4 ms·

I’m very worried about these kind of things. I’ve worked on a number of projects that were not checking any of the licenses they were building on top of. As lon

by baby 3y ago

I’m very worried about these kind of things. I’ve worked on a number of projects that were not checking any of the licenses they were building on top of. As long as it’s open sourced people always assume that it’s OK to use it. I really wish it was the case. It’s really like people are leaving these small mines here and there for people to trip on it.

jraph 3y ago
If you act in good faith and fix issues as they are raised, nothing really bad should happen to you. Usually, GPL breakages are amicably pointed out and only if no agreement can be reached, the big legal tools are used. Orange knows what they are doing.
Cthulhu_ 3y ago
As a developer, it's your responsibility to make sure the licenses check out; chances are you know more about those than your manager or employer's legal department. On that note, we should probably double check our licenses and that we publish them as well.
- cryptonym 3y ago
  Tell that to the average JavaScript dev who uses npm to download a library with 12 dependencies in order to use a function that returns the number of words in a string. As a company, it's your responsibility to set and enforce a clear policy on using third party code. License is only one part of the problem.
- mytailorisrich 3y ago
  It cannot be the individual dev's sole responsibility. There must be a clear policy and hoops to go through (decision on choice of library, reviews before integration in code base/product, audits, etc). If that does not exist then the organisation must really step up its game. By the way, it is the very job of the legal department to know about this and to inform policies, and of the managers to enforce those policies and processes.
rwmj 3y ago
Did you also use Windows without any regard to Microsoft's licensing? Whatever software you use, you must be aware of the license. It has nothing to do with whether or not the software is open source.
- baby 3y ago
  It’s not easy to pirate software
defrost 3y ago
Right there at the top on the landing page: Lasso is a free software C library aiming to implement the Liberty Alliance standards; it defines processes for federated identities, single sign-on and related protocols. Lasso is built on top of libxml2, XMLSec and OpenSSL and is licensed under the GNU General Public License (with an OpenSSL exception). We strongly recommend the use of the GNU General Public License each time it is possible. But for proprietary projects, that wouldn't want to use it, we designed a commercial license. -- https://lasso.entrouvert.org/ https://lasso.entrouvert.org/ That's hardly hiding the choice, someone at the telecom company chose not to get a commercial use license.
- EspadaV9 3y ago
  Hmm, the link for the commercial license is a 404 page though - https://www.entrouvert.com/en/expertise/licenses/ https://www.entrouvert.com/en/expertise/licenses/ Edit: So are the links for the GPL and the OpenSSL Exception - https://lasso.entrouvert.org/license https://lasso.entrouvert.org/license
  - defrost 3y ago
    Those links have been dead for three years, it's a webpage </shrug> https://dev.entrouvert.org/issues/52569 https://dev.entrouvert.org/issues/52569 https://git.entrouvert.org/entrouvert/lasso https://git.entrouvert.org/entrouvert/lasso For commercial usage, though, the git page and forums are active enough and real live humans can be communicated with.
epanchin 3y ago
This seems an easily solvable problem. AI driven licence check on git merge to release?
- actionfromafar 3y ago
  Not even AI driven is fine, "just" match against a large corpus of known open source software.
  - epanchin 3y ago
    “Known open source” But who will check the licences of those softwares to build the corpus?
    - actionfromafar 3y ago
      A good start would be to crawl github and sourceforge. Most have license data. BlackDuck has a scanner with a corpus, don’t know how good it is.
  - iExploder 3y ago
    Nah it has to be AI driven these days to get approval from management.
Turing_Machine 3y ago
IMO, using "free software" to describe GPL work doesn't really make sense. If I give you something, but require you to adhere to certain conditions, it's not really "free". Say, if Bertram Gilfoyle lets you live in an apartment he owns as long as you remain a practicing member of the Church of Satan, that's not really "free", now, is it? Of course, this idea of "freedom" is on a spectrum. By my lights, the MIT license is more free than the GPL because it imposes fewer restrictions on the user. Personally, I don't let GPL software come anywhere near anything I'm working on. I don't even like using GCC, and was very happy when LLVM appeared on the scene with a less-scary license.
- baby 3y ago
  Yeah I think GPL should be described as booby trapped software

by baby 3y ago

jraph 3y ago

If you act in good faith and fix issues as they are raised, nothing really bad should happen to you. Usually, GPL breakages are amicably pointed out and only if no agreement can be reached, the big legal tools are used. Orange knows what they are doing.

Cthulhu_ 3y ago

As a developer, it's your responsibility to make sure the licenses check out; chances are you know more about those than your manager or employer's legal department. On that note, we should probably double check our licenses and that we publish them as well.

cryptonym 3y ago
Tell that to the average JavaScript dev who uses npm to download a library with 12 dependencies in order to use a function that returns the number of words in a string. As a company, it's your responsibility to set and enforce a clear policy on using third party code. License is only one part of the problem.
mytailorisrich 3y ago
It cannot be the individual dev's sole responsibility. There must be a clear policy and hoops to go through (decision on choice of library, reviews before integration in code base/product, audits, etc). If that does not exist then the organisation must really step up its game. By the way, it is the very job of the legal department to know about this and to inform policies, and of the managers to enforce those policies and processes.

rwmj 3y ago

Did you also use Windows without any regard to Microsoft's licensing? Whatever software you use, you must be aware of the license. It has nothing to do with whether or not the software is open source.

baby 3y ago
It’s not easy to pirate software

defrost 3y ago

Right there at the top on the landing page: Lasso is a free software C library aiming to implement the Liberty Alliance standards; it defines processes for federated identities, single sign-on and related protocols. Lasso is built on top of libxml2, XMLSec and OpenSSL and is licensed under the GNU General Public License (with an OpenSSL exception). We strongly recommend the use of the GNU General Public License each time it is possible. But for proprietary projects, that wouldn't want to use it, we designed a commercial license. -- https://lasso.entrouvert.org/ https://lasso.entrouvert.org/ That's hardly hiding the choice, someone at the telecom company chose not to get a commercial use license.

EspadaV9 3y ago
Hmm, the link for the commercial license is a 404 page though - https://www.entrouvert.com/en/expertise/licenses/ https://www.entrouvert.com/en/expertise/licenses/ Edit: So are the links for the GPL and the OpenSSL Exception - https://lasso.entrouvert.org/license https://lasso.entrouvert.org/license
- defrost 3y ago
  Those links have been dead for three years, it's a webpage </shrug> https://dev.entrouvert.org/issues/52569 https://dev.entrouvert.org/issues/52569 https://git.entrouvert.org/entrouvert/lasso https://git.entrouvert.org/entrouvert/lasso For commercial usage, though, the git page and forums are active enough and real live humans can be communicated with.

epanchin 3y ago

This seems an easily solvable problem. AI driven licence check on git merge to release?

actionfromafar 3y ago
Not even AI driven is fine, "just" match against a large corpus of known open source software.
- epanchin 3y ago
  “Known open source” But who will check the licences of those softwares to build the corpus?
  - actionfromafar 3y ago
    A good start would be to crawl github and sourceforge. Most have license data. BlackDuck has a scanner with a corpus, don’t know how good it is.
- iExploder 3y ago
  Nah it has to be AI driven these days to get approval from management.

Turing_Machine 3y ago

IMO, using "free software" to describe GPL work doesn't really make sense. If I give you something, but require you to adhere to certain conditions, it's not really "free". Say, if Bertram Gilfoyle lets you live in an apartment he owns as long as you remain a practicing member of the Church of Satan, that's not really "free", now, is it? Of course, this idea of "freedom" is on a spectrum. By my lights, the MIT license is more free than the GPL because it imposes fewer restrictions on the user. Personally, I don't let GPL software come anywhere near anything I'm working on. I don't even like using GCC, and was very happy when LLVM appeared on the scene with a less-scary license.

baby 3y ago
Yeah I think GPL should be described as booby trapped software