9 ms·

Licenses Over Data: A Case Study with Github v BitBucket

102 points by Maximal 13y ago

casca 13y ago
IANAL but this doesn't seem unreasonable. The exact clause is: End User hereby grants Atlassian a non-exclusive license to copy, distribute, perform, display, store, modify, and otherwise use End User Data in connection with operating the Hosted Services. For me, the key is "in connection with operating the Hosting Service". They will need to do things with your data as they move it between servers and storage and make it available to you. If you want it displayed publicly then you need to have given them a license to do so.
- chris_wot 13y ago
  Why do they need to modify the data? And why do they need to distribute it (assuming this is different from copying), and for that matter why do they need to use your source code?
  - toyg 13y ago
    Modify: things like the just-launched web editor will need to modify whatever data you originally uploaded. Distribute: git clone etc. Execute: scripts and so on, or even interpreting markup could be considered "using" a file in some contexts.
  - anu_gupta 13y ago
    > Why do they need to modify the data? Maybe they want to store it in a compressed form > distribute it Making the code available for you or your collaborators is distributing it. How else would they do this? Why not just email them with your concerns, if you actually really have some, and aren't just playing to the peanut gallery for karma.
    - chris_wot 13y ago
      Why not just email them with your concerns, if you actually really have some, and aren't just playing to the peanut gallery for karma. Ascribing motivations to my post is illogical, not to mention unfair. I have some genuine concerns, I posted them above. Luckily, my account is with GitHub, not with BitBucket. P.S. see my reply here: https://news.ycombinator.com/item?id=5888670 https://news.ycombinator.com/item?id=5888670
  - jasonlotito 13y ago
    Modify so they can change and update the code when you push revisions or use their web based editor. They need to distribute it so you or others you allow can clone it or view it online. They need to use your code so they can format .md files.
  - rmc 13y ago
    Modify & Distribute: If someone wants to download a zip file of your repository, then you have give BitBucket the permission to modify the content (to produce the zip file) and distribute it (to send it to someone who wants it). Use it: I'm not sure, maybe to do syntax highlighting, they need to use the source code with a syntax highlighting software.
    - goblin89 13y ago
      Does content modification in legal speak really have the same strict meaning as we tend to imply? I just checked Instagram's Terms for example, and they have no mention of modification—though they obviously do compress and resize submitted images. This makes me wonder if altering a sequence of bytes (for example, after conversion to a different format) is really a ‘modification’ if it still represents the same work.
  - mpchlets 13y ago
    Do you truly think that Github does not do the same? Any service needs to modify your data on the backend for the good of the service, including copying it to multiple servers for backups and ensuring uptime during a server failure. They do not need to distribute your code, i.e. making your repo public - this is part of their service and you grant them the right to do so when you make it public. Do they need to use your source code - well not explicitly as such, but they do modify it when displaying it back to you - look at any source code page, it is modified source code. This is all in the auspices of giving you a good service. Furthermore, any fork network modifies your repo - it is all one repository. So in essence, you are modifying people's repos without them knowing.
- pfortuny 13y ago
  Copy: obviously, I want them to store my data and move them from HD to HD. Distribute: This is what a distributed version control system is for. Perform: Yes, please, format my .md files as specified. Display: show me my code please. Store: already covered. Modify: this is dubious but if I upload a change, they need to modify it. So I want to give them those rights if I want the service to work as desired, otherwise, it would not be bitbucket.
  - Ziomislaw 13y ago
    modify may apply to editing files throght the browser
- mpyne 13y ago
  Also, they're give me a private repo for free if I ask for it, which is something GitHub doesn't offer, so a slight difference in ToS I would not find at all surprising. And this just sounds like a different legal template to me and not much more, they list specific things they need to do and then lump in the general "stuff we have to do with your stuff to make hosting work" clause, which is perfectly fine to me.
- crusso 13y ago
  Yes, this article is absolutely horrible by coming to the opposite of the correct conclusion. How could an attorney parsing the documents not notice the "in connection with operating the Hosting Service" stipulation? Further, Bitbucket and Github are opposite in terms of the freedom you have to control your FREE repositories. Github forces your free repositories to be open to the public. Bitbucket allows you to keep some free repositories private.
  - pjbrow 13y ago
    The wording "in connection with" is specifically considered in the article. Also, here is the definition for "Hosted Services" (it's extremely broad): 1.2 What's Included in "Hosted Services". "Hosted Services" include any Atlassian online services products that End User orders, which can include "OnDemand" versions of many Atlassian Software products, the Bitbucket hosting service ("Bitbucket"), and other online services provided by Atlassian. "Hosted Services" always means the version of the Hosted Services as described in Atlassian's then-current product descriptions. End User's detailed rights to use Hosted Services are in Section 3 below.
    - mcintyre1994 13y ago
      Atlassian provide a lot of services which can be used in conjunction with one another. They probably use similar wording across their suite so that they are able to allow interaction between products etc. I'm not sure where you got that quote from, but it's used exactly here: http://www.atlassian.com/end-user-agreement/ http://www.atlassian.com/end-user-agreement/ So yes, it's used across their suite, and doesn't seem overly broad in that case.
  - vacri 13y ago
    "In order to keep our prices low, we sold the contents of some private repositories" counts as 'in connection with operating the Hosting Service'. The author's problem is that the wording isn't particularly specific and can be used in a number of ways.
- rbehrends 13y ago
  More importantly, Atlassian is further constrained by the confidentiality clause (section 8) of its End User Agreement [1]. [1] http://www.atlassian.com/end-user-agreement/ http://www.atlassian.com/end-user-agreement/
- h4rrison 13y ago
  You can't deny that the wording is far more convoluted and vague, despite the precise legal implications.
magoon 13y ago
A service does need the right to store, process and display your data, and if their service makes use of third-parties then they need to assert the right to work with third parties. That said, it would be comforting if Atlassian clarified this to make it clear they have zero claims on anybody's IP.
paul_f 13y ago
Why does any service need to assertively state they don't own your IP? They don't own your IP. And can't claim it. Whether they mention it or not doesn't change that fact.
- chris_wot 13y ago
  But they do seem to say they have many rights to your code. Rights they shouldn't have.
  - jasonlotito 13y ago
    Rights they need to have if they want to host your code. You asked in another comment why they needed certain rights, and now I see you commenting here as if you know what you are talking about. You are admit you are ignorant of the needs, but you go around commenting as if you have a clue. Github needs the same rights as bitbucket to do what it does.
    - chris_wot 13y ago
      Sir, your ad hominem argument is a fallacy that proves nothing, and impresses no one. If you want to give me an actual reason, rather than making your argument about my person, feel free. You have only asserted that they need the rights, but you fail to say why. Please feel free to chime in with facts and reasoning at some point, I am interested in what you have to say. You are admit you are ignorant of the needs, but you go around commenting as if you have a clue. You'll notice I said "seems". That's an English word with connotations of uncertainty and doubt, do try to look it up in a dictionary some time.
      - mcintyre1994 13y ago
        https://news.ycombinator.com/item?id=5888471 https://news.ycombinator.com/item?id=5888471 Have you read this reply to your previous post yet? I think that's what was being referred to, and it clearly answers the issue bought up there and again here.
mnutt 13y ago
I'd be surprised if Atlassian inserted that phrase out of malice. I've been told by lawyers more than once that "it's necessary to prevent someone from suing you for doing exactly what they asked you to do". (display content they uploaded) The lawyers also use it for covering all their bases. By uploading, do you automatically give them the right to feature your repo on their homepage? Or is that advertising?
brudgers 13y ago
"courts have ruled that “in connection with” covers indirect connection as well as direct connection." Which courts? The question matters because while Github is located in San Francisco, Atlassian is an Australian company.
btipling 13y ago
> End User hereby grants Atlassian a non-exclusive license The title of this post needs to be changed to reflect the title of the post. Right now it's disingenuous link bait.
mpchlets 13y ago
At Assembla, a project management tool that incorporates a repository service like github or bitbucket, we have a similar TOS as github: "1. Assembla claims no copyright or other ownership rights in the Content you upload to the Service. 2. By uploading or otherwise providing Content to Assembla.com, You grant to Assembla a non-exclusive, royalty-free, paid-up right and license to use, reproduce, display and distribute such Content on Assembla.com in connection Assembla's provision of the Services to such persons as you may authorize. 3. You hereby represent and warrant that you have all intellectual property and other rights necessary concerning any Content posted by You on Assembla.com." https://www.assembla.com/terms_of_service https://www.assembla.com/terms_of_service We do not want your data for our personal or corporate uses, we only want to display/reproduce/use your data with your expressed permission, i.e. you make your data public - the same as github. The theory we have at Assembla is that the data is yours, always yours. We will never keep your data from you and we will never claim ownership over it. We explicitly state that we do not own your IP because in today's world so many services are taking ownership over what you create. We feel it important to tell you right out that we do not claim ownership because if we do not, you will not know our stance. Our stance is that we want you to feel comfortable using our service for both private and public projects for your data. We want you to be successful with a nice tool, we do not want to own your data.
- Uchikoma 13y ago
  You got me confused, your "You grant to Assembla a non-exclusive, royalty-free, paid-up right and license to use, reproduce, display and distribute such Content on Assembla.com in connection Assembla's provision of the Services to such persons as you may authorize" sounds much more like Atlassian, "End User hereby grants Atlassian a non-exclusive license to copy, distribute, perform, display, store, modify, and otherwise use End User Data in connection with operating the Hosted Services." not at all like the Github TOS.
  - mpchlets 13y ago
    I think you are misunderstanding the wording: "as you may authorize" - that bit is about you making it public, and only about you making it public - nothing else. You authorize it to be made public, github says the same as "By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories" github is just not using lawyer speak, which is definitely cooler.
davidjgraph 13y ago
In my experience, the vast majority of developers completely ignore/misunderstand licensing most/all of the time. The common excuse is that the intent by publishing source code online is that you clearly are allowing everybody to use it freely as they wish. I have no doubt the licenses on Bitbucket are not followed correctly more often than not. Atlassian, if you've followed them, have always been a very transparent, developer-centric company, the behaviour of neither the founders, nor the company has ever suggested they are in the slightest bit interested in being arseholes in the manner being suggested here. Yet somehow there's a switch from 'intent' to being licensing experts when it suits.
- jey 13y ago
  The problem is that control of the company could be transferred to other actors, in which case the original founders' "intent" becomes irrelevant. So the best thing to do is to encode the intended terms explicitly in the contract.
  - davidjgraph 13y ago
    In most cases there's some clause saying "we can pretty much do anything to these terms, as long as we give you 30 days notice". They can be as explicit as they like, the next company can just change them. It's not that I disagree with you, I'm just calling out what I view as "selective license goggles", which I find particularly ironic given the nature of the service in question.
ernesth 13y ago
From github's Terms of service : "You understand that the technical processing and transmission of the Service, including your Content, may be transfered unencrypted and involve (a) transmissions over various networks; and (b) changes to conform and adapt to technical requirements of connecting networks or devices." In other words, the end user grants github a license to copy, distribute, store, modify End User Data (without encryption even if the user marked this data private).
wes-exp 13y ago
It's github's TOS that seems flawed to me, not Atlassian's. Maybe some jerk-off will sue Github because it's making "copies" of copyrighted coded without a license. I am more worried about that outcome than Atlassian going tyrannical.
dakimov 13y ago
C'mon, Atlassian is not evil, they just want to avoid being sued. I think that end-user agreements must be prohibited altogether, because it is a mean of discrimination. Either you provide a public service and then your relationships with users are guided by the state law, or you sign an exclusive contract out of public service. The main obstacle to that is the retarded US law system.

102 points by Maximal 13y ago

casca 13y ago

IANAL but this doesn't seem unreasonable. The exact clause is: End User hereby grants Atlassian a non-exclusive license to copy, distribute, perform, display, store, modify, and otherwise use End User Data in connection with operating the Hosted Services. For me, the key is "in connection with operating the Hosting Service". They will need to do things with your data as they move it between servers and storage and make it available to you. If you want it displayed publicly then you need to have given them a license to do so.

chris_wot 13y ago
Why do they need to modify the data? And why do they need to distribute it (assuming this is different from copying), and for that matter why do they need to use your source code?
- toyg 13y ago
  Modify: things like the just-launched web editor will need to modify whatever data you originally uploaded. Distribute: git clone etc. Execute: scripts and so on, or even interpreting markup could be considered "using" a file in some contexts.
- anu_gupta 13y ago
  > Why do they need to modify the data? Maybe they want to store it in a compressed form > distribute it Making the code available for you or your collaborators is distributing it. How else would they do this? Why not just email them with your concerns, if you actually really have some, and aren't just playing to the peanut gallery for karma.
  - chris_wot 13y ago
    Why not just email them with your concerns, if you actually really have some, and aren't just playing to the peanut gallery for karma. Ascribing motivations to my post is illogical, not to mention unfair. I have some genuine concerns, I posted them above. Luckily, my account is with GitHub, not with BitBucket. P.S. see my reply here: https://news.ycombinator.com/item?id=5888670 https://news.ycombinator.com/item?id=5888670
- jasonlotito 13y ago
  Modify so they can change and update the code when you push revisions or use their web based editor. They need to distribute it so you or others you allow can clone it or view it online. They need to use your code so they can format .md files.
- rmc 13y ago
  Modify & Distribute: If someone wants to download a zip file of your repository, then you have give BitBucket the permission to modify the content (to produce the zip file) and distribute it (to send it to someone who wants it). Use it: I'm not sure, maybe to do syntax highlighting, they need to use the source code with a syntax highlighting software.
  - goblin89 13y ago
    Does content modification in legal speak really have the same strict meaning as we tend to imply? I just checked Instagram's Terms for example, and they have no mention of modification—though they obviously do compress and resize submitted images. This makes me wonder if altering a sequence of bytes (for example, after conversion to a different format) is really a ‘modification’ if it still represents the same work.
- mpchlets 13y ago
  Do you truly think that Github does not do the same? Any service needs to modify your data on the backend for the good of the service, including copying it to multiple servers for backups and ensuring uptime during a server failure. They do not need to distribute your code, i.e. making your repo public - this is part of their service and you grant them the right to do so when you make it public. Do they need to use your source code - well not explicitly as such, but they do modify it when displaying it back to you - look at any source code page, it is modified source code. This is all in the auspices of giving you a good service. Furthermore, any fork network modifies your repo - it is all one repository. So in essence, you are modifying people's repos without them knowing.
pfortuny 13y ago
Copy: obviously, I want them to store my data and move them from HD to HD. Distribute: This is what a distributed version control system is for. Perform: Yes, please, format my .md files as specified. Display: show me my code please. Store: already covered. Modify: this is dubious but if I upload a change, they need to modify it. So I want to give them those rights if I want the service to work as desired, otherwise, it would not be bitbucket.
- Ziomislaw 13y ago
  modify may apply to editing files throght the browser
mpyne 13y ago
Also, they're give me a private repo for free if I ask for it, which is something GitHub doesn't offer, so a slight difference in ToS I would not find at all surprising. And this just sounds like a different legal template to me and not much more, they list specific things they need to do and then lump in the general "stuff we have to do with your stuff to make hosting work" clause, which is perfectly fine to me.
crusso 13y ago
Yes, this article is absolutely horrible by coming to the opposite of the correct conclusion. How could an attorney parsing the documents not notice the "in connection with operating the Hosting Service" stipulation? Further, Bitbucket and Github are opposite in terms of the freedom you have to control your FREE repositories. Github forces your free repositories to be open to the public. Bitbucket allows you to keep some free repositories private.
- pjbrow 13y ago
  The wording "in connection with" is specifically considered in the article. Also, here is the definition for "Hosted Services" (it's extremely broad): 1.2 What's Included in "Hosted Services". "Hosted Services" include any Atlassian online services products that End User orders, which can include "OnDemand" versions of many Atlassian Software products, the Bitbucket hosting service ("Bitbucket"), and other online services provided by Atlassian. "Hosted Services" always means the version of the Hosted Services as described in Atlassian's then-current product descriptions. End User's detailed rights to use Hosted Services are in Section 3 below.
  - mcintyre1994 13y ago
    Atlassian provide a lot of services which can be used in conjunction with one another. They probably use similar wording across their suite so that they are able to allow interaction between products etc. I'm not sure where you got that quote from, but it's used exactly here: http://www.atlassian.com/end-user-agreement/ http://www.atlassian.com/end-user-agreement/ So yes, it's used across their suite, and doesn't seem overly broad in that case.
- vacri 13y ago
  "In order to keep our prices low, we sold the contents of some private repositories" counts as 'in connection with operating the Hosting Service'. The author's problem is that the wording isn't particularly specific and can be used in a number of ways.
rbehrends 13y ago
More importantly, Atlassian is further constrained by the confidentiality clause (section 8) of its End User Agreement [1]. [1] http://www.atlassian.com/end-user-agreement/ http://www.atlassian.com/end-user-agreement/
h4rrison 13y ago
You can't deny that the wording is far more convoluted and vague, despite the precise legal implications.

magoon 13y ago

A service does need the right to store, process and display your data, and if their service makes use of third-parties then they need to assert the right to work with third parties. That said, it would be comforting if Atlassian clarified this to make it clear they have zero claims on anybody's IP.

paul_f 13y ago

Why does any service need to assertively state they don't own your IP? They don't own your IP. And can't claim it. Whether they mention it or not doesn't change that fact.

chris_wot 13y ago
But they do seem to say they have many rights to your code. Rights they shouldn't have.
- jasonlotito 13y ago
  Rights they need to have if they want to host your code. You asked in another comment why they needed certain rights, and now I see you commenting here as if you know what you are talking about. You are admit you are ignorant of the needs, but you go around commenting as if you have a clue. Github needs the same rights as bitbucket to do what it does.
  - chris_wot 13y ago
    Sir, your ad hominem argument is a fallacy that proves nothing, and impresses no one. If you want to give me an actual reason, rather than making your argument about my person, feel free. You have only asserted that they need the rights, but you fail to say why. Please feel free to chime in with facts and reasoning at some point, I am interested in what you have to say. You are admit you are ignorant of the needs, but you go around commenting as if you have a clue. You'll notice I said "seems". That's an English word with connotations of uncertainty and doubt, do try to look it up in a dictionary some time.
    - mcintyre1994 13y ago
      https://news.ycombinator.com/item?id=5888471 https://news.ycombinator.com/item?id=5888471 Have you read this reply to your previous post yet? I think that's what was being referred to, and it clearly answers the issue bought up there and again here.

mnutt 13y ago

I'd be surprised if Atlassian inserted that phrase out of malice. I've been told by lawyers more than once that "it's necessary to prevent someone from suing you for doing exactly what they asked you to do". (display content they uploaded) The lawyers also use it for covering all their bases. By uploading, do you automatically give them the right to feature your repo on their homepage? Or is that advertising?

brudgers 13y ago

"courts have ruled that “in connection with” covers indirect connection as well as direct connection." Which courts? The question matters because while Github is located in San Francisco, Atlassian is an Australian company.

btipling 13y ago

> End User hereby grants Atlassian a non-exclusive license The title of this post needs to be changed to reflect the title of the post. Right now it's disingenuous link bait.

mpchlets 13y ago

At Assembla, a project management tool that incorporates a repository service like github or bitbucket, we have a similar TOS as github: "1. Assembla claims no copyright or other ownership rights in the Content you upload to the Service. 2. By uploading or otherwise providing Content to Assembla.com, You grant to Assembla a non-exclusive, royalty-free, paid-up right and license to use, reproduce, display and distribute such Content on Assembla.com in connection Assembla's provision of the Services to such persons as you may authorize. 3. You hereby represent and warrant that you have all intellectual property and other rights necessary concerning any Content posted by You on Assembla.com." https://www.assembla.com/terms_of_service https://www.assembla.com/terms_of_service We do not want your data for our personal or corporate uses, we only want to display/reproduce/use your data with your expressed permission, i.e. you make your data public - the same as github. The theory we have at Assembla is that the data is yours, always yours. We will never keep your data from you and we will never claim ownership over it. We explicitly state that we do not own your IP because in today's world so many services are taking ownership over what you create. We feel it important to tell you right out that we do not claim ownership because if we do not, you will not know our stance. Our stance is that we want you to feel comfortable using our service for both private and public projects for your data. We want you to be successful with a nice tool, we do not want to own your data.

Uchikoma 13y ago
You got me confused, your "You grant to Assembla a non-exclusive, royalty-free, paid-up right and license to use, reproduce, display and distribute such Content on Assembla.com in connection Assembla's provision of the Services to such persons as you may authorize" sounds much more like Atlassian, "End User hereby grants Atlassian a non-exclusive license to copy, distribute, perform, display, store, modify, and otherwise use End User Data in connection with operating the Hosted Services." not at all like the Github TOS.
- mpchlets 13y ago
  I think you are misunderstanding the wording: "as you may authorize" - that bit is about you making it public, and only about you making it public - nothing else. You authorize it to be made public, github says the same as "By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories" github is just not using lawyer speak, which is definitely cooler.

davidjgraph 13y ago

In my experience, the vast majority of developers completely ignore/misunderstand licensing most/all of the time. The common excuse is that the intent by publishing source code online is that you clearly are allowing everybody to use it freely as they wish. I have no doubt the licenses on Bitbucket are not followed correctly more often than not. Atlassian, if you've followed them, have always been a very transparent, developer-centric company, the behaviour of neither the founders, nor the company has ever suggested they are in the slightest bit interested in being arseholes in the manner being suggested here. Yet somehow there's a switch from 'intent' to being licensing experts when it suits.

jey 13y ago
The problem is that control of the company could be transferred to other actors, in which case the original founders' "intent" becomes irrelevant. So the best thing to do is to encode the intended terms explicitly in the contract.
- davidjgraph 13y ago
  In most cases there's some clause saying "we can pretty much do anything to these terms, as long as we give you 30 days notice". They can be as explicit as they like, the next company can just change them. It's not that I disagree with you, I'm just calling out what I view as "selective license goggles", which I find particularly ironic given the nature of the service in question.

ernesth 13y ago

From github's Terms of service : "You understand that the technical processing and transmission of the Service, including your Content, may be transfered unencrypted and involve (a) transmissions over various networks; and (b) changes to conform and adapt to technical requirements of connecting networks or devices." In other words, the end user grants github a license to copy, distribute, store, modify End User Data (without encryption even if the user marked this data private).

wes-exp 13y ago

It's github's TOS that seems flawed to me, not Atlassian's. Maybe some jerk-off will sue Github because it's making "copies" of copyrighted coded without a license. I am more worried about that outcome than Atlassian going tyrannical.

dakimov 13y ago

C'mon, Atlassian is not evil, they just want to avoid being sued. I think that end-user agreements must be prohibited altogether, because it is a mean of discrimination. Either you provide a public service and then your relationships with users are guided by the state law, or you sign an exclusive contract out of public service. The main obstacle to that is the retarded US law system.