4 ms·

> Don't use one of the most permissive licenses in existence Does it matter what license you use if they actively ignore the terms in the license you did chose

by diggan 2y ago

> Don't use one of the most permissive licenses in existence Does it matter what license you use if they actively ignore the terms in the license you did chose? MIT requires attribution, but they didn't. Why would any other terms be different? You surely could have put "You must license your project the same as the one you forked from" and they still would have ignored it, not sure what the difference would have been.

bayindirh 2y ago
MIT doesn't need attribution. Original BSD does, but revised and most widespread BSDs do not. GPL/AGPL would prevented this somehow, requiring proper attribution via mandatory source code release, and allowing to track project origins. This would make it harder to label it as a "a Microsoft Product from Ground Up", and prevent Sherlocking the original application to a greater degree. As a result, this would probably forced Microsoft to develop a new one from scratch, because they're allergic to GPL, because if they have breached GPL, they would be forced to comply, since GPL is court tested already. So, write Free Software. Not Open Source. Esp. for your personal projects.
- Zambyte 2y ago
  > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. Source: the MIT license. https://choosealicense.com/licenses/mit/ https://choosealicense.com/licenses/mit/
  - bayindirh 2y ago
    There's no writing in that license which I can't change the copyright after forking the code. There's a copyright line, check. There's the permission notice, check. The rest is just goodwill and ethics, which is not a very valuable currency in software in these days.
    - Zambyte 2y ago
      You can't just remove the above copyright notice and replace it with your own and claim you retained the copyright notice lol
      - bayindirh 2y ago
        Can you give me a couple examples how this is done? I mean, in terms of actual repositories.
        throwaway277432 2y ago
        The easiest way to do it is to add your own copyright line above the original LICENSE copyright line. That way anyone touching the project can just add their own line on top. Done. EDIT: Example: https://github.com/go-gitea/gitea/blob/main/LICENSE https://github.com/go-gitea/gitea/blob/main/LICENSE A more complicated way to do it is to add a folder that contains the original LICENSE file or files. Sometimes there is more than one license, or the license texts differ. In that case, you must preserve all the different variants, even if they all call themselves MIT. Then, you can optionally add your additional own LICENSE file * only iff* it is compatible with all existing LICENSES. In the case of the MIT license, you may relicense, sublicense, or use a different license in addition, provided it is MIT-compatible. With e.g. GPL you can't. Note that you still have to preserve all the original LICENSE files in the repo.
        Zambyte 2y ago
        Original license of Redis is retained in the form Valkey: https://github.com/valkey-io/valkey/blob/unstable/COPYING https://github.com/valkey-io/valkey/blob/unstable/COPYING Third party licenses retained in a THIRDPARTY file in MariaDB https://github.com/MariaDB/server/blob/main/THIRDPARTY https://github.com/MariaDB/server/blob/main/THIRDPARTY Only two good examples I could quickly find.
    - throwaway277432 2y ago
      No! Once you change the copyright line, you no longer include "the above copyright notice". At that point you're violating the license. You are also not allowed to change the copyright notice or license text in any way (you may however add to the license, which is a loophole other licenses such as GPL fix.) Substantial is subject to (legal) debate as the Oracle vs. MS case has shown. Whole functions or large parts of files however should always be considered substantial, as the software would otherwise not work. I'm seriously flabbergasted at how bad reading comprehension seems to be among coders.
  - sublimefire 2y ago
    Yes and they do redistribute under MIT as well, there is no foul play here
    - Zambyte 2y ago
      https://github.com/Azure/peerd/blob/main/LICENSE https://github.com/Azure/peerd/blob/main/LICENSE I don't see "Copyright (c) 2024 The Spegel Authors" (the "above copyright notice" in https://github.com/spegel-org/spegel/blob/main/LICENSE https://github.com/spegel-org/spegel/blob/main/LICENSE) anywhere. Where do you see it?
      - ryao 2y ago
        To be fair, Spegel changed the copyright notice in 2024. It used to say someone else. That said, Microsoft is definitely missing the notice.
        cestith 2y ago
        The original author can change their own notice. Why would that be a problem?
        Zambyte 2y ago
        Well they could technically have proper attribution without the literal string "Copyright (c) 2024 The Spegel Authors" if they included an older copyright notice that was more appropriate. I think that was the point they were making.
        ryao 2y ago
        This is correct and is roughly what I meant. My only nitpick is that I was thinking that if they forked at the time of the older notice, they would be fine to have used it, rather than a vague notion of appropriateness that probably was intended to mean the same thing, but is less precise. The hacker news post reached someone high enough up at Microsoft to have things changed. They ended placing a combined copyright notice that is a mixture of both versions into the repository to play it safe.
- Asmod4n 2y ago
  GPL doesn’t help you with them taking your idea and doing a clean room implementation. You’d need to patent your idea to stop that.
  - bayindirh 2y ago
    I never claimed that? Citing myself from my comment: > As a result, this would probably forced Microsoft to develop a new one from scratch, because they're allergic to GPL, because if they have breached GPL, they would be forced to comply, since GPL is court tested already. So, we seem to agree here.
- jeremyjh 2y ago
  GPL/AGPL might have improved the attribution, but they would not have prevented anything else from happening because Microsoft is publishing the source code.
liveafterlove 2y ago
Is this really true? Whats the point of even licensing our repo then?
- staunton 2y ago
  A major point is communicating your intentions to people who care about them and who will respect how you wish your project to be treated.
- diggan 2y ago
  Well, there are other companies than Microsoft out there, most of which tend to respect FOSS licenses when they fork projects/interact with the ecosystem, at least in my experience.
gwd 2y ago
> Does it matter what license you use if they actively ignore the terms in the license you did chose? If they're breaking the license, go talk to a lawyer. You might start by approaching the SFLC [1] (although I haven't heard much from them recently). [1] https://softwarefreedom.org/ https://softwarefreedom.org/
- diggan 2y ago
  Sometimes social pressure can be a cheaper approach, time will tell if it'll work in this case :)
- YetAnotherNick 2y ago
  Is there any for profit law firm which works without fee in cases like these and split the earnings? Needing to pay lawyer upfront makes it hard for individuals to sue mega corp even if they were clearly wronged.
- pabs3 2y ago
  I would suggest Software Freedom Conservancy instead: https://sfconservancy.org/copyleft-compliance/help.html https://sfconservancy.org/copyleft-compliance/help.html
sublimefire 2y ago
MS has internal tools that scan dependencies etc and flag them against legal team if anything is fishy. License choice matters quite a bit, they will not risk litigation.
- diggan 2y ago
  Guess they should start using those tools when they setup their "looks-like-acquihire-but-really-is-a-brain-dump" meetings so they could flag the FOSS projects they want to rewrite internally.
  - baq 2y ago
    People who run the meetings are not people who run the scanners. See also: Microsoft’s org chart https://imgur.com/gallery/org-charts-uBcF28f https://imgur.com/gallery/org-charts-uBcF28f
baq 2y ago
If you worked at a megacorp you’d know they care a whole lot about not allowing GPL code anywhere near their propertiary repos; this is usually enforced by IT security (NOT engineering) with dedicated scanners, confirmed matches are at least highest priority bugs.
- mvdtnz 2y ago
  Not just mega corps. Everywhere I've worked for the past 10+ years treats GPL code like leprosy. You just don't go anywhere near it for any reason. It's the first thing you look for when taking on a new external dependency.
  - trelane 2y ago
    Yeah, giving massive corporations a free ride has been incredibly successful for corporations. For their users not so much.
  - mickael-kerjean 2y ago
    Everywhere I've worked for the past 10+ years treats open source like a candy store to benefit from and wouldn't allow contributing code back
    - matheusmoreira 2y ago
      https://web.archive.org/web/20120620103603/http://zedshaw.com/essays/why_i_gpl.html https://web.archive.org/web/20120620103603/http://zedshaw.co... > Why I (A/L)GPL > I want people to appreciate the work I’ve done and the value of what I’ve made. > Not pass on by waving “sucker” as they drive their fancy cars. Always choose AGPLv3 no matter what it is you're doing. If they want it, AGPLv3 gives you the leverage to negotiate a licensing deal. You sell them permission to violate it. I even emailed Stallman asking what he thought of this strategy. He thinks it's a net good.
      - pabs3 2y ago
        Depends on the terms of the deal, I would want to at minimum get back any modifications they are making.
zamadatix 2y ago
It matters because the only thing which can be claimed to have been ignored here is missing the line "Copyright (c) 2024 The Spegel Authors" in the main license file. Now that it's brought up https://github.com/Azure/peerd/issues/109 https://github.com/Azure/peerd/issues/109 that'll probably be fixed. What remains after full compliance with the MIT license choince will be the bulk of the complaints in the article.
- diggan 2y ago
  > It matters because the only So if the author instead used GPL, this wouldn't have been a problem? Call me pessimist, but I don't think Microsoft would have cared if it was MIT, GPL or even missing a license (so copyrighted by the author), they would have made the same choice as they just now did. I'm sorry, but it's really hard to understand what you mean here, how choosing GPL would have somehow lead to a different outcome.
  - riquito 2y ago
    For the copyright part, it wouldn't have lead to a different outcome. What could have been different is that Microsoft could have had difficulties in working on a GPL fork which is harder to resell (you can, but people are sometimes afraid for good or bad reasons) and so Microsoft could have proposed to the author to sell them a copy with a different license. But reading the article, the author appears to be more disgruntled by the fact that a behemoth forked his project than the mishandling of the copyright that can be fixed with one PR (he is right to be pissed about that, but that's an easily solvable problem, I doubt Microsoft will stand against it).
    - trelane 2y ago
      I suspect that damages may also play a role in practical resolution of infringement. There is a large difference between "they didn't put in a sentence that they needed to," and "we have 30 users who didn't get the source code that they were required to receive."
  - zamadatix 2y ago
davidgerard 2y ago
It matters because the GPL has been upheld in US courts.
matheusmoreira 2y ago
I may be a hobbyist developer but I do have access to lawyers and I'm not afraid of using them. People get sued over the smallest matters every single day. Corporations should be no exception.
spit2wind 2y ago
> MIT requires attribution, but they didn't I'm confused how you and others reach this conclusion. No, it doesn't. The MIT license is one of the shortest free license that exists: Copyright (c) <year> <copyright holders> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. https://en.m.wikipedia.org/wiki/MIT_License https://en.m.wikipedia.org/wiki/MIT_License No where does that require attribution. It has basically one condition: perpetuate the license. Maybe the author didn't actually use an MIT license, despite claiming to? But as far as the MIT license is concerned, as long as the other party provides the same license for the fork, that's all that's needed.
- cryptonector 2y ago
  > > MIT requires attribution, but they didn't > I'm confused how you and others reach this conclusion. No, it doesn't. | Copyright (c) <year> <copyright holders> | | ... | | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. The copyright notice that must be preserved includes the copyright holders' names, and that is a form of attribution.
  - spit2wind 2y ago
    Ah okay, thank you
indymike 2y ago
>You surely could have put "You must license your project the same as the one you forked from" and they still would have ignored it, No, they would have found something else that wasn't a pain to steal.

by diggan 2y ago

bayindirh 2y ago

MIT doesn't need attribution. Original BSD does, but revised and most widespread BSDs do not. GPL/AGPL would prevented this somehow, requiring proper attribution via mandatory source code release, and allowing to track project origins. This would make it harder to label it as a "a Microsoft Product from Ground Up", and prevent Sherlocking the original application to a greater degree. As a result, this would probably forced Microsoft to develop a new one from scratch, because they're allergic to GPL, because if they have breached GPL, they would be forced to comply, since GPL is court tested already. So, write Free Software. Not Open Source. Esp. for your personal projects.

Zambyte 2y ago
> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. Source: the MIT license. https://choosealicense.com/licenses/mit/ https://choosealicense.com/licenses/mit/
- bayindirh 2y ago
  There's no writing in that license which I can't change the copyright after forking the code. There's a copyright line, check. There's the permission notice, check. The rest is just goodwill and ethics, which is not a very valuable currency in software in these days.
  - Zambyte 2y ago
    You can't just remove the above copyright notice and replace it with your own and claim you retained the copyright notice lol
    - bayindirh 2y ago
      Can you give me a couple examples how this is done? I mean, in terms of actual repositories.
      - throwaway277432 2y ago
        The easiest way to do it is to add your own copyright line above the original LICENSE copyright line. That way anyone touching the project can just add their own line on top. Done. EDIT: Example: https://github.com/go-gitea/gitea/blob/main/LICENSE https://github.com/go-gitea/gitea/blob/main/LICENSE A more complicated way to do it is to add a folder that contains the original LICENSE file or files. Sometimes there is more than one license, or the license texts differ. In that case, you must preserve all the different variants, even if they all call themselves MIT. Then, you can optionally add your additional own LICENSE file * only iff* it is compatible with all existing LICENSES. In the case of the MIT license, you may relicense, sublicense, or use a different license in addition, provided it is MIT-compatible. With e.g. GPL you can't. Note that you still have to preserve all the original LICENSE files in the repo.
      - Zambyte 2y ago
        Original license of Redis is retained in the form Valkey: https://github.com/valkey-io/valkey/blob/unstable/COPYING https://github.com/valkey-io/valkey/blob/unstable/COPYING Third party licenses retained in a THIRDPARTY file in MariaDB https://github.com/MariaDB/server/blob/main/THIRDPARTY https://github.com/MariaDB/server/blob/main/THIRDPARTY Only two good examples I could quickly find.
  - throwaway277432 2y ago
    No! Once you change the copyright line, you no longer include "the above copyright notice". At that point you're violating the license. You are also not allowed to change the copyright notice or license text in any way (you may however add to the license, which is a loophole other licenses such as GPL fix.) Substantial is subject to (legal) debate as the Oracle vs. MS case has shown. Whole functions or large parts of files however should always be considered substantial, as the software would otherwise not work. I'm seriously flabbergasted at how bad reading comprehension seems to be among coders.
- sublimefire 2y ago
  Yes and they do redistribute under MIT as well, there is no foul play here
  - Zambyte 2y ago
    https://github.com/Azure/peerd/blob/main/LICENSE https://github.com/Azure/peerd/blob/main/LICENSE I don't see "Copyright (c) 2024 The Spegel Authors" (the "above copyright notice" in https://github.com/spegel-org/spegel/blob/main/LICENSE https://github.com/spegel-org/spegel/blob/main/LICENSE) anywhere. Where do you see it?
    - ryao 2y ago
      To be fair, Spegel changed the copyright notice in 2024. It used to say someone else. That said, Microsoft is definitely missing the notice.
      - cestith 2y ago
        The original author can change their own notice. Why would that be a problem?
        Zambyte 2y ago
        Well they could technically have proper attribution without the literal string "Copyright (c) 2024 The Spegel Authors" if they included an older copyright notice that was more appropriate. I think that was the point they were making.
        ryao 2y ago
        This is correct and is roughly what I meant. My only nitpick is that I was thinking that if they forked at the time of the older notice, they would be fine to have used it, rather than a vague notion of appropriateness that probably was intended to mean the same thing, but is less precise. The hacker news post reached someone high enough up at Microsoft to have things changed. They ended placing a combined copyright notice that is a mixture of both versions into the repository to play it safe.
Asmod4n 2y ago
GPL doesn’t help you with them taking your idea and doing a clean room implementation. You’d need to patent your idea to stop that.
- bayindirh 2y ago
  I never claimed that? Citing myself from my comment: > As a result, this would probably forced Microsoft to develop a new one from scratch, because they're allergic to GPL, because if they have breached GPL, they would be forced to comply, since GPL is court tested already. So, we seem to agree here.
jeremyjh 2y ago
GPL/AGPL might have improved the attribution, but they would not have prevented anything else from happening because Microsoft is publishing the source code.

liveafterlove 2y ago

Is this really true? Whats the point of even licensing our repo then?

staunton 2y ago
A major point is communicating your intentions to people who care about them and who will respect how you wish your project to be treated.
diggan 2y ago
Well, there are other companies than Microsoft out there, most of which tend to respect FOSS licenses when they fork projects/interact with the ecosystem, at least in my experience.

gwd 2y ago

> Does it matter what license you use if they actively ignore the terms in the license you did chose? If they're breaking the license, go talk to a lawyer. You might start by approaching the SFLC [1] (although I haven't heard much from them recently). [1] https://softwarefreedom.org/ https://softwarefreedom.org/

diggan 2y ago
Sometimes social pressure can be a cheaper approach, time will tell if it'll work in this case :)
YetAnotherNick 2y ago
Is there any for profit law firm which works without fee in cases like these and split the earnings? Needing to pay lawyer upfront makes it hard for individuals to sue mega corp even if they were clearly wronged.
pabs3 2y ago
I would suggest Software Freedom Conservancy instead: https://sfconservancy.org/copyleft-compliance/help.html https://sfconservancy.org/copyleft-compliance/help.html

sublimefire 2y ago

MS has internal tools that scan dependencies etc and flag them against legal team if anything is fishy. License choice matters quite a bit, they will not risk litigation.

diggan 2y ago
Guess they should start using those tools when they setup their "looks-like-acquihire-but-really-is-a-brain-dump" meetings so they could flag the FOSS projects they want to rewrite internally.
- baq 2y ago
  People who run the meetings are not people who run the scanners. See also: Microsoft’s org chart https://imgur.com/gallery/org-charts-uBcF28f https://imgur.com/gallery/org-charts-uBcF28f

baq 2y ago

If you worked at a megacorp you’d know they care a whole lot about not allowing GPL code anywhere near their propertiary repos; this is usually enforced by IT security (NOT engineering) with dedicated scanners, confirmed matches are at least highest priority bugs.

mvdtnz 2y ago
Not just mega corps. Everywhere I've worked for the past 10+ years treats GPL code like leprosy. You just don't go anywhere near it for any reason. It's the first thing you look for when taking on a new external dependency.
- trelane 2y ago
  Yeah, giving massive corporations a free ride has been incredibly successful for corporations. For their users not so much.
- mickael-kerjean 2y ago
  Everywhere I've worked for the past 10+ years treats open source like a candy store to benefit from and wouldn't allow contributing code back
  - matheusmoreira 2y ago
    https://web.archive.org/web/20120620103603/http://zedshaw.com/essays/why_i_gpl.html https://web.archive.org/web/20120620103603/http://zedshaw.co... > Why I (A/L)GPL > I want people to appreciate the work I’ve done and the value of what I’ve made. > Not pass on by waving “sucker” as they drive their fancy cars. Always choose AGPLv3 no matter what it is you're doing. If they want it, AGPLv3 gives you the leverage to negotiate a licensing deal. You sell them permission to violate it. I even emailed Stallman asking what he thought of this strategy. He thinks it's a net good.
    - pabs3 2y ago
      Depends on the terms of the deal, I would want to at minimum get back any modifications they are making.

zamadatix 2y ago

It matters because the only thing which can be claimed to have been ignored here is missing the line "Copyright (c) 2024 The Spegel Authors" in the main license file. Now that it's brought up https://github.com/Azure/peerd/issues/109 https://github.com/Azure/peerd/issues/109 that'll probably be fixed. What remains after full compliance with the MIT license choince will be the bulk of the complaints in the article.

diggan 2y ago
> It matters because the only So if the author instead used GPL, this wouldn't have been a problem? Call me pessimist, but I don't think Microsoft would have cared if it was MIT, GPL or even missing a license (so copyrighted by the author), they would have made the same choice as they just now did. I'm sorry, but it's really hard to understand what you mean here, how choosing GPL would have somehow lead to a different outcome.
- riquito 2y ago
  For the copyright part, it wouldn't have lead to a different outcome. What could have been different is that Microsoft could have had difficulties in working on a GPL fork which is harder to resell (you can, but people are sometimes afraid for good or bad reasons) and so Microsoft could have proposed to the author to sell them a copy with a different license. But reading the article, the author appears to be more disgruntled by the fact that a behemoth forked his project than the mishandling of the copyright that can be fixed with one PR (he is right to be pissed about that, but that's an easily solvable problem, I doubt Microsoft will stand against it).
  - trelane 2y ago
    I suspect that damages may also play a role in practical resolution of infringement. There is a large difference between "they didn't put in a sentence that they needed to," and "we have 30 users who didn't get the source code that they were required to receive."
- zamadatix 2y ago

davidgerard 2y ago

It matters because the GPL has been upheld in US courts.

matheusmoreira 2y ago

I may be a hobbyist developer but I do have access to lawyers and I'm not afraid of using them. People get sued over the smallest matters every single day. Corporations should be no exception.

spit2wind 2y ago

> MIT requires attribution, but they didn't I'm confused how you and others reach this conclusion. No, it doesn't. The MIT license is one of the shortest free license that exists: Copyright (c) <year> <copyright holders> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. https://en.m.wikipedia.org/wiki/MIT_License https://en.m.wikipedia.org/wiki/MIT_License No where does that require attribution. It has basically one condition: perpetuate the license. Maybe the author didn't actually use an MIT license, despite claiming to? But as far as the MIT license is concerned, as long as the other party provides the same license for the fork, that's all that's needed.

cryptonector 2y ago
> > MIT requires attribution, but they didn't > I'm confused how you and others reach this conclusion. No, it doesn't. | Copyright (c) <year> <copyright holders> | | ... | | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. The copyright notice that must be preserved includes the copyright holders' names, and that is a form of attribution.
- spit2wind 2y ago
  Ah okay, thank you

indymike 2y ago

>You surely could have put "You must license your project the same as the one you forked from" and they still would have ignored it, No, they would have found something else that wasn't a pain to steal.