5 ms·

Did you read the quarter-million-line license for your Slack app?

104 points by leakycap 1y ago

leakycap 1y ago
And we provide these apps with data and collaboration we rely on for our business or clubs day-to-day? Time to rethink.
nettlin 1y ago
This file does not contain the terms of service of Slack. Rather, it contains the software licenses of third-party code that is embedded in Chromium, which in turn is embedded in the Slack app. Every dependency has its own license, which is why the file is so big (800× Apache-2.0, 237× MIT, 59× LGPL, and so on).
- zahlman 1y ago
  Why can't it deduplicate matching licenses?
  - throwup238 1y ago
    The legal department doesn't want to take that chance.
    - phendrenad2 1y ago
      Lawyers can make mistakes, but to REALLY mess things up, you need lawyers, plus some engineers that take the lawyers too seriously.
      - cruffle_duffle 1y ago
        That goes true of basically every hard core expert. They might be wildly smart in their domain… and that is it.
      - dv_dt 1y ago
        The worst companies to work for are bad at differentiating risk especially ones that entertain the most remote legal risks. It seems to happen more with legal risks than security or technology risks.
  - Uehreka 1y ago
    I think it might be the case that licenses often include the authors’ names in the “this code is copyright of so-and-so” (as you can see, I Am Not A Lawyer) section, which might be considered part of the text of the license, thereby making it a requirement to include the full license text for each dependency.
    - notpushkin 1y ago
      It’s usually done in MIT-like licenses, which are quite short. But I’d argue that replacing it with Copyright (c) 207X Jonathan Fenimore Licensed MIT, see the license text below or even Copyright (c) 207X Jonathan Fenimore SPDX-License-Identifier: MIT should be enough, but IANAL too. --- In longer licenses like GPL or Apache, you are not supposed to change any copyright statement placeholders. For example, there’s this line in the GPL text: Copyright (C) <year> <name of author> But it’s a part of the “How to Apply These Terms to Your New Programs” section. You are supposed to copy it into your code and fill it out there instead. --- Or they could just compress the license amalgamation! I think it would be a bit bigger but pretty reasonable, and their lawyers should be happy with this arrangement.
  - gpm 1y ago
    Are you sure it doesn't*? * When we treat different versions of say, the MIT license, with different names and copyright years inserted, as different licenses. I have to imagine the file would compress extremely well though... I'm more curious why they don't use compression.
    - toast0 1y ago
      Not sure why Apple doesn't offer a compressed filesystem :p it makes writes a bit slower when compression fails, but otherwise the savings in I/O time often makes up for the increased processing on read and write.
  - s20n 1y ago
    That's how it is done in debian packages. The full text of each license is only mentioned once and given an identifier which is then used to link the license to the relevant copyright statements. For example: https://salsa.debian.org/debian/highlight/-/blob/94ee655915518d22669ad8341b212b0653c3b563/debian/copyright https://salsa.debian.org/debian/highlight/-/blob/94ee6559155...
  - sneak 1y ago
    I imagine it does precisely that when gzipped for distribution.
- hmartin 1y ago
  Title of this post is blatantly misleading for using the singular 'license'.
- JdeBP 1y ago
  This is BSD Licence Hell, and for about 10 years I've being doing what miniscule part I can do to ameliorate it. Debian people are trying to do their parts, too. * https://debian.org/doc/packaging-manuals/copyright-format/1.0/ https://debian.org/doc/packaging-manuals/copyright-format/1....
neuroelectron 1y ago
I can't really understand the point of using Slack. There's so many free alternatives.
- guerrilla 1y ago
  Someone also explain to me how gamers of all people can live with Discord when the thing barely works.
  - greenavocado 1y ago
    Wait until you find out both Ukrainian and Russian military were using Discord to communicate
    - superb_dev 1y ago
      Wait until you find out that the interim prime minister of Nepal was elected on Discord
  - jbaber 1y ago
    When I installed matrix, I thought it was an example of FOSS UI being crummy. Then I found out they were actually doing a good job of emulating discord.
    - dade_ 1y ago
      Except that Matrix is a protocol.
    - sealeck 1y ago
      Discord is much, much more user friendly than Matrix!
  - bigstrat2003 1y ago
    Because it actually works pretty well most of the time. I'm not sure where you get "barely works" from, but that's not remotely my experience or the experience of anyone I know. And of course, network effects are strong so that keeps people using it even through the occasional hiccups. As for how it got its foothold, it comes down to having an easier onboarding than the solutions it competed with. With Mumble (or Ventrilo, etc) someone has to pay for a server. Then you have to download the client, get the host and port to connect to, enter credentials, and so on. Repeat for every server you might join. With Discord, once your account is set up you just click on a link and join the server. You don't even have to use the client if you don't want; you can join from the browser just fine. I don't think the friction of using previous solutions was actually bad, but it was enough to give Discord an edge even without the integrated chat+voice angle (which is something that those other programs never did and still don't do).
wilg 1y ago
This is simply downstream of open source working as intended. It's also not a problem, and also there's no good solution.
- leakycap 1y ago
  > It's also not a problem, and also there's no good solution. I have worked with people who have this attitude and I wonder how they're doing these days. I hope they haven't ran into any problems they cannot simply dismiss as not problems that don't have solutions.
  - wilg 1y ago
    I didn't claim that there are no problems, just that this isn't one?
    - leakycap 1y ago
      I'm not sure why you asked a question here.
      - wilg 1y ago
        This is a common pattern in communication. https://www.thoughtco.com/what-is-a-declarative-question-1690372 https://www.thoughtco.com/what-is-a-declarative-question-169...
        leakycap 1y ago
        Communication involves getting your point across, and it's usually best if you don't have to google a link to explain your own comment.
        wilg 1y ago
        I don't think you're having a good faith discussion, and I think you weren't confused.
GuestFAUniverse 1y ago
My first computer had a 10MB HDD. * I could program with it comfortably (e.g. Turbo Pascal). * I could play with it (Civ, Day of the Tentacle with a few tricks, ...) * I could run a office suite. * I could communicate via mail and newsgroups In short: all problems back than could be solved at home. And yeah, I know that barely anybody cares _how utterly_ wasteful software has become.
- theideaofcoffee 1y ago
  But think of the dEvElopEr exPeRienCe! They may have to slow down on the rate they are shitting things out to actually learn a native system/UI toolkit, or, gasp, write it a few different times for different environments! Thats gonna affect some bonuses for sure.
JED3 1y ago
honestly the slack app store and it’s ridiculous policies makes publishing apps completely unworthy of the time investment. after having published numerous apps across dozens of marketplaces, I would advise everyone to avoid apps.slack.com at all costs. slack is beyond the maximum bloat threshold in virtually every aspect imaginable, TOS and licensing most especially. build elsewhere
hliyan 1y ago
We need to return to a world where we primarily own things, not rent them. If the software executable can be thought of as a machine, we should be able to own the version/instance of it we purchased the license for. We may not own the intellectual property, but we should have enough ownership to install it on a personal cloud computer we own and run it until such time we need to upgrade it.
- kristianc 1y ago
  Buy Campfire instead? https://once.com/campfire https://once.com/campfire
  - piskov 1y ago
    It’s free and under MIT (though no too long ago this wasn’t the case)
    - kristianc 1y ago
      Yeah, I see you're right. I had in my head it was around a $200 fee?
      - tossit444 1y ago
        299USD. It became free merely two weeks ago. https://nitter.net/dhh/status/1963675999012552970 https://nitter.net/dhh/status/1963675999012552970
      - powvans 1y ago
        You aren’t wrong. Up until a couple of weeks ago it was $299. Once. Forever. That was the whole idea. Very cool that they open sourced it. MIT license too. https://x.com/dhh/status/1963675999012552970 https://x.com/dhh/status/1963675999012552970 https://github.com/basecamp/once-campfire https://github.com/basecamp/once-campfire
  - shomp 1y ago
    Campfire needs 64GB RAM for 10,000 users, that surprises me, I would think we could get to 10k users with far less RAM.
Flatterer3544 1y ago
An alternative to look into, https://element.io/ https://element.io/ using Matrix, especially if encryption is preferred.

104 points by leakycap 1y ago

And we provide these apps with data and collaboration we rely on for our business or clubs day-to-day? Time to rethink.

This file does not contain the terms of service of Slack. Rather, it contains the software licenses of third-party code that is embedded in Chromium, which in turn is embedded in the Slack app. Every dependency has its own license, which is why the file is so big (800× Apache-2.0, 237× MIT, 59× LGPL, and so on).

zahlman 1y ago
Why can't it deduplicate matching licenses?
- throwup238 1y ago
  The legal department doesn't want to take that chance.
  - phendrenad2 1y ago
    Lawyers can make mistakes, but to REALLY mess things up, you need lawyers, plus some engineers that take the lawyers too seriously.
    - cruffle_duffle 1y ago
      That goes true of basically every hard core expert. They might be wildly smart in their domain… and that is it.
    - dv_dt 1y ago
      The worst companies to work for are bad at differentiating risk especially ones that entertain the most remote legal risks. It seems to happen more with legal risks than security or technology risks.
- Uehreka 1y ago
  I think it might be the case that licenses often include the authors’ names in the “this code is copyright of so-and-so” (as you can see, I Am Not A Lawyer) section, which might be considered part of the text of the license, thereby making it a requirement to include the full license text for each dependency.
  - notpushkin 1y ago
    It’s usually done in MIT-like licenses, which are quite short. But I’d argue that replacing it with Copyright (c) 207X Jonathan Fenimore Licensed MIT, see the license text below or even Copyright (c) 207X Jonathan Fenimore SPDX-License-Identifier: MIT should be enough, but IANAL too. --- In longer licenses like GPL or Apache, you are not supposed to change any copyright statement placeholders. For example, there’s this line in the GPL text: Copyright (C) <year> <name of author> But it’s a part of the “How to Apply These Terms to Your New Programs” section. You are supposed to copy it into your code and fill it out there instead. --- Or they could just compress the license amalgamation! I think it would be a bit bigger but pretty reasonable, and their lawyers should be happy with this arrangement.
- gpm 1y ago
  Are you sure it doesn't*? * When we treat different versions of say, the MIT license, with different names and copyright years inserted, as different licenses. I have to imagine the file would compress extremely well though... I'm more curious why they don't use compression.
  - toast0 1y ago
    Not sure why Apple doesn't offer a compressed filesystem :p it makes writes a bit slower when compression fails, but otherwise the savings in I/O time often makes up for the increased processing on read and write.
- s20n 1y ago
  That's how it is done in debian packages. The full text of each license is only mentioned once and given an identifier which is then used to link the license to the relevant copyright statements. For example: https://salsa.debian.org/debian/highlight/-/blob/94ee655915518d22669ad8341b212b0653c3b563/debian/copyright https://salsa.debian.org/debian/highlight/-/blob/94ee6559155...
- sneak 1y ago
  I imagine it does precisely that when gzipped for distribution.
hmartin 1y ago
Title of this post is blatantly misleading for using the singular 'license'.
JdeBP 1y ago
This is BSD Licence Hell, and for about 10 years I've being doing what miniscule part I can do to ameliorate it. Debian people are trying to do their parts, too. * https://debian.org/doc/packaging-manuals/copyright-format/1.0/ https://debian.org/doc/packaging-manuals/copyright-format/1....

neuroelectron 1y ago

I can't really understand the point of using Slack. There's so many free alternatives.

guerrilla 1y ago
Someone also explain to me how gamers of all people can live with Discord when the thing barely works.
- greenavocado 1y ago
  Wait until you find out both Ukrainian and Russian military were using Discord to communicate
  - superb_dev 1y ago
    Wait until you find out that the interim prime minister of Nepal was elected on Discord
- jbaber 1y ago
  When I installed matrix, I thought it was an example of FOSS UI being crummy. Then I found out they were actually doing a good job of emulating discord.
  - dade_ 1y ago
    Except that Matrix is a protocol.
  - sealeck 1y ago
    Discord is much, much more user friendly than Matrix!
- bigstrat2003 1y ago
  Because it actually works pretty well most of the time. I'm not sure where you get "barely works" from, but that's not remotely my experience or the experience of anyone I know. And of course, network effects are strong so that keeps people using it even through the occasional hiccups. As for how it got its foothold, it comes down to having an easier onboarding than the solutions it competed with. With Mumble (or Ventrilo, etc) someone has to pay for a server. Then you have to download the client, get the host and port to connect to, enter credentials, and so on. Repeat for every server you might join. With Discord, once your account is set up you just click on a link and join the server. You don't even have to use the client if you don't want; you can join from the browser just fine. I don't think the friction of using previous solutions was actually bad, but it was enough to give Discord an edge even without the integrated chat+voice angle (which is something that those other programs never did and still don't do).

wilg 1y ago

This is simply downstream of open source working as intended. It's also not a problem, and also there's no good solution.

leakycap 1y ago
> It's also not a problem, and also there's no good solution. I have worked with people who have this attitude and I wonder how they're doing these days. I hope they haven't ran into any problems they cannot simply dismiss as not problems that don't have solutions.
- wilg 1y ago
  I didn't claim that there are no problems, just that this isn't one?
  - leakycap 1y ago
    I'm not sure why you asked a question here.
    - wilg 1y ago
      This is a common pattern in communication. https://www.thoughtco.com/what-is-a-declarative-question-1690372 https://www.thoughtco.com/what-is-a-declarative-question-169...
      - leakycap 1y ago
        Communication involves getting your point across, and it's usually best if you don't have to google a link to explain your own comment.
        wilg 1y ago
        I don't think you're having a good faith discussion, and I think you weren't confused.

GuestFAUniverse 1y ago

My first computer had a 10MB HDD. * I could program with it comfortably (e.g. Turbo Pascal). * I could play with it (Civ, Day of the Tentacle with a few tricks, ...) * I could run a office suite. * I could communicate via mail and newsgroups In short: all problems back than could be solved at home. And yeah, I know that barely anybody cares _how utterly_ wasteful software has become.

theideaofcoffee 1y ago
But think of the dEvElopEr exPeRienCe! They may have to slow down on the rate they are shitting things out to actually learn a native system/UI toolkit, or, gasp, write it a few different times for different environments! Thats gonna affect some bonuses for sure.

JED3 1y ago

honestly the slack app store and it’s ridiculous policies makes publishing apps completely unworthy of the time investment. after having published numerous apps across dozens of marketplaces, I would advise everyone to avoid apps.slack.com at all costs. slack is beyond the maximum bloat threshold in virtually every aspect imaginable, TOS and licensing most especially. build elsewhere

hliyan 1y ago

We need to return to a world where we primarily own things, not rent them. If the software executable can be thought of as a machine, we should be able to own the version/instance of it we purchased the license for. We may not own the intellectual property, but we should have enough ownership to install it on a personal cloud computer we own and run it until such time we need to upgrade it.

kristianc 1y ago
Buy Campfire instead? https://once.com/campfire https://once.com/campfire
- piskov 1y ago
  It’s free and under MIT (though no too long ago this wasn’t the case)
  - kristianc 1y ago
    Yeah, I see you're right. I had in my head it was around a $200 fee?
    - tossit444 1y ago
      299USD. It became free merely two weeks ago. https://nitter.net/dhh/status/1963675999012552970 https://nitter.net/dhh/status/1963675999012552970
    - powvans 1y ago
      You aren’t wrong. Up until a couple of weeks ago it was $299. Once. Forever. That was the whole idea. Very cool that they open sourced it. MIT license too. https://x.com/dhh/status/1963675999012552970 https://x.com/dhh/status/1963675999012552970 https://github.com/basecamp/once-campfire https://github.com/basecamp/once-campfire
- shomp 1y ago
  Campfire needs 64GB RAM for 10,000 users, that surprises me, I would think we could get to 10k users with far less RAM.

Flatterer3544 1y ago

An alternative to look into, https://element.io/ https://element.io/ using Matrix, especially if encryption is preferred.