5 ms·

I initially was going to say: Failing to abide by the MIT license is copyright infringement. My advice is to contact these guys: https://softwarefreedom.org/ h

by ryao 2y ago

I initially was going to say: Failing to abide by the MIT license is copyright infringement. My advice is to contact these guys: https://softwarefreedom.org/ https://softwarefreedom.org/ They likely can file a cease and desist on your behalf. However, I took a closer look at the files in question. The MIT license requires that they retain and provide copyright notices, but you never put copyright notices in your files. The only place where you appear to have placed a copyright notice is in the LICENSE file: https://github.com/spegel-org/spegel/commit/23ed0d60f66dd2923ca03611c592d33e61e5ffee https://github.com/spegel-org/spegel/commit/23ed0d60f66dd292... Things become interesting when I look at their LICENSE file. They appear to have tried to relicense this to Apache 2.0 before backpedaling and reinstating the MIT license: https://github.com/Azure/peerd/commit/473a26c808907f2d9f7b7f0b8924c05a95dbe144 https://github.com/Azure/peerd/commit/473a26c808907f2d9f7b7f... Unless they forked from a very early version of the project that did not even have the LICENSE file, they removed the sole copyright notice you had in the repository. That brings us back to my original thoughts, which is that they have committed copyright infringement, and you should contact OSS friendly lawyers about it. I am not a lawyer, but I do contribute to various OSS projects and all of the ones to which I have ever contributed have copyright notice headers at the top of every file to ensure proper attribution is maintained no matter where that code is used. Beyond having that sole missing copyright notice reinstated, I am not sure what else you could expect since none of your files have proper copyright headers in them. The SFLC guys would be in a better position to advise you, as they are actual lawyers.

johnisgood 2y ago
> but you never put copyright notices in your files. I thought having a LICENSE file in the project's root directory was sufficient. Is it not the case?
- ryao 2y ago
  It is a fairly standard practice in at least some open source communities to add copyright notices to files that people have changed significantly, although there is no well defined minimum threshold for how much permits them to add a copyright notice. Thus, someone else can come along, fork the project, add copyright notices to all of the files and then give the impression that they wrote them, since there is no attribution aside from the one LICENSE file that you wrote. The git history might show the truth, but if they copy the files into a fresh git repository, that metadata will be lost. Projects take files from one another all the time, so there is no guarantee that they will preserve your commit history and then anyone curious who wrote the code needs to do digital archaeology. That said, file level copyright notices are not perfect (since only the VCS shows who added what lines and that might not be preserved), but it is better than nothing and it is something that is guaranteed to persist as long as people are abiding by licenses. If they are not, that is copyright infringement and the copyright holder can do things like send cease and desist notices in response to the copyright notices being removed. Also, I must emphasize that I am not a lawyer, but one might argue that it was not willful infringement if someone removed a copyright notice from 1 file by claiming it had been a mistake. However, if they remove it from all files, then nobody is going to believe it was not willful.
  - johnisgood 2y ago
    Thanks! I have some open source projects where I only have one LICENSE file (it is also in README), but I will consider adding it to all files, there are just too many files. :/ I am inconsistent, because I have projects that contain the copyright notice in all files.
    - ryao 2y ago
      [flagged]
      - deleted 2y ago
        [deleted]
      - matkoniecz 2y ago
        Why you think that LLM-generated legal advise is worth posting on forum for humans?
        DrammBA 2y ago
        > Why you think that LLM-generated legal advise is worth posting on forum for humans? Can you quote which part of the LLM chat above constitutes legal advice? I read the whole chat and didn't see any.
        DrammBA 2y ago
        for reference this was the chat that allegedly contained legal advice: https://chatgpt.com/share/6806382f-7944-800f-95aa-8c770276237e https://chatgpt.com/share/6806382f-7944-800f-95aa-8c77027623...
        ryao 2y ago
        It does not. It simply discusses ways of adding headers to arbitrary source code. The intention is to add license and copyright headers, but the reality is that these headers can say anything. It is discussing generic techniques for doing this.
- veltas 2y ago
  Sufficient but a good idea to put copyright in all files. Technically if there's no license found then it should be considered automatically copyrighted, with no permissions to copy. So leaving copyright license out actually makes it less open source.
  - ryao 2y ago
    The license does not necessarily need to be in the files. It could be a project level license in LICENSE, which is what the author here did.
    - veltas 2y ago
      Yes that's exactly what I said :)
    - dboreham 2y ago
      It's not the license that's important, but the copyright notice.
    - frumplestlatz 2y ago
      It really should be in all files, not because it’s legally necessary, but because it’s the best way to ensure that the correct license/copyright follows the code to which it applies. Consider future contributions; the contributor’s copyright should apply only to the files to which they contributed. Similarly, consider any code that you incorporate from external sources; that code’s copyright and license should only apply to the files in which it has been incorporated. Lastly, consider the case where the code is copied out of your project to be incorporated in a different project. The license and copyright should follow with those files (and if your files don’t include copyright and license at the top, it’s very likely the person doing that copying will insert it themselves for this same reason).
      - ryao 2y ago
        I was responding to this: Sufficient but a good idea to put copyright in all files. Technically if there's no license found then it should be considered automatically copyrighted, with no permissions to copy. So leaving copyright license out actually makes it less open source. I said it is not legally necessary to have that in every file in the previous comment solely to contradict the idea that his project level LICENSE file did not constitute a license for the individual files. I did not at any time suggest that it was not a good idea to put notices in every file. In fact, if you look at my other comments, you will see that I said that he should have put copyright notices into every file multiple times. I even said it at the root of this thread: https://news.ycombinator.com/item?id=43750850 https://news.ycombinator.com/item?id=43750850
- dboreham 2y ago
  I would say: absolutely no (ianal). But I've had stand up arguments with colleagues in the recent past that I was unable to win. They wouldn't even ask the legal team for an opinion. But it's nice to see some evidence here that I was correct.
- ndiddy 2y ago
  It's not required, but it's generally safer to put a notice saying who owns the copyright and what license the file is released under at the top of each file. Some licenses like MIT, the BSD licenses, Zlib, etc are short enough that you can include the full license text in the notice, and others like GPL provide sample copyright header text to include. Here's an example of this from a random file in the SDL source code: https://github.com/libsdl-org/SDL/blob/main/src/video/SDL_blit.c https://github.com/libsdl-org/SDL/blob/main/src/video/SDL_bl... Obviously Microsoft is still committing copyright infringement and in the wrong here. However, if the author had copyright notices in each file and then Microsoft stripped them out or changed the copyright information, it would make it harder for them to brush it off with "oops, we forgot to commit the correct LICENSE file" like I'm sure they'll do here.
  - deleted 2y ago
    [deleted]
mikeortman 2y ago
Just the absence of a license generally means the creator has all right reserved by default. You don’t need a license in every file because in much of the world copyright is given by default to the creator. A licensed file is permission to do something with that copyright material.
- ryao 2y ago
  He had a top level license file that presumably applies to all files. He would not be the first to do that and will not be the last. That said, if Microsoft had forked before the LICENSE was added or stated somewhere, they were reusing all-rights-reserved code, which is definitely copyright infringement. Again, I am not a lawyer.
boxed 2y ago
It says "copyright microsoft" in that license file. Just because THAT file is MIT is irrelevant. They didn't retain the original license file. They should have APPENDED to it, keeping the original copyright holder name, otherwise it's just blatant copyright infringement that coincidentally is released under the same license.
- ryao 2y ago
  I am not a lawyer, but I imagine a lawyer would find it alright if they just restore the missing notice. I do not imagine there is much else that can be done here since he cannot really claim to have been significantly damaged by the absence of a single line, but these matters are best discussed with attorneys.
  - tgsovlerkhgsel 2y ago
    I imagine a lawyer sending them a settlement offer for the blatant copyright violation they committed would get them to settle for a five-digit amount, since just the cost of discovery (and potentially having the "let's just fork it" dirty email laundry aired in public court) would be much higher.
    - saagarjha 2y ago
      I doubt this developer has the money to burn on a lawsuit like that.
      - tgsovlerkhgsel 2y ago
        The letter is cheap, and there might be law firms willing to fund it for a cut of the profits, making the threat credible.
  - cflewis 2y ago
    IANAL but my understanding from floating around open source licensing circles is that you'd have a hard time with the judge if you didn't just ask for the license to be put back as step 1. Microsoft willingly not restoring the license would be more problematic. The forgiveness clause in GPL 3 is as much an acknowledgement of actual reality than anything else.
scosman 2y ago
If they forked from before the author had a license, it’s worse. MS had no right to use it. I’ve contributed to plenty of project that don’t have the per-file copyrights. It’s a choice not a mistake.
- ryao 2y ago
  > If they forked from before the author had a license, it’s worse. MS had no right to use it. You are right, provided he did not have a notice saying it was MIT licensed elsewhere. > I’ve contributed to plenty of project that don’t have the per-file copyrights. It’s a choice not a mistake. I would consider it to be both a choice and a mistake. The two are not mutually exclusive. There is no evidence in the fork that he is the copyright holder of the original code and it looks like Microsoft is. Part of that is Microsoft’s fault, but part of that is the original author’s fault for not including per file copyright notices, such that Microsoft could add theirs and be the sole one listed in every file. I would not be surprised if Microsoft’s legal department doing a scan of public repositories for stolen code mistook him for infringing on “their code” given that they have no information that he authored it rather than their employee. It sounds absurd, but it has happened. I know for a fact the sg3 utils author added copyright notices to his code examples because he was getting contacted by companies, whose engineers incorporated his code into their projects without attribution, that thought he had stolen their code: https://github.com/doug-gilbert/sg3_utils https://github.com/doug-gilbert/sg3_utils I know that because he told me by email in 2013.
  - bornfreddy 2y ago
    > There is no evidence in the fork that he is the copyright holder of the original code and it looks like Microsoft is. Part of that is Microsoft’s fault, but part of that is his fault for not including per file copyright notices, such that Microsoft could add theirs and be the sole one listed in every file. Absolutely not! This is completely and only M$'s fault, whichever way you look at it. Copying a file and slapping your own license on it, without consideration of the original one, is never acceptable. Don't blaim the victim please. As for incompetence - well maybe they (M$) need to get better at managing licenses? Accusing others of stealing when the reverse is true only makes everything worse. Let's not try to change the standard way of licensing because some developers can't be bothered to check the license (and even fix typos in comments, apparently). As an aside, there is no need to add copyright / license to every file. I would even consider it an anti-pattern, because it pollutes the code with noise.

by ryao 2y ago

johnisgood 2y ago

> but you never put copyright notices in your files. I thought having a LICENSE file in the project's root directory was sufficient. Is it not the case?

ryao 2y ago
It is a fairly standard practice in at least some open source communities to add copyright notices to files that people have changed significantly, although there is no well defined minimum threshold for how much permits them to add a copyright notice. Thus, someone else can come along, fork the project, add copyright notices to all of the files and then give the impression that they wrote them, since there is no attribution aside from the one LICENSE file that you wrote. The git history might show the truth, but if they copy the files into a fresh git repository, that metadata will be lost. Projects take files from one another all the time, so there is no guarantee that they will preserve your commit history and then anyone curious who wrote the code needs to do digital archaeology. That said, file level copyright notices are not perfect (since only the VCS shows who added what lines and that might not be preserved), but it is better than nothing and it is something that is guaranteed to persist as long as people are abiding by licenses. If they are not, that is copyright infringement and the copyright holder can do things like send cease and desist notices in response to the copyright notices being removed. Also, I must emphasize that I am not a lawyer, but one might argue that it was not willful infringement if someone removed a copyright notice from 1 file by claiming it had been a mistake. However, if they remove it from all files, then nobody is going to believe it was not willful.
- johnisgood 2y ago
  Thanks! I have some open source projects where I only have one LICENSE file (it is also in README), but I will consider adding it to all files, there are just too many files. :/ I am inconsistent, because I have projects that contain the copyright notice in all files.
  - ryao 2y ago
    [flagged]
    - deleted 2y ago
      [deleted]
    - matkoniecz 2y ago
      Why you think that LLM-generated legal advise is worth posting on forum for humans?
      - DrammBA 2y ago
        > Why you think that LLM-generated legal advise is worth posting on forum for humans? Can you quote which part of the LLM chat above constitutes legal advice? I read the whole chat and didn't see any.
        DrammBA 2y ago
        for reference this was the chat that allegedly contained legal advice: https://chatgpt.com/share/6806382f-7944-800f-95aa-8c770276237e https://chatgpt.com/share/6806382f-7944-800f-95aa-8c77027623...
        ryao 2y ago
        It does not. It simply discusses ways of adding headers to arbitrary source code. The intention is to add license and copyright headers, but the reality is that these headers can say anything. It is discussing generic techniques for doing this.
veltas 2y ago
Sufficient but a good idea to put copyright in all files. Technically if there's no license found then it should be considered automatically copyrighted, with no permissions to copy. So leaving copyright license out actually makes it less open source.
- ryao 2y ago
  The license does not necessarily need to be in the files. It could be a project level license in LICENSE, which is what the author here did.
  - veltas 2y ago
    Yes that's exactly what I said :)
  - dboreham 2y ago
    It's not the license that's important, but the copyright notice.
  - frumplestlatz 2y ago
    It really should be in all files, not because it’s legally necessary, but because it’s the best way to ensure that the correct license/copyright follows the code to which it applies. Consider future contributions; the contributor’s copyright should apply only to the files to which they contributed. Similarly, consider any code that you incorporate from external sources; that code’s copyright and license should only apply to the files in which it has been incorporated. Lastly, consider the case where the code is copied out of your project to be incorporated in a different project. The license and copyright should follow with those files (and if your files don’t include copyright and license at the top, it’s very likely the person doing that copying will insert it themselves for this same reason).
    - ryao 2y ago
      I was responding to this: Sufficient but a good idea to put copyright in all files. Technically if there's no license found then it should be considered automatically copyrighted, with no permissions to copy. So leaving copyright license out actually makes it less open source. I said it is not legally necessary to have that in every file in the previous comment solely to contradict the idea that his project level LICENSE file did not constitute a license for the individual files. I did not at any time suggest that it was not a good idea to put notices in every file. In fact, if you look at my other comments, you will see that I said that he should have put copyright notices into every file multiple times. I even said it at the root of this thread: https://news.ycombinator.com/item?id=43750850 https://news.ycombinator.com/item?id=43750850
dboreham 2y ago
I would say: absolutely no (ianal). But I've had stand up arguments with colleagues in the recent past that I was unable to win. They wouldn't even ask the legal team for an opinion. But it's nice to see some evidence here that I was correct.
ndiddy 2y ago
It's not required, but it's generally safer to put a notice saying who owns the copyright and what license the file is released under at the top of each file. Some licenses like MIT, the BSD licenses, Zlib, etc are short enough that you can include the full license text in the notice, and others like GPL provide sample copyright header text to include. Here's an example of this from a random file in the SDL source code: https://github.com/libsdl-org/SDL/blob/main/src/video/SDL_blit.c https://github.com/libsdl-org/SDL/blob/main/src/video/SDL_bl... Obviously Microsoft is still committing copyright infringement and in the wrong here. However, if the author had copyright notices in each file and then Microsoft stripped them out or changed the copyright information, it would make it harder for them to brush it off with "oops, we forgot to commit the correct LICENSE file" like I'm sure they'll do here.
- deleted 2y ago
  [deleted]

mikeortman 2y ago

Just the absence of a license generally means the creator has all right reserved by default. You don’t need a license in every file because in much of the world copyright is given by default to the creator. A licensed file is permission to do something with that copyright material.

ryao 2y ago
He had a top level license file that presumably applies to all files. He would not be the first to do that and will not be the last. That said, if Microsoft had forked before the LICENSE was added or stated somewhere, they were reusing all-rights-reserved code, which is definitely copyright infringement. Again, I am not a lawyer.

boxed 2y ago

It says "copyright microsoft" in that license file. Just because THAT file is MIT is irrelevant. They didn't retain the original license file. They should have APPENDED to it, keeping the original copyright holder name, otherwise it's just blatant copyright infringement that coincidentally is released under the same license.

ryao 2y ago
I am not a lawyer, but I imagine a lawyer would find it alright if they just restore the missing notice. I do not imagine there is much else that can be done here since he cannot really claim to have been significantly damaged by the absence of a single line, but these matters are best discussed with attorneys.
- tgsovlerkhgsel 2y ago
  I imagine a lawyer sending them a settlement offer for the blatant copyright violation they committed would get them to settle for a five-digit amount, since just the cost of discovery (and potentially having the "let's just fork it" dirty email laundry aired in public court) would be much higher.
  - saagarjha 2y ago
    I doubt this developer has the money to burn on a lawsuit like that.
    - tgsovlerkhgsel 2y ago
      The letter is cheap, and there might be law firms willing to fund it for a cut of the profits, making the threat credible.
- cflewis 2y ago
  IANAL but my understanding from floating around open source licensing circles is that you'd have a hard time with the judge if you didn't just ask for the license to be put back as step 1. Microsoft willingly not restoring the license would be more problematic. The forgiveness clause in GPL 3 is as much an acknowledgement of actual reality than anything else.

scosman 2y ago

If they forked from before the author had a license, it’s worse. MS had no right to use it. I’ve contributed to plenty of project that don’t have the per-file copyrights. It’s a choice not a mistake.

ryao 2y ago
> If they forked from before the author had a license, it’s worse. MS had no right to use it. You are right, provided he did not have a notice saying it was MIT licensed elsewhere. > I’ve contributed to plenty of project that don’t have the per-file copyrights. It’s a choice not a mistake. I would consider it to be both a choice and a mistake. The two are not mutually exclusive. There is no evidence in the fork that he is the copyright holder of the original code and it looks like Microsoft is. Part of that is Microsoft’s fault, but part of that is the original author’s fault for not including per file copyright notices, such that Microsoft could add theirs and be the sole one listed in every file. I would not be surprised if Microsoft’s legal department doing a scan of public repositories for stolen code mistook him for infringing on “their code” given that they have no information that he authored it rather than their employee. It sounds absurd, but it has happened. I know for a fact the sg3 utils author added copyright notices to his code examples because he was getting contacted by companies, whose engineers incorporated his code into their projects without attribution, that thought he had stolen their code: https://github.com/doug-gilbert/sg3_utils https://github.com/doug-gilbert/sg3_utils I know that because he told me by email in 2013.
- bornfreddy 2y ago
  > There is no evidence in the fork that he is the copyright holder of the original code and it looks like Microsoft is. Part of that is Microsoft’s fault, but part of that is his fault for not including per file copyright notices, such that Microsoft could add theirs and be the sole one listed in every file. Absolutely not! This is completely and only M$'s fault, whichever way you look at it. Copying a file and slapping your own license on it, without consideration of the original one, is never acceptable. Don't blaim the victim please. As for incompetence - well maybe they (M$) need to get better at managing licenses? Accusing others of stealing when the reverse is true only makes everything worse. Let's not try to change the standard way of licensing because some developers can't be bothered to check the license (and even fix typos in comments, apparently). As an aside, there is no need to add copyright / license to every file. I would even consider it an anti-pattern, because it pollutes the code with noise.