Hacker News Reader

Comment by intertextuality | Hacker News Reader

I believe this is a big problem with git or any of the current repo gui providers. A repository should not be able to be forked if it doesn't have a SPDIX license. Or at the very least users should be able to turn off forking ability in the repo settings.

It's usually not an issue but I have run into some small repositories that had no license, meaning I could -not- fork and modify for myself or a PR, legally. But this is not obvious at all unless you look for the license file or a manifest file.

View on HN

Neither git nor github can automatically discern how the law applies in context in 195 nations without consulting a lawyer and honestly neither can you.

Unless you want to pay thousands of dollars per repo presumably everyone is going to continue not giving a damn.

If you don't want people to clone a repo don't upload it to a public github repo. If you are thinking of cloning realize that the ability to clone it gives you zero legal rights.

Anyway you cannot fix legal complexities with technology in this instance.

This could be a problem for ricardian contracts and/or smart contracts

Those don't solve anything, because the core problem is a human one. It needs to be legal in all the countries that they might apply to, and that still requires a lot of expertise. The person you are responding to says "this is a problem technology can't fix", I assume this is the reason.

> Or at the very least users should be able to turn off forking ability in the repo settings.

This is absurd. You don't have to use the "fork" button to copy a repository. It's as simple as cloning it and pushing it. Such a restriction servers no purpose at all.

Obviously such an implementation would disable cloning as well.

Why bother putting it on GitHub then? I expect to be able to git clone anything I find on GitHub. It's on you to determine how you can legally use the code.

GitHub would obviously also have to make the repo private as well, and then get into the business of interpreting and potentially defending the compatibility of their service against various licenses before making it public. That's unsustainable.

The onus is on the end user to make it private.

Just thinking aloud, but GitHub could warn, when setting up new projects that don't have an OSS license, that the user may wish to make the repo private.

I have a small iOS app, not too big, a few thousand lines.

My idea was to use Github, but then I didn't want to go through the cost/effort, and I am using my own version system, AWAY from everyone. The only way for someone to get my code is: a) laptop gets hacked b) laptop gets stolen (disk is encrypted), c) backup gets stolen (carbonite is encrypted) d) Apple gets hacked.

Git should not bother people with a bunch of different alerts (imho). A COMPANY (apologies for the caps) that has been working on code for "a few years" and doesn't do the MINIMUM to protect their Intellectual Property (IP)... well that is suicide.

Don't they pay someone with GRC/Audit/Security skills to put some sense into them????

Then make a private repo. Hosting a public repo that a company would have to pay a mechanical turk to scrape every single file from manually by viewing the RAW data is just obtuse.

If you want it open source, understand what that means before complaining about it. Otherwise don't release your software on an open source platform.

There _is_ a difference between forking and cloning. Forking is always allowed by the github license:

> other GitHub users have the right to view and fork your repository _within the GitHub site_

^^ That's from the github website. Note that they only have permission to fork from within the website.

So such a restriction serves as a legal barrier - it leaves no legal way to copy the code.

GitHub doesn't have the ability to choose what is legal. Or a better way to put it, the law does not follow GitHub's Terms of Use. You can violate them all day long and have no legal repercussions. The most important thing about people putting software in open report is that demonstrates their intention to make their software available to the public, which makes a big difference in a court of law.

The github license is irrelevant here because they don't own the code. So there's no point in even mentioning that.

Uh, if you don't wan't to fork, don't make it public in the first place? Code escrow is another thing, but that does not mean everyone needs access...

The two aren't necessarily mutually exclusive, although yes I would agree with you. -In the case- of a repository being public without a license however, forking and related things should still be disabled to prevent licensing headaches.

This shows a fundamental misunderstanding of how git works.

The main point of putting something on GitHub is to allow people to git clone it. Every git clone is a fork of the project.

If you don't want something forked, don't put it on GitHub.

I understand how git works. I'm discussing the edge case scenario where someone uploads something but doesn't add a license. In that case, forking and cloning should be disabled, at the least.

IIUC, you are suggesting that GitHub make new repos private by default, unless a permissive license is set.

This seems a reasonable balance.

It's antithetical to their business strategy. They charge for premium accounts to give access to private repos. Nothing wrong with that, but OP should probably try out Gitlab if he wants an enterprise-level solution for free.

I'm not OP, I'm GP. Second, I fully understand git, github, gitlab, etc.

I'm specifically discussing a situation wherein someone has uploaded non-licensed code to github. I am not advocating for this. I am discussing what should be the default behavior for a repo if unlicensed. Another alternative is not having the repo be usable at all (so not private) if one attempts to bring it public without a license.

Get over yourself. I was referring to OP of this particular sub-thread, meaning you.

And you are continuing to misunderstand how this works. If you can view it, you can copy it. Nothing prevents someone from viewing a public repo. So nothing prevents someone from copying it. Therefore any attempt to make it difficult is just a PITA.

That's why Github has a default license for all non-licensed public repos. Because it's a public repo. If it wasn't supposed to be available to copy, the source code shouldn't have been made a public repository.

So again. If what you're looking for is a private repo solution, Gitlab offers this enterprise-level solution for free. You are barking up the wrong tree.

Angry, but correct.

Does your computer's shell disable `cp -r` for directories that don't contain a license?

The point of uploading to a public Github repo is to let others clone it. Pure tech tools like that shouldn't implement features that require searching a repo for a file that could be a license and then determining whether the file gives others the right to do that clone. After all, letting others clone is the entire point of the tool. If it's not allowed, don't use the tool.

There's nothing stopping you from entering anything in the LICENSE file, including an open source license, a copyright notice, or something completely unrelated to the license of the project.

With that in mind, to enforce your argument, they would need to create a list of licenses that are okay to fork/clone. Why should they create a finite list of that?

I'm willingly using WTFPL[0] that can be summarized as "as long as you change the name, do whatever the fuck you want to". I know it's not a serious license (I only use it for non-important collaborative Markdown documents I've started), but thanks to its use of the word "fuck", I'm having hard time believing that it would find its way into any whitelist. FSF mentions it on their website, but GitHub doesn't list it as an option on choosealicense.com.

[0] http://www.wtfpl.net/

Github is a publishing platform. Publishing is the act of releasing something for distribution. Cloning or forking a repo is the standard method of distributing something using Git. All Github's terms of service do is ensure it's clear that if something is published to their platform, they will distribute it in those ways.

Laws are different in different countries, e.g. it is not against the law to consume pirated content in Switzerland, but is illegal to share it further. So, if I have a pet project for my personal use then I can pretty much use anything I can find on the internet.

By hosting on github aren't you sharing it further?

GitHub require you license public repos to allow others to fork it. Whether they can use it for a specific purpose is still questionable - but clicking the fork button on github is allowed. They agreed when they uploaded the code.

Note that this is governed by GitHub’s TOS and supersedes anything in the License file.

> If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking)

So I can "perform" and "reproduce" content through forking, solely on Github. But I couldn't clone it, nor make modifications to my fork, if I read that correctly.

It makes little sense and could be avoided altogether by disabling forking for un-licensed repositories. Or by simply giving all new projects a default (with an opt-out option for no license or alternate licenses).

It makes more sense if you understand the license is about protecting GitHub and not you.

A disabled fork button unless the repo did a positive action would dilute the whole concept. The fork feature is key to the whole thing and is what made them different.

Reply on news.ycombinator.com