I Found Myself Accused of Stealing Code from WordPress | Hacker News Reader

I Found Myself Accused of Stealing Code from WordPress

medium.com

52 pointsmolloy43 comments

Correct me if I'm wrong but this post does nothing to explain why the license of Wix's library is MIT while based on prior art which was GPL, thus infringing on the GPL license, which is the whole point Matt is discussing about in his initial post.

I'm missing the context, since there's no link to or quote of the accusation. However, the author clearly admits that Wix did not comply with the license, with no excuse other than ignorance and indignation.

Googled it, here's context:

https://news.ycombinator.com/item?id=12824355

I'm not someone who'd know enough to be able to discuss this in detail. But in the linked post, Kal Tol mentions "The WordPress GPL Rich Text component in question, is actually a wrapper around another Rich Text component named ZSSRichTextEditor which is licensed MIT. In retrospect it would have been easier to use it directly."

So it appears that although Wordpress is using GPL, the component that Wordpress based their wrapper on is using a MIT license; so it would seem there is a flexibility in being able to use either the GPL or MIT license.

What I'm basically seeing based on Kol's article is:

1. MIT created ZSSRichTextEditor, and distributed it using MIT license. (see: https://github.com/nnhubbard/ZSSRichTextEditor/blob/master/L...)

2. Wordpress then created a wrapper for ZSSRichTextEditor, and subsequently had it covered by GPL instead of MIT. (see: https://github.com/wordpress-mobile/WordPress-Editor-iOS/blo...)

3. Kol then took that stuff, implemented React, and re-applied MIT license to it, which whether intentional or not, was what the original license was.

That being said, it's all open source and in the public domain. There's no theft here if it's was freely distributed. Kol even took it one step further (as he should), and gave proper credit where due -- not only within the project, but on social media.

MIT can be relicensed as GPL. GPL cannot be relicensed as MIT. If they wanted to use the wrapper, they should have released as GPL. I'd they didn't want to release as GPL they shouldn't have used GPL code. It is that simple.

Moral of the story: avoid GPL code, unless you really want to deal with headaches.

More like: Avoid GPLv2/3 code if you plan to keep your code proprietary and distribute binaries. Avoid GPL Affero if you want to keep your code proprietary and it can be reached over a network by clients. Use GPL if your code can also be GPLd or you aren't going to be distributing it/giving it network access to clients.

I don't think your point 3 is correct. Wix did not re-apply the MIT to WP's code. Wix only applied the MIT license to their own wrapper code and pointed people the the license of the "dependencies" in their readme.

That said, I am not sure if you license a wrapper code of a GPL library as MIT? My gut says yes as you don't need to distribute the GPL'd code with your code, but I'd be happy to be enlightened.

Of course you can, but that's pretty pointless. The moment someone tries to use the wrapper the wrapped GPL library must also be present, so then the whole thing becomes GPL.

The complaint isn't that the code in the repo isn't GPL, anyway. They released an app with GPLed code but have not released the source.

(There is one exception: if your wrapper just invokes a GPL program as you would on a shell, that's not considered a combined work. But anything else, static or dynamic linking, whatever, it pretty much immediately becomes GPL)

> Of course you can, but that's pretty pointless. The moment someone tries to use the wrapper the wrapped GPL library must also be present, so then the whole thing becomes GPL.

It may be pointless (I don't agree), but I wasn't writing about whether there was a point to it, but whether it could or could not be done.

> The complaint isn't that the code in the repo isn't GPL, anyway.

Where did I say that was what the complaint was? I was just responding to parents comment as I thought it was incorrect. If you read my first comment on this story it was to point this out.

The WordPress repos are tracked as git submodules, so Wix is not modifying or redistributing any GPL licensed content. It can be argued that they have no obligation to license their repo under the GPL.

See http://softwareengineering.stackexchange.com/a/260889 for a similar discussion.

They are redistributing the GPL content in their mobile app. So, it may be the case that there's nothing amiss with the code in their repository, but anyone who tries to use their code will run afoul of the GPL.

That's only half of the problem, as I understand it. Also unacknowledged was that by distributing an app that is comprised at least in part by GPL code, they are required to provide the source code for the app, not just any changes they made to the component itself. Granted, it seems like refusing to provide the source code when asked for it would be a violation of the license, as opposed to actively distributing it via GitHub.

At least that's my interpretation of GPL requirements.

> by distributing an app that is comprised at least in part by GPL code, they are required to provide the source code for the app

Well, almost. In order to have permission from an author to copy or distribute a GPL licensed work, I have only the GPL to look to as a source for such a permission. The GPL states that I have to choose one of a number of options; if I choose none of them, I can’t distribute, because copyright law states that only the authors have that right, unless they give permission. The available options are listed in section 3 of GPL 2. The first option is to simply always send the source code with every copy of the program; as in, include the source code in the app or binary sent to every user of the program. The second option is to include a “written offer” for source code to every recipient of the app or binary, so that anyone in possession of this offer can take me up on it and have me send them the source code upon request. Note that the person using the offer can be anyone, not just the original recipient of it. The third option is only available if I myself received such a written offer – I can then choose to simply forward this offer on to you instead of making my own. Note that this third option is also only available for non-commercial distribution.

If you got a GPL licensed program from me, and I did not choose any of the three above options, I have violated the GPL and consequently violated the copyright of the original author. You don't have to write me and ask for the source code and be refused in order to know this: If I’m distributing commercially, I can’t use the third option; if you didn’t either get the source code on the disk or in the downloaded archive or had it available on the site for download where you got your app or binary, then I didn’t choose the first option; if you can’t find a written offer from me anywhere, then I didn’t choose the second option.

Thanks! I haven't read every word of the GPL and hadn't heard about the written offer to provide source code bring a requirement.

What I wrote is valid for GPL 2, which was relevant here because that’s what Wordpress uses. GPL 3, however, offers five options, each written to be more generously worded to allow for more flexibility. One of the new options allows for me to say, essentially, “I didn’t modify the source from upstream, here’s a link to their source code download page; go there and download it yourself”. Some people do this already, but this isn’t actually permitted with GPL 2.

Wix's library appears to be a wrapper for Wordpress's GPL library. I am not a GPL expert, but I believe that Wix has the right to publish their wrapper code using any license they like. Publishing their code as MIT is not the same as them trying to change the license of someone elses code. Wix explicitly state it in their github repo:

> Code in this git repo is licensed MIT, please consider the licenses of the dependencies separately.

With a link to the Wordpress library.

Regardless, reading Matt's original post, I see that his complaint was not about relicensing at all. It was more to do with whether Wix's app is allowed to use Wordpress's GPL'd code, without attribution or providing the source to their entire application.

The whole thing (IMHO) boils down to whether you can use a GPL'd lib in a codebase without having to:

1. provide attribution

2. apply GPL your entire codebase

I believe 1 is not required. A quick google says 2 is not "ok". If you use a GPL lib in your application, you must open source your entire application (LGPL is the GPL license created to allow you to use a GPL lib without "infecting" your codebase with the GPL).

That said, I can understand someone misunderstanding the implications GPL and believing they don't have to open source their work that utilises a GPL library.

What I believe should have happened is that Matt from WP should have reached out Tai from Wix and quietly informed them of their obligations WRT using their GPL'd license, giving Wix the opportunity to correct what could have been an honest mistake.

Taking this public and accusing people of "stealing"[0], as a first step, is a selfish action will make people even more wary of using GPL'd code in their projects.

[0] I hate it when people abuse the word "stealing" WRT intellectual property rights, it smacks of either dishonesty or ignorance.

Mullenwegg sees Wix as a competitor, so he has no incentive to keep it on the quiet. If more people stay away from Wordpress code to build Wordpress competitors, that's a net win for him.

The GPL is extremely protective of the code it covers. This protection can be used positively ("hey man, if you use my code it's only fair that you share yours, wanna collaborate?") or negatively ("dude, you used that code in ways you are not supposed to - stop immediately and stay away from it if you don't understand how it works"). This is why it's a bloody good license, for people who understand it and are ready to enforce it.

> This is why it's a bloody good license, for people who understand it and are ready to enforce it.

One of the direct intentions of the GPL was to prevent freeloading (which the MIT license allows).

Oh, I understand what Mullenwegg/WP is doing, and where his incentives lie (hence my selfish comment). I also understand Wix/Kol are in the wrong and need to take corrective action. I just think (maybe incorrectly) that Mullenwegg's actions damage the perception of the GPL in the eyes of the developer community. But perhaps not, perhaps this is positive news and will get more people to produce GPL'd code as it does put more power into the hands of the author than MIT.

I think the React native whatever wrapper comes with the Wordpress code and builds with it. So its a combined work. The MIT license gives less rights than GPL. So they are not compatible.

As a result, this is a violation.

I'm sure if you can somehow separate the Wordpress and wrapper code you can license the wrapper code as MIT, but the moment it's used in an actual app it obviously has to come with the Wordpress code. At that point the whole becomes GPL.

Absolutely correct on all points. I do think it is worth clarifying your statement:

> The MIT license gives less rights than GPL

The MIT license gives less rights to end users than GPL. The GPL gives less rights to publishers than MIT.

> I hate it when people abuse the word "stealing" WRT intellectual property rights, it smacks of either dishonesty or ignorance.

What do you call it when someone disregards an author's rights?

Copyright makes it Matt's code, which he grants others the right to use, if they follow his provisions. If you're unwilling to follow those provisions, you have no right to use that code.

I call it "copyright infringement"

"Stealing" implies something is taken and by being taken the owner is deprived of that thing. "Jill had her bike stolen and now she has to walk to work".

"Copyright infringement" is missing that loss to the owner which is why it's not called "stealing"

Exactly. I believe copyright infringement is wrong, but it is not stealing. Words have meanings! If you use the word "stealing" in these discussions, you either want to push your case dishonestly by ratcheting up the stakes, or you have been hoodwinked by those dishonest people.

If Wix's library directly calls Wordpress code, that's a problem, WordPress isn't licensed under the LGPL which would allow for this. It's licensed under the GPL which would make his own code GPL'd. The reality though is that the GPL only applies to software you physically run yourself, unless WordPress becomes AGPL which would force Wix to share their code. Not sure how attribution applies to a service, but it would still be nice if they pushed that regardless. As for their work being GPL'd I agree, it doesn't mean you get access to it though. It's like asking Google for their Linux kernel code, there is no actual reason they have to give it to you unless the kernel is AGPL licensed. On the other hand, Apple using BSD licensed code never actually has to share any of it.

Well, Wix does appear to be in the wrong here. I believe the code in question is for a mobile application, which means that they are distributing GPL'd code without GPL'ing the entire application. This is a clear infringement of the GPL.

Wix needs to either:

1. Open source the application that uses the GPL code

2. Stop distributing their application until they can remove the GPL library

The crux of the disagreement is whether simply calling another library (as opposed to modifying its source code) makes your codebase a derivative work of that library.

The GPL FAQ seems to think the answer is yes [1]. However, other, more legally astute commentators strongly disagree [2][3].

In fact, the GPL FAQ seems to make some rather strange claims, like whether the fact that code is dynamically or statically linked legally determines whether a calling code becomes derivative work. This is an argument has never been tested in court.

IMO, the GPL FAQ basically takes a copyright maximalist position in order to interpret the license as broadly as possible. These are arguments that, in other contexts, most geeks would find completely unacceptable. It's worthwhile to note that the GPL FAQ has no validity as a legal document, only the license itself.

[1] https://www.gnu.org/licenses/gpl-faq.en.html#IfLibraryIsGPL

[2] http://www.rosenlaw.com/lj19.htm

[3] http://illinoisjltp.com/journal/wp-content/uploads/2013/10/G... p.124

Unless I am very mistaken, GPL and MIT proponents came to a compromise on this very issue, resulting in the LGPL. This exact scenario (linking/using a GPL library without modification) was considered valid by both sides to the point that they created a new license specifically for it.

Not exactly. There's two different issues here:

1. Whether the license makes derivative works fall under the same license (GPL does, LGPL doesn't)

2. Whether the work in question is in fact a derivative work (which is yet to be determined)

Even if it turns out that it is in fact a derivative work, using the library might constitute fair use.

I think it's dubious if any court is going to care about static/dynamic linking technical discussions, particularly since we're talking about an Android app with Java code, among other things.

The GPL license itself doesn't bother with such technical minutiae either. But it does concern itself with distributing GPL code and unrelated code as a "whole"; and undeniably the Wix Android app comes with the Wordpress GPL code.

So I don't think this is the particular case that you want to test the whole dynamic linking discussion on.

Blog post from WiX CEO http://www.wix.com/blog/2016/10/dear-matt-mullenweg-an-open-...

Wow, the ongoing ignorance here is really not doing them any favors. They really need to stop talking here if Mullenweg wants to escalate this into a legal claim.

This could be construed willful:

  Yes, we did use the WordPress open source library for a minor part of the application

This is all well and good but doesn't change the fact that the Wix app is violating the GPL. They need to fix it. I don't see any commitment from Wix or Tal Kol that this will happen.

Could someone please explain whether or how an iPhone app has PHP code from Wordpress included with it?

The Wordpress application also includes frontend code, including the HTML/Javascript library that is at issue in this dispute.

Oh great, thanks! If the app wasn't distributed with the html/css/js but downloaded from a server, would that skirt around the GPL requirements?

If I writing an APP to APP Store, and I don't want to give the FULL source code away. I must not use GPL code. Is it?

Pretty much, yes. That's the whole point of the GPL.

Reply on news.ycombinator.com