7 ms·

Sending legal threats to individual contributors to open source projects is extremely poor form, and reflects badly on both the company that sent them, and the

Sending legal threats to individual contributors to open source projects is extremely poor form, and reflects badly on both the company that sent them, and the lawyers or law firms who helped them do so. From the perspective of the open-source software development community, this will be perceived as both an attack and a breach of ethics, and the reputation cost is likely to affect WhatsApp's ability to hire and retain developers in the future. Just saying.

strommen 11y ago
This raises an interesting theoretical question: If you develop a web service and make it accessible from the public internet, what restrictions should you be allowed to place on its usage? And what should the consequences be for individuals trying to bypass those restrictions?
- toomuchtodo 11y ago
  > If you develop a web service and make it accessible from the public internet, what restrictions should you be allowed to place on its usage? Whatever you want. Public API access =! protected right. > And what should the consequences be for individuals trying to bypass those restrictions? Denial of future access by technical means.
  - teacup50 11y ago
    I agree if you mean "whatever [technical] restrictions you want". However, providing the tools that allow instituting legal restrictions is a big can of worms; property rights just don't apply cleanly to client/server communications.
    - toomuchtodo 11y ago
      I agree that legal restrictions carry little to no weight in the technical world (I'm not arguing if they should or not, just if the do). The solution is to require API accounts, which you can then monitor and terminate with prejudice. Tie the account to something unique-ish, or difficult to constantly cycle (SMS? check provider, deny if Google Voice, Twilio, has to be a physical carrier if we're talking messaging client). The law may eventually catch up to tech. Maybe.
    - fleitz 11y ago
      They don't apply cleanly to real property either which is why people who own property have 'people with guns' (gov't technical solution) to resolve any disputes about who's property it is. Similarly when someone uses a server in a way you don't like you send 'people with guns' to resolve any disputes, because in this case lawyers are believed to be cheaper than changing the server. This isn't about the ideals of law and power, it's about getting people to stop doing things you don't like, apparently WhatsApp chose a reasonably effective strategy.
    - s73v3r 11y ago
      In this case they do. When you access my API, you're accessing my server, my property. If I have decided that I do not want you accessing that, it's no different than if I have decided I do not want you on my land. Not everything is special simply because it's digital.
      - teacup50 11y ago
        In a hypothetical world in which SaaS has taken over the market, and 3rd-party clients are forbidden by virtue of license agreements, interoperability becomes impossible. Imagine if Windows Server had been SaaS; Samba would never exist, Mac OS X and Linux couldn't operate in a Windows environment. Where property law falls down is when we consider what it is you're selling -- access to a service, or a fully controlled end-to-end service agreement where you assert control over both the client and server. If it's the latter, does this create a healthy market, or does it create something that could never exist before: the ability to create a "natural monopoly" on an individual customer level. That is, once people are invested in your platform, the cost to compete for that person is so high that it creates a nearly unassailable barrier to entry? Pre-SaaS, if someone wanted to compete with Microsoft Office, they could invest the effort supporting the Office file format to ease customer transition. Post-SaaS, if Google Docs, Office 365, et al disallow data/API access to third-party clients, supporting your competitors' existing customers becomes impossible.
      - ams6110 11y ago
        It depends on why you've decided. If it's by some predetermined rule that applies the same to everybody, it's probably OK. If it's something like "I didn't like that comment supporting same sex marriage you posted on my blog" maybe not. At what point are APIs considered public accommodations?
      - Jayschwa 11y ago
        If you don't want someone using your API, then return 403 Forbidden. It's more efficient than strongly-worded letters.
      - tacticus 11y ago
        So if i have a library that implements your API should that also be illegal?
- angersock 11y ago
  Though I doubt it'll be a popular opinion, you should only place whatever restrictions you can technically enforce. Anything else basically ends up a) not working and b) requiring government intervention of one sort or another, eventually, and that harms everyone.
  - immibis 11y ago
    In the non-digital world, you can't enforce that people won't murder each other... should murder not be restricted?
    - angersock 11y ago
      This is an absurd comparison.
panarky 11y ago
> the reputation cost is likely to affect WhatsApp's ability to hire and retain developers in the future Have Oracle's attacks on open source software [1] affected their ability to hire and retain talent? Is there any example where bad behavior by a large organization [2, 3] meaningfully affected its ability to buy the talent it needs? [1] http://www.wired.com/2010/08/oracle-attacks-opensource/ http://www.wired.com/2010/08/oracle-attacks-opensource/ [2] https://www.nsa.gov/careers/FAQs/index.shtml#isNSA_5 https://www.nsa.gov/careers/FAQs/index.shtml#isNSA_5 [3] http://en.wikipedia.org/wiki/Smartphone_patent_wars http://en.wikipedia.org/wiki/Smartphone_patent_wars
- rando3826 11y ago
  The answer to both questions is yes. The talent pool and cost of developer talent is significantly impacted by a company's reputation, including it's activities in the free/open source arena. Also, your question include a false presumption in "buy the talent it needs", every software company seeks to optimize talent/cost, it doesn't simply have a binary "needed quota filled." Perhaps it doesn't affect it enough yet for them to rationally stop their nasty behaviour, and that is a better question.
- hippich 11y ago
  Speaking of Oracle - I bet they have no problem to hire people. But reputation affects what kind of developers you get. I believe this might affect company's destiny.
- awkward 11y ago
  For one, Microsoft. And would you argue that the NSA has seen no meaningful reduction in access to talent?
  - brandmeyer 11y ago
    How can you make a meaningful argument either way without access to NSA's actual hiring data?
    - CodeWriter23 11y ago
dsparry 11y ago
I agree. Instead of sending demand letters directly to the open-source developers, wouldn't it be more efficient (and more compliant with the DMCA) to send the demand letter to Github? If the developers are truly at fault, they will have breached the Github terms of service and Github will have a cause of action against the developers.
s73v3r 11y ago
I think most people realize that this is not an attack on any kind of open source community or a breach of ethics. Further, the unethical ones are those that worked on the project, knowing that it was not their api. Just saying.
- nine_k 11y ago
  While legally the senders of the C&D letters are right, doing that might be an unwise move. Curbing your developer community in a hostile way may be a mistake in a longer term. In a longer term, open solutions prevail. OTOH it might be not the moment yet for WhatsApp. Compare the stance of Microsoft in 2005 and 2015.

strommen 11y ago

This raises an interesting theoretical question: If you develop a web service and make it accessible from the public internet, what restrictions should you be allowed to place on its usage? And what should the consequences be for individuals trying to bypass those restrictions?

toomuchtodo 11y ago
> If you develop a web service and make it accessible from the public internet, what restrictions should you be allowed to place on its usage? Whatever you want. Public API access =! protected right. > And what should the consequences be for individuals trying to bypass those restrictions? Denial of future access by technical means.
- teacup50 11y ago
  I agree if you mean "whatever [technical] restrictions you want". However, providing the tools that allow instituting legal restrictions is a big can of worms; property rights just don't apply cleanly to client/server communications.
  - toomuchtodo 11y ago
    I agree that legal restrictions carry little to no weight in the technical world (I'm not arguing if they should or not, just if the do). The solution is to require API accounts, which you can then monitor and terminate with prejudice. Tie the account to something unique-ish, or difficult to constantly cycle (SMS? check provider, deny if Google Voice, Twilio, has to be a physical carrier if we're talking messaging client). The law may eventually catch up to tech. Maybe.
  - fleitz 11y ago
    They don't apply cleanly to real property either which is why people who own property have 'people with guns' (gov't technical solution) to resolve any disputes about who's property it is. Similarly when someone uses a server in a way you don't like you send 'people with guns' to resolve any disputes, because in this case lawyers are believed to be cheaper than changing the server. This isn't about the ideals of law and power, it's about getting people to stop doing things you don't like, apparently WhatsApp chose a reasonably effective strategy.
  - s73v3r 11y ago
    In this case they do. When you access my API, you're accessing my server, my property. If I have decided that I do not want you accessing that, it's no different than if I have decided I do not want you on my land. Not everything is special simply because it's digital.
    - teacup50 11y ago
      In a hypothetical world in which SaaS has taken over the market, and 3rd-party clients are forbidden by virtue of license agreements, interoperability becomes impossible. Imagine if Windows Server had been SaaS; Samba would never exist, Mac OS X and Linux couldn't operate in a Windows environment. Where property law falls down is when we consider what it is you're selling -- access to a service, or a fully controlled end-to-end service agreement where you assert control over both the client and server. If it's the latter, does this create a healthy market, or does it create something that could never exist before: the ability to create a "natural monopoly" on an individual customer level. That is, once people are invested in your platform, the cost to compete for that person is so high that it creates a nearly unassailable barrier to entry? Pre-SaaS, if someone wanted to compete with Microsoft Office, they could invest the effort supporting the Office file format to ease customer transition. Post-SaaS, if Google Docs, Office 365, et al disallow data/API access to third-party clients, supporting your competitors' existing customers becomes impossible.
    - ams6110 11y ago
      It depends on why you've decided. If it's by some predetermined rule that applies the same to everybody, it's probably OK. If it's something like "I didn't like that comment supporting same sex marriage you posted on my blog" maybe not. At what point are APIs considered public accommodations?
    - Jayschwa 11y ago
      If you don't want someone using your API, then return 403 Forbidden. It's more efficient than strongly-worded letters.
    - tacticus 11y ago
      So if i have a library that implements your API should that also be illegal?
angersock 11y ago
Though I doubt it'll be a popular opinion, you should only place whatever restrictions you can technically enforce. Anything else basically ends up a) not working and b) requiring government intervention of one sort or another, eventually, and that harms everyone.
- immibis 11y ago
  In the non-digital world, you can't enforce that people won't murder each other... should murder not be restricted?
  - angersock 11y ago
    This is an absurd comparison.

panarky 11y ago

> the reputation cost is likely to affect WhatsApp's ability to hire and retain developers in the future Have Oracle's attacks on open source software [1] affected their ability to hire and retain talent? Is there any example where bad behavior by a large organization [2, 3] meaningfully affected its ability to buy the talent it needs? [1] http://www.wired.com/2010/08/oracle-attacks-opensource/ http://www.wired.com/2010/08/oracle-attacks-opensource/ [2] https://www.nsa.gov/careers/FAQs/index.shtml#isNSA_5 https://www.nsa.gov/careers/FAQs/index.shtml#isNSA_5 [3] http://en.wikipedia.org/wiki/Smartphone_patent_wars http://en.wikipedia.org/wiki/Smartphone_patent_wars

rando3826 11y ago
The answer to both questions is yes. The talent pool and cost of developer talent is significantly impacted by a company's reputation, including it's activities in the free/open source arena. Also, your question include a false presumption in "buy the talent it needs", every software company seeks to optimize talent/cost, it doesn't simply have a binary "needed quota filled." Perhaps it doesn't affect it enough yet for them to rationally stop their nasty behaviour, and that is a better question.
hippich 11y ago
Speaking of Oracle - I bet they have no problem to hire people. But reputation affects what kind of developers you get. I believe this might affect company's destiny.
awkward 11y ago
For one, Microsoft. And would you argue that the NSA has seen no meaningful reduction in access to talent?
- brandmeyer 11y ago
  How can you make a meaningful argument either way without access to NSA's actual hiring data?
  - CodeWriter23 11y ago

dsparry 11y ago

I agree. Instead of sending demand letters directly to the open-source developers, wouldn't it be more efficient (and more compliant with the DMCA) to send the demand letter to Github? If the developers are truly at fault, they will have breached the Github terms of service and Github will have a cause of action against the developers.

s73v3r 11y ago

I think most people realize that this is not an attack on any kind of open source community or a breach of ethics. Further, the unethical ones are those that worked on the project, knowing that it was not their api. Just saying.

nine_k 11y ago
While legally the senders of the C&D letters are right, doing that might be an unwise move. Curbing your developer community in a hostile way may be a mistake in a longer term. In a longer term, open solutions prevail. OTOH it might be not the moment yet for WhatsApp. Compare the stance of Microsoft in 2005 and 2015.