Hacker News Reader

Comment by Joeri | Hacker News Reader

I have a different reading of this. I think this is them doing the best they can within the limits set by microsoft's legal department. They cannot legally admit they looked at his code and copied the structure, because that opens them up to a copyright suit. In the blog post it seems they went as far as they could: admitting to being influenced by the ideas, without having actually copied any of the code.

If they really want to fix this, they need to pay AppGet's author some money, and get something in writing so they are legally protected from copyright suits. I assume they're negotiating this right now, and that once this deal is done there will be another blog post that is more genuine.

They really messed this up because it would have been cheap to get something in writing before releasing WinGet. Someone at microsoft legal dropped the ball.

View on HN

AppGet is open source, under the Apache 2.0 license: https://github.com/appget/appget. That means basing a new project off AppGet - including using its source code - is legally permissible.

edit: This is explicitly not a judgement of ethics.

Forking is permissible, but you still have to adhere to the terms of the Apache License 2.0. You can't remove copyright notices, you must provide attribution, if you release source you must indicate what you changed, etc.

That Microsoft didn't do any of that indicates that they do not believe that WinGet is a derivative work of AppGet under copyright law, so the copyright license granted by the Apache License is not needed.

ETA: That is, Microsoft believes they don't need a copyright license. My personal position is that I would have liked to see a proper fork under the ALv2 with attribution, which would have avoided all this mess.

WinGet is open source under the MIT License, which I believe keeps them in the clear: https://github.com/microsoft/winget-cli. In practice, I've never heard of any legal problems when a derivative project is also open source under a similar license. (Yes, the licenses are different. But I also believe they are considerable compatible.)

No, that's wrong. You can't just slap a new license on top of code you've copied — that's illegal!

You have to adhere to the terms of the copyright license granted in this case by upstream License. If you do not, you lose the copyright license and the ability to redistribute under any terms.

Maybe you're thinking of license subsumption? That's when (say) a project under a more restrictive license (e.g. Apache License 2.0) bundles a dependency which is under a more permissive license (e.g. MIT), yet the package is advertised as being under "Apache License 2.0" even though the licensing is polyglot.

But even under subsumption, you still don't get to do things like removing copyright notices or declaring unilaterally that somebody else's work is now under some new license they didn't grant. The license headers in the bundled dependency's source files don't get modified, it's just that you summarize the terms of the complete package because fulfilling the terms of the ALv2 suffices to fulfill the terms of the MIT license. (Sort of. License subsumption is a complicated issue.)

As I said, I'm unaware of any actual projects getting into trouble in a situation like this, as the licenses are mostly compatible. Are you?

Yes. Plenty of projects have gotten "in trouble" for copying code and illegally changing the license, either inadvertently or deliberately. The punishment is generally a complaint, and the remedy is that they fix the attribution. Examples:

- https://github.com/Lutando/Akkatecture/issues/19

- https://github.com/Grover-c13/PokeGOAPI-Java/issues/490

- https://github.com/dsiguide/dsiguide.github.io/issues/14

Such problems do not end up in court for two reasons.

First, it costs very little to bring a project into compliance with a permissive license — all you need to do is give attribution. It's not like GPL enforcement, where you have to choose whether to open source your proprietary code or to purge the GPL'd code from the project in order to achieve compliance.

Second, the culture of permissively licensed open source communities is such that they don't generally want to foster a litigious environment which would frighten business users.

If your point is that all they need to do is make the appropriate attribution, then we're in agreement.

> They cannot legally admit they looked at his code and copied the structure, because that opens them up to a copyright suit.

AppGet is released under Apache License 2.0, Winget under MIT, I'm not sure how copyright would be an issue.

AppGet's author addresses that point here

https://keivan.io/the-day-appget-died/#edit-to-clarify-some-...

I'm mean I know it would be nice to toss him some money. And it sucks when companies ghost people. But really isn't the point of open source that everyone can do what they want with the code? And if you're not distributing the actual code, why do you owe them anything?

If I gave credit to everyone who influenced the code I write, the file would be huge. Does the world have enough disk drives to hold all the credit where credit is due?

> why do you owe them anything?

decency, morals, thoughtfulness, that kind of thing

> If I gave credit to everyone who influenced the code I write...

They directly ripped it off.

Big companies will try not to pay even when they have money. To not even give the minimum of non-monetary credit is even less reason for me ever to release code under a "what's mine is yours licence".

> They directly ripped it off.

No, they used some very common and unoriginal ideas that were implemented in AppGet.

Can you point out exactly what was "ripped off" here?

- https://github.com/microsoft/winget-cli

- https://github.com/appget/appget

They're not even written in the same language. And everything done in AppGet has been done before. Yawn

> Big companies will try not to pay even when they have money.

I will try not to pay, even when I have money. I think this applies to most people. Who wants to pays for something that's already free? I'm not running a fuckin charity over here.

> To not even give the minimum of non-monetary credit...

They've given it.

However, I wonder if during all of this Keivan has credited Microsoft for all of the open source tools, services and frameworks that he's used in his other work???

> Can you point out exactly what was "ripped off" here?

from his blog

"When I showed it to my wife, the first thing she said was, “They Called it WinGet? are you serious!?” I didn’t even have to explain to her how the core mechanics, terminology, the manifest format and structure, even the package repository’s folder structure, are very inspired by AppGet."

> I will try not to pay, even when I have money

Then people like you will kill off exactly the things they leech off, by pissing off those people who made them from their goodwill.

> However, I wonder if during all of this Andrew has credited Microsoft for all of the open source tools, services and frameworks that he's used in his other work???

I don't know, has he? Why raise the question instead of answering it.

You're curiously willing to defend microsoft.

> They Called it WinGet? are you serious!?

How many products have "Git" or "React" in their name? Does everybody accuse these people of ripping off Linus Torvalds or Facebook?

> Then people like you will kill off exactly the things they leech off, by pissing off those people who made them from their goodwill.

Because I don't want to pay for the air that I breathe?? Mmkay.

> I don't know, has he? Why raise the question instead of answering it.

You should be answering it because you're the one accusing Microsoft without knowing the whole story.

> You're curiously willing to defend microsoft.

Whenever I see imbalanced, ill-informed or illogical conclusions I speak out against them.

> are very inspired by AppGet.

This is "ripping off" now? Maybe they did steal it wholesale, maybe not, but I haven't seen any evidence (nay, even allegations) of it.

> nay, even allegations

The allegation is right there. His blog. Which I quoted from. But didn't link to, so sorry, here it is https://keivan.io/the-day-appget-died/

inspiration != theft

> "When I showed it to my wife, the first thing she said was, “They Called it WinGet? are you serious!?” I didn’t even have to explain to her how the core mechanics, terminology, the manifest format and structure, even the package repository’s folder structure, are very inspired by AppGet."

https://help.ubuntu.com/community/AptGet

I wonder if he mentioned his name was inspired by the extremely more well known and 22 year old default package manager in linux that happens to be called apt-get.

I mean honestly if he's saying that as justification in his blog post, I'm immediately off his team. That's insane. Obviously a layman would think the name was ripped off if they didn't know about apt-get.

There's NuGet (another package manager) released by MSFT in 2010.

I compared the manifest format, that's different terminology. And WinGet has more insightful supports, e.g. MinOSVersion, License, LicenseUrl.

And the folder structure is different also. That's per version per file on WinGet but single YAML on AppGet. I'm pretty sure his wife can't handle that if she is not a developer.

"Core Mechanics" => It needed more proof.

I agree. And just because it's a company making billions selling software doesn't mean they're obliged to pay you a great deal of money.

If Beigi was smart he would've asked them to purchase the copyrights as he's the only one legally entitled to do so.

If he's developing his software altruistically he should be satisfied with his credit, well knowing that his project will now be overshadowed by Microsoft's and will eventually pass into oblivion and be forgotten.

Reply on news.ycombinator.com