6 ms·

Crockford on JSON license (2011)

249 points by samuel246 3y ago

markstos 3y ago
Some lawyers need to discover eslint.
lmm 3y ago
So the whole thing had no point other than making life hard for organisations with actual principles, like Debian. And he wonders why people get pissed off.
- jonny_eh 3y ago
  He makes a good point. Don’t ask me what it is though.
  - lcnPylGDnU4H9OF 3y ago
    I only just got here but I believe the point is that IBM and their customers (and minions, of course; strangely, not their patsies but maybe they fall under minions) are privileged to use this software for Evil.
- deleted 3y ago
  [deleted]
- em-bee 3y ago
  actually, the way i see it, the fact that people took the effort to contact the developer shows that they really wanted to use that. otherwise they would have just used it silently and the developer might not even find out about it. in some cases that might even have been an opportunity to earn some money.
  - lmm 3y ago
    I mean if he didn't charge IBM (and for such a broad license) he's surely not charging anyone else. I guess he opens a line of communication with them in some sense, but it's with some random staffer in the legal department rather than anyone who's going to be hiring contractors, and surely there would be friendlier ways if that was the goal (hell, just asking people to say hi would be starting you off on better terms).
    - ke88y 3y ago
      FWIW, I always recommend charging 3 months of jr dev time for cross-licensing and use the cash to pay for a project-related internship. It's win-win-win: - you get help with your project, - the project (and its corporate user) gets new features or bug fixes or refactors, - the student gets a learning experience. Mentoring does take a surprising amount of time, so you can also tack on a little extra and treat yourself to a weekend at a ski report (or whatever your thing is) as a "thank you" to yourself for the free mentorship :)
- abigail95 3y ago
  If Debian's principles are free software then obviously their values are incompatible with this license due to the restrictions it imposes. It's not a hard choice for Debian to make - they just put it in non-free with thousands of other packages.
  - lmm 3y ago
    > If Debian's principles are free software then obviously their values are incompatible with this license due to the restrictions it imposes. Restrictions which he clearly has no willingness to actually enforce. So they only serve to make life hard for the decent folks. > It's not a hard choice for Debian to make - they just put it in non-free with thousands of other packages. Sure, but that then has other consequences - they can't use it as a dependency in their build system, they have to move downstream stuff into contrib or look for replacement dependencies, ....
joshmarinacci 3y ago
I’m impressed that IBM is actually doing their due diligence.
- aabhay 3y ago
  Impressed or depressed?
macksd 3y ago
While this is funny, it does highlight that you should probably have an actual legal opinion if you decide to write your own license. A less tongue-in-cheek example that I've run into is https://dst.lbl.gov/ACSSoftware/colt/license.html https://dst.lbl.gov/ACSSoftware/colt/license.html. "any usage related to military applications is expressly forbidden", which is still poorly defined enough that it makes lots of corporate lawyers nervous and you end up having to remove those packages even for stuff that isn't really a military application just because it's not clear how military-adjacent something is allowed to be. It's especially ironic since it's being distributed by a Department of Energy national lab. I wonder if DOE national labs ever have military applications... It's also not clear to me that this does actually make it illegal for the military to just use it directly, even if they cared about following the letter of the law. If copyright is the real power behind the enforcement of open-source licenses, I'm not sure usage is something the license grantor gets to dictate as long as you're not redistributing something.
- asynchronous 3y ago
  Can confirm DOE labs work on military adjacent things all the time
  - macksd 3y ago
    Yes my question was, itself, tongue-in-cheek. I've been told that a customer insisted the packages in question be removed because although they did nothing military-related, they did happen to have a customer that is well-known for being a contractor on military projects and they didn't want to be getting in trouble just because their civilian service was used by a civilian company that did military-adjacent work. And even if LBL isn't developing nuclear weapons they seem a mite closer to it than that.
- verve_rat 3y ago
  I mean... no? There is nothing compelling these organisations to use that particular piece of software. When contacted the author could just shrug and say "not my problem" and the organisation would just have to find some other software to use. The author has no obligation to make things easier for people that don't know if they are doing evil or not, or if they are military or not.
rtpg 3y ago
It is sort of interesting how there are practical logistical issues with making bespoke licenses. I would not want my work to end up being used by weapons manufacturers[0]. I honestly would like to put this into licenses. But there would be endless kvetching at such a license being used, of course. But so much OSS tooling is relying on how we have ended up with a lot of mutual compatible licenses, and having any sort of weirdness ends up excluding you from being bundled in repros. There is a line that could be crossed here (and has been crossed by more than one very large project!), and I get ... annoyed at 'licenses' like the WTFPL. But when people get frustrated at seeing American companies deploy tooling to help with things like mass censorship in authoritarian regimes, I think about how we might be a couple license changes away from making that job way harder. [0]: Not making a blanket statement for people working there! I simply do not want to participate.
- Shawnj2 3y ago
  I like the “open source will be enforced” nature of GPLv3 for that reason. Yes,it does mean that a developer some some huge company will have to write their own version of your project instead of just using yours and thus your code would be less widely used than if it hadn’t, but on the other hand if I choose to work on something for free and available to everyone you making the thing you made also free and available to everyone is completely reasonable, benefitting open source projects and community use while also making it disproportionately harder for people trying to hide the software in a different evil program of some sort. Obviously it’s not perfect but I’ve always viewed the relative exclusivity of the GPL to be one of its pros.
hunterhe 3y ago
How do you define evil? that's a good question.
- js2 3y ago
  Evil is the malevolent being from Time Bandits of course. And you definitely shouldn't touch it: https://youtu.be/QKGbguoildA https://youtu.be/QKGbguoildA
brigadier132 3y ago
Amazing writing. Question, is there any US judicial precedent for what is evil and what is not?
- Vecr 3y ago
  Probably. Most of the US has a legal system based on common law. I think it would really depend on the context though, because I don't know how you can use a linting program "for evil."
  - zoky 3y ago
    Have it lint PHP?
- School-Cotton 3y ago
  No, which is why this license is probably much more restrictive than its author intended. Many serious organizations simply won’t use something for which the meaning of the license terms is unclear to this extent. That of course doesn’t mean they “plan on using it for evil” or anything of the sort.
  - jrflowers 3y ago
    I’d think that it wouldn’t make for a very restrictive license. Since there’s no agreement on what “evil” means whatsoever, it doesn’t seem that different from putting “You can not use this code to hooplebop shanglefronks” Edit: I guess there’s that TV show “Evil”. It would be funny if IBM had that production company as a client.
    - School-Cotton 3y ago
      > there’s no agreement on what “evil” means whatsoever Indeed, which is why lawyers won’t want to take the risk. I’m sure they wouldn’t want to use software whose license claims you can’t “hooblepop shanglefronks” either, for that matter, without discussing with the owner to clarify what that means. Essentially the practical meaning of this license is “this can’t be used by companies with careful lawyers who take license terms seriously”, which I doubt was the intent.
getmeinrn 3y ago
I was talking with a small startup founder about a project I had licensed under AGPL. He asked, "How do you know if someone uses your project against your licence though?" with a smile. His point wasn't anything new, but I still didn't have a great answer. I just said that it would require the company being honest and purchase a commercial license, and that I have personally worked at companies that evaluate their licenses to make sure they are in compliance. But his immediate reaction being the thought of abusing the license was irritating. I can't say that I have never thought this way (of using "free" software, licenses be damned) when I was younger & in school. But as the owner of legitimate business, it seems so perverse. It screws small creators and discourages them from sharing their work with everyone.
- dylanpyle 3y ago
  For what it’s worth - we had to audit/list all licenses for OSS components & dependencies on at least 3 separate occasions during fundraising diligence processes. I would guess nobody read it too closely but GPL code would definitely have stuck out. I imagine bigger companies have this process pretty well structured.
- pabs3 3y ago
  GPL violations are constant and everywhere, this definitely isn't new. I've even seen BSD license violations before. My DSL modem/router violates the licenses of micro_httpd (BSD), samba/Linux/busybox (GPL) and probably more. Basically, you have to go out and look for violations and prosecute them. If the Software Freedom Conservancy prevails in their lawsuit against Vizio, then it will make it possible for any recipient of GPLed binaries to sue for GPL compliance. That means that lawsuits for compliance don't need to involve the copyright holder and projects can outsource compliance efforts to the userbase of open source copylefted projects. That doesn't necessarily help your project though, since it sounds like most users of your project will be on the proprietary/commercial version? https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/copyleft-compliance/vizio.html
- gizmo686 3y ago
  Its not like paid software is immune from unlicensed use.
lstamour 3y ago
I’d heard this one before. And yep, sure enough, it was sourced from a video from 2011. Definitely one of my favourites tho. It was also previously discussed in 2022 at https://news.ycombinator.com/item?id=31027104 https://news.ycombinator.com/item?id=31027104 and in 2013 at https://news.ycombinator.com/item?id=5138866 https://news.ycombinator.com/item?id=5138866 and probably at other times, but I’m on my phone and can’t search it up now. Also, I’m pretty sure if you wanted to, you can now use JSLint for evil. (And if you really think about it, if you’re evil, wouldn’t you just break the license terms as part of your evil deeds? Or is this how they catch you, like tax evasion?)
- CoastalCoder 3y ago
  I'd refer you to the term "lawful evil", but I suspect Wizards of the Coast would sue me.
gnabgib 3y ago
The license was from 2002[0], and the IBM update was from 2011[1]. What's the point of this gist which only vaguely mentions Douglas Crockford (through a lawyer quote and a the gist name)? [0]: https://codedocs.org/what-is/douglas-crockford https://codedocs.org/what-is/douglas-crockford [1]: https://web.archive.org/web/20170722132351/https://dev.hasenj.org/post/3272592502/ibm-and-its-minions https://web.archive.org/web/20170722132351/https://dev.hasen...
- dredmorbius 3y ago
  Best I can tell, neither the video linked from TFA nor an earlier version submitted previously to HN remain online. See: <https://news.ycombinator.com/item?id=36809645 https://news.ycombinator.com/item?id=36809645> Whether or not there's a more definitive source I haven't investigated.
yieldcrv 3y ago
I love this style it’s like John Mulaney
kubectl_h 3y ago
It's little wonder that javascript is such a fraught, inferior language and ecosystem given it was so heavily influenced by Crockford and Eich. In a way I'm glad that the future of compute in the browser (such as WASM, et. al), will be dictated by corporate overlords so we don't have to deal with such mercurial personalities.
- seattle_spring 3y ago
  You must really hate GPL then
- ke88y 3y ago
  What is the browser-based debugging tool story for compiled-to-WASM languages?
fortenforge 3y ago
Cryptographers often tell software engineers that they shouldn't roll their own crypto. I think lawyers would tell software engineers that they shouldn't roll their own license. If you really intend or want other people to be able to use the software you wrote, for the love of god please pick a sane, well-known license so that people can use your software with full knowledge of the legal implications.
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
dredmorbius 3y ago
Originally at <https://web.archive.org/web/20110418031915/http://dev.hasenj.org/post/3272592502/ibm-and-its-minions https://web.archive.org/web/20110418031915/http://dev.hasenj...> (archive) Discussed at the time: <https://news.ycombinator.com/item?id=5138866 https://news.ycombinator.com/item?id=5138866> (56 comments).
whimsicalism 3y ago
well good, it is not like IBM was ever involved in the holocaust or something
ilaksh 3y ago
I think it's pretty funny that the lawyer suspects some of their clients are probably evil and his response is just to try to fix the clause so that evil is allowed. Rather than trying to find a job that doesn't involve evil.
- School-Cotton 3y ago
  The correct reading is that the lawyer recognizes, correctly, that “evil” has no clear legal meaning and therefore wants to clarify what the author actually meant before deciding whether to use his software.
nanmu42 3y ago
The referred license: https://www.json.org/license.html https://www.json.org/license.html Debian thinks it is a nonfree license: https://wiki.debian.org/qa.debian.org/jsonevil https://wiki.debian.org/qa.debian.org/jsonevil
deleted 3y ago
[deleted]

249 points by samuel246 3y ago

Some lawyers need to discover eslint.

lmm 3y ago

So the whole thing had no point other than making life hard for organisations with actual principles, like Debian. And he wonders why people get pissed off.

jonny_eh 3y ago
He makes a good point. Don’t ask me what it is though.
- lcnPylGDnU4H9OF 3y ago
  I only just got here but I believe the point is that IBM and their customers (and minions, of course; strangely, not their patsies but maybe they fall under minions) are privileged to use this software for Evil.
deleted 3y ago
[deleted]
em-bee 3y ago
actually, the way i see it, the fact that people took the effort to contact the developer shows that they really wanted to use that. otherwise they would have just used it silently and the developer might not even find out about it. in some cases that might even have been an opportunity to earn some money.
- lmm 3y ago
  I mean if he didn't charge IBM (and for such a broad license) he's surely not charging anyone else. I guess he opens a line of communication with them in some sense, but it's with some random staffer in the legal department rather than anyone who's going to be hiring contractors, and surely there would be friendlier ways if that was the goal (hell, just asking people to say hi would be starting you off on better terms).
  - ke88y 3y ago
    FWIW, I always recommend charging 3 months of jr dev time for cross-licensing and use the cash to pay for a project-related internship. It's win-win-win: - you get help with your project, - the project (and its corporate user) gets new features or bug fixes or refactors, - the student gets a learning experience. Mentoring does take a surprising amount of time, so you can also tack on a little extra and treat yourself to a weekend at a ski report (or whatever your thing is) as a "thank you" to yourself for the free mentorship :)
abigail95 3y ago
If Debian's principles are free software then obviously their values are incompatible with this license due to the restrictions it imposes. It's not a hard choice for Debian to make - they just put it in non-free with thousands of other packages.
- lmm 3y ago
  > If Debian's principles are free software then obviously their values are incompatible with this license due to the restrictions it imposes. Restrictions which he clearly has no willingness to actually enforce. So they only serve to make life hard for the decent folks. > It's not a hard choice for Debian to make - they just put it in non-free with thousands of other packages. Sure, but that then has other consequences - they can't use it as a dependency in their build system, they have to move downstream stuff into contrib or look for replacement dependencies, ....

joshmarinacci 3y ago

I’m impressed that IBM is actually doing their due diligence.

aabhay 3y ago
Impressed or depressed?

macksd 3y ago

While this is funny, it does highlight that you should probably have an actual legal opinion if you decide to write your own license. A less tongue-in-cheek example that I've run into is https://dst.lbl.gov/ACSSoftware/colt/license.html https://dst.lbl.gov/ACSSoftware/colt/license.html. "any usage related to military applications is expressly forbidden", which is still poorly defined enough that it makes lots of corporate lawyers nervous and you end up having to remove those packages even for stuff that isn't really a military application just because it's not clear how military-adjacent something is allowed to be. It's especially ironic since it's being distributed by a Department of Energy national lab. I wonder if DOE national labs ever have military applications... It's also not clear to me that this does actually make it illegal for the military to just use it directly, even if they cared about following the letter of the law. If copyright is the real power behind the enforcement of open-source licenses, I'm not sure usage is something the license grantor gets to dictate as long as you're not redistributing something.

asynchronous 3y ago
Can confirm DOE labs work on military adjacent things all the time
- macksd 3y ago
  Yes my question was, itself, tongue-in-cheek. I've been told that a customer insisted the packages in question be removed because although they did nothing military-related, they did happen to have a customer that is well-known for being a contractor on military projects and they didn't want to be getting in trouble just because their civilian service was used by a civilian company that did military-adjacent work. And even if LBL isn't developing nuclear weapons they seem a mite closer to it than that.
verve_rat 3y ago
I mean... no? There is nothing compelling these organisations to use that particular piece of software. When contacted the author could just shrug and say "not my problem" and the organisation would just have to find some other software to use. The author has no obligation to make things easier for people that don't know if they are doing evil or not, or if they are military or not.

rtpg 3y ago

It is sort of interesting how there are practical logistical issues with making bespoke licenses. I would not want my work to end up being used by weapons manufacturers[0]. I honestly would like to put this into licenses. But there would be endless kvetching at such a license being used, of course. But so much OSS tooling is relying on how we have ended up with a lot of mutual compatible licenses, and having any sort of weirdness ends up excluding you from being bundled in repros. There is a line that could be crossed here (and has been crossed by more than one very large project!), and I get ... annoyed at 'licenses' like the WTFPL. But when people get frustrated at seeing American companies deploy tooling to help with things like mass censorship in authoritarian regimes, I think about how we might be a couple license changes away from making that job way harder. [0]: Not making a blanket statement for people working there! I simply do not want to participate.

Shawnj2 3y ago
I like the “open source will be enforced” nature of GPLv3 for that reason. Yes,it does mean that a developer some some huge company will have to write their own version of your project instead of just using yours and thus your code would be less widely used than if it hadn’t, but on the other hand if I choose to work on something for free and available to everyone you making the thing you made also free and available to everyone is completely reasonable, benefitting open source projects and community use while also making it disproportionately harder for people trying to hide the software in a different evil program of some sort. Obviously it’s not perfect but I’ve always viewed the relative exclusivity of the GPL to be one of its pros.

hunterhe 3y ago

How do you define evil? that's a good question.

js2 3y ago
Evil is the malevolent being from Time Bandits of course. And you definitely shouldn't touch it: https://youtu.be/QKGbguoildA https://youtu.be/QKGbguoildA

brigadier132 3y ago

Amazing writing. Question, is there any US judicial precedent for what is evil and what is not?

Vecr 3y ago
Probably. Most of the US has a legal system based on common law. I think it would really depend on the context though, because I don't know how you can use a linting program "for evil."
- zoky 3y ago
  Have it lint PHP?
School-Cotton 3y ago
No, which is why this license is probably much more restrictive than its author intended. Many serious organizations simply won’t use something for which the meaning of the license terms is unclear to this extent. That of course doesn’t mean they “plan on using it for evil” or anything of the sort.
- jrflowers 3y ago
  I’d think that it wouldn’t make for a very restrictive license. Since there’s no agreement on what “evil” means whatsoever, it doesn’t seem that different from putting “You can not use this code to hooplebop shanglefronks” Edit: I guess there’s that TV show “Evil”. It would be funny if IBM had that production company as a client.
  - School-Cotton 3y ago
    > there’s no agreement on what “evil” means whatsoever Indeed, which is why lawyers won’t want to take the risk. I’m sure they wouldn’t want to use software whose license claims you can’t “hooblepop shanglefronks” either, for that matter, without discussing with the owner to clarify what that means. Essentially the practical meaning of this license is “this can’t be used by companies with careful lawyers who take license terms seriously”, which I doubt was the intent.

getmeinrn 3y ago

I was talking with a small startup founder about a project I had licensed under AGPL. He asked, "How do you know if someone uses your project against your licence though?" with a smile. His point wasn't anything new, but I still didn't have a great answer. I just said that it would require the company being honest and purchase a commercial license, and that I have personally worked at companies that evaluate their licenses to make sure they are in compliance. But his immediate reaction being the thought of abusing the license was irritating. I can't say that I have never thought this way (of using "free" software, licenses be damned) when I was younger & in school. But as the owner of legitimate business, it seems so perverse. It screws small creators and discourages them from sharing their work with everyone.

dylanpyle 3y ago
For what it’s worth - we had to audit/list all licenses for OSS components & dependencies on at least 3 separate occasions during fundraising diligence processes. I would guess nobody read it too closely but GPL code would definitely have stuck out. I imagine bigger companies have this process pretty well structured.
pabs3 3y ago
GPL violations are constant and everywhere, this definitely isn't new. I've even seen BSD license violations before. My DSL modem/router violates the licenses of micro_httpd (BSD), samba/Linux/busybox (GPL) and probably more. Basically, you have to go out and look for violations and prosecute them. If the Software Freedom Conservancy prevails in their lawsuit against Vizio, then it will make it possible for any recipient of GPLed binaries to sue for GPL compliance. That means that lawsuits for compliance don't need to involve the copyright holder and projects can outsource compliance efforts to the userbase of open source copylefted projects. That doesn't necessarily help your project though, since it sounds like most users of your project will be on the proprietary/commercial version? https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/copyleft-compliance/vizio.html
gizmo686 3y ago
Its not like paid software is immune from unlicensed use.

lstamour 3y ago

I’d heard this one before. And yep, sure enough, it was sourced from a video from 2011. Definitely one of my favourites tho. It was also previously discussed in 2022 at https://news.ycombinator.com/item?id=31027104 https://news.ycombinator.com/item?id=31027104 and in 2013 at https://news.ycombinator.com/item?id=5138866 https://news.ycombinator.com/item?id=5138866 and probably at other times, but I’m on my phone and can’t search it up now. Also, I’m pretty sure if you wanted to, you can now use JSLint for evil. (And if you really think about it, if you’re evil, wouldn’t you just break the license terms as part of your evil deeds? Or is this how they catch you, like tax evasion?)

CoastalCoder 3y ago
I'd refer you to the term "lawful evil", but I suspect Wizards of the Coast would sue me.

gnabgib 3y ago

The license was from 2002[0], and the IBM update was from 2011[1]. What's the point of this gist which only vaguely mentions Douglas Crockford (through a lawyer quote and a the gist name)? [0]: https://codedocs.org/what-is/douglas-crockford https://codedocs.org/what-is/douglas-crockford [1]: https://web.archive.org/web/20170722132351/https://dev.hasenj.org/post/3272592502/ibm-and-its-minions https://web.archive.org/web/20170722132351/https://dev.hasen...

dredmorbius 3y ago
Best I can tell, neither the video linked from TFA nor an earlier version submitted previously to HN remain online. See: <https://news.ycombinator.com/item?id=36809645 https://news.ycombinator.com/item?id=36809645> Whether or not there's a more definitive source I haven't investigated.

yieldcrv 3y ago

I love this style it’s like John Mulaney

kubectl_h 3y ago

It's little wonder that javascript is such a fraught, inferior language and ecosystem given it was so heavily influenced by Crockford and Eich. In a way I'm glad that the future of compute in the browser (such as WASM, et. al), will be dictated by corporate overlords so we don't have to deal with such mercurial personalities.

seattle_spring 3y ago
You must really hate GPL then
ke88y 3y ago
What is the browser-based debugging tool story for compiled-to-WASM languages?

fortenforge 3y ago

Cryptographers often tell software engineers that they shouldn't roll their own crypto. I think lawyers would tell software engineers that they shouldn't roll their own license. If you really intend or want other people to be able to use the software you wrote, for the love of god please pick a sane, well-known license so that people can use your software with full knowledge of the legal implications.

deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

dredmorbius 3y ago

Originally at <https://web.archive.org/web/20110418031915/http://dev.hasenj.org/post/3272592502/ibm-and-its-minions https://web.archive.org/web/20110418031915/http://dev.hasenj...> (archive) Discussed at the time: <https://news.ycombinator.com/item?id=5138866 https://news.ycombinator.com/item?id=5138866> (56 comments).

whimsicalism 3y ago

well good, it is not like IBM was ever involved in the holocaust or something

ilaksh 3y ago

I think it's pretty funny that the lawyer suspects some of their clients are probably evil and his response is just to try to fix the clause so that evil is allowed. Rather than trying to find a job that doesn't involve evil.

School-Cotton 3y ago
The correct reading is that the lawyer recognizes, correctly, that “evil” has no clear legal meaning and therefore wants to clarify what the author actually meant before deciding whether to use his software.

nanmu42 3y ago

The referred license: https://www.json.org/license.html https://www.json.org/license.html Debian thinks it is a nonfree license: https://wiki.debian.org/qa.debian.org/jsonevil https://wiki.debian.org/qa.debian.org/jsonevil

deleted 3y ago

[deleted]