments that should survive the minification/compilation process, for this very purpose.
  - bambax 4y ago
    Not hard at all. A couple of comments won't make any difference. Here's the minified version of one of react components for example: https://unpkg.com/react@18.2.0/umd/react.production.min.js https://unpkg.com/react@18.2.0/umd/react.production.min.js
- jairajs89 4y ago
  Hey, Substack CTO here. We actually link directly to the jsdeliver CDN to use the files that get built for distribution in the sodo-search npm library. We make no modifications to the files (including not minifying them anymore than they are). The files actually do have a link at the top to the license file, which is hosted in the same directory on jsdeliver.
  - srt72910 4y ago
    understood
  - bakkoting 4y ago
    > The files actually do have a link at the top to the license file That's not actually the license for the file; it's the license for the resources it includes. The license for the file is available elsewhere but is not directly linked. See my comment at https://news.ycombinator.com/item?id=33959622 https://news.ycombinator.com/item?id=33959622

_fat_santa 4y ago

The way I do it in my SaaS app is there is an "attributions" page. On it I have a list of all OSS software I've used in both frontend and backend.

blacksmith_tb 4y ago
I like it - though it'd be hard to resist aliasing /attributions.txt to /lawyers.txt ...
agluszak 4y ago
Unfortunately a mention in the "attributions" page won't pay the OSS developers' rent.
- nerdawson 4y ago
  It's more acknowledgement than is required to use most OSS. If the OSS developers want to generate revenue, there are plenty of paths they can follow.
- jrochkind1 4y ago
  If you want people who use the software you develop to pay you to use it, you should not release your software under an open source license. You probably already knew this, I don't mean to point out the obvious. I am just confused by your comment, and others like it that frequently come up on HN these days. People saying or implying that there is something unfair about using open source software under the license terms that its developers have chosen to release it.

samtho 4y ago

> For a SaaS app, wouldn't that copyright attribution be on the server side (hidden to the end user)? I agree and my take on this is based on the way compilers generate binaries. I would not expect a compiler to inject random copyright notices in sdtout, for example. Ghost, in this case, is acting like "compiler" and the HTML can be thought of as the "output" akin to a binary generated by a traditional compiler. The MIT license (and similarly permissive ones) do not dictate software usage and thus it's output is not required to have any attribution, only source code.

sdedovic 4y ago
Ah you may find it interesting, the GPL3 license actually does prescribe showing copyright notices in stdout [1]. > If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode ... > The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”. This is to say it is not entire unusual to have copyright notices in output. [1] https://www.gnu.org/licenses/gpl-3.0.en.html https://www.gnu.org/licenses/gpl-3.0.en.html
- taeric 4y ago
  This feels silly. Not a single one of my userland tools does this, but they are clearly all GNU...
  - bombcar 4y ago
    Note the “interactive mode” - this means like starting an editor or nslookup kind of thing.
    - taeric 4y ago
      Less is interactive, and does no such thing. I mean, I get it. This will be nigh impossible to codify, such that there will be reasons things can and cannot work in certain situations. This line of attack here, though, is feeling overly forced and would actually sway me to never use such licensed stuff. And I'm pretty heavy on the open source support.

sn0wf1re 4y ago

Would be nice if upstream Ghost made this easier for users. I just checked my blog and it has a default footer with a link "powered by ghost", they could just as easily have a link to the license.

__derek__ 4y ago

> For a SaaS app, wouldn't that copyright attribution be on the server side, where the code is (hidden from the end user)? I'm curious about this because the end user's browser is where the (copied) code is run, not on the server. That's why they need to hot-load additional code from Ghost's CDN, rather than doing so on build servers.

greenthrow 4y ago

They are shipping Ghost client side javascript. That should have the mentioned notice on it.

jairajs89 4y ago
Hey Substack CTO here. We actually don't host, modify, or minify the client side library in question. We link directly to the jsdelivr CDN for it and the distributed files from there have a license link at the top

Waterluvian 4y ago

I think I'm safe just having a .txt file you can somehow discover and read from the same server that hosts the website. But in order to do what feels right, I always put it into an "About" section somewhere.