Do I have to worry about copyright issues for code posted on Stack Overflow? | Hacker News Reader

Do I have to worry about copyright issues for code posted on Stack Overflow?

meta.stackexchange.com

48 pointswhereistimbo31 comments

The situation is worse than presented.

The person posting the code to SO as an answer may not own the copyright to the code they're sharing, despite the SO TOS requiring them to. So even a link to SO isn't a total solution if lawyers are getting involved.

All in all in CAN be a shitshow, in practice it mostly works out.

This also is largely ignoring what fair use means in different jurisdictions, let alone what licenses work where. Many tech companies operate globally from day one, so all sorts of issues can come up. In reality, ignore almost all of them and solve them if you ever actually start making money.

Is there a defence to using the code because you had a good faith belief it was licensed in such a way that would have been fine, if the original author did have the right to grant said license?

Sort of.

Blatant infringement is typically punished worse by judges / legislation.

You still can be fined, have injunctions bought against products etc without it being wilful.

There have been a bunch of song examples of this, where someone alleges a small riff is taken unknowingly or not from another song, and the songwriter losing all royalties to the song.

I think it is (sort of) and the best signal may be not a legal analysis alone but the actual shift in the enterprise-backed communities.

Ever since https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._Internation.... Eclipse Foundation required what they call "Type B" IP scan for all projects (Eclipse F. is not just an IDE but a competitor to the Apache F.), essentially a deep scan of the code searching for any bits of GPL (our Eclipse project had a dojox dependency flagged because its MIT-licensed code contained a small snippet of GPL, that was the only time we got a rejection of a library). In late 2019, the change was made to make "Type A", a deep scan of the licenses only, to be the default (https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-...).

To me it signals that the common sense in the enterprise community now is that there is not much risk in that scenario, worst case would be that the original IP holder can force you to remove their code if they convince the court the developer had no right to publish it as opposed to getting crazy amounts awarded. I think it is also judged that the likelihood and the amount of trouble are relatively small compared to full code scan of all deps transitively at all times (incl lost productivity).

[deleted]

> That's exactly the example in the SO answer: someone posts a code snippet that they copy-pasted from a GPL'd OSS project. You use that snippet in your closed-source commercial software. Audit detects GPL'd code in your code base.

No it's not. The example in the SO answer is that the SO snippet is copied both into your software and a GPL'd open-source project.

Thanks, deleted.

Although it must be said that the scenario whereby someone posts a code snippet for which they do not own the copyright, perhaps indeed because they copy-pasted it from an OSS project, is an obvious one and less sneaky than the example.

I think the other obvious worry is that people post well meaning answers on the job, but it turns out that their contract says their employer owns the copyright to all code they write on the job.

They have no ownership over the copyright to give.

Previous company went through source code audit during acquisition. Auditor inevitably found code from Stack Overflow. Their guidance, which got us a passing grade, was to just include links to the SO answer and link to CC in a nearby comment in the code.

This is not legal advice, just sharing our story.

I wonder how this applies on proprietary code? Should the attribution be added in documentation or third party notices?

Out of curiosity, how does the audit work? Do they have automated tools to check against open source code bases and SO snippets or is it manual? Interesting nonetheless...

Yes, there are a number of tools that analyze source code and compare it with "all known source code on the Internet". They usually produce list of matches. For less-than-complete-file matches, usually human review and decision is needed.

That's strange. By including the link you satisfy the "BY" obligation of the license; but what about the "SA" one? Unless your code was being released under an open source license.

As parent said, this is not legal advice -- ask someone qualified to answer.

Another factor not addressed by the Stack Exchange answers is that even where the poster had the legal rights to post the code, it may not be under the licence that Stack Overflow says it is. Stack Exchange retroactively "changed" the licence from CC-BY-SA 2.5 to 3.0 in 2011,[1] and from 3.0 to 4.0 in 2018,[2] without getting permission from the people who own the rights. So the code actually remains under the original licence.

If the code is used verbatim, it must be released under the same version of the CC-BY-SA licence (unless permitted by the copyright holder), but adapting it would let you put the new work under a later version.[3] But there is also a jurisdiction-dependent question of what constitutes an adaptation, and how much of the larger codebase could be considered an adaptation of the CC'd work (and would therefore be covered by the same licence).[4]

1. https://meta.stackexchange.com/questions/74867/should-stack-...

2. https://meta.stackexchange.com/questions/333089/stack-exchan...

3. https://opensource.stackexchange.com/questions/7430/can-i-up...

4. https://wiki.creativecommons.org/index.php?title=ShareAlike_...

Note that SE finally backtracked on the 4.0 relicense in March [0], after two years of continuous objections from the community.

Now, content posted before the 2018 license change is licensed under CC-BY-SA 3.0, whereas content posted after is licensed under 4.0. You can see the licensing history for a post by clicking the “timeline” icon under the voting arrows.

[0]: https://meta.stackexchange.com/q/344491

Yes.

Why is this downvoted? The submission title is idiotic. If a colleague asked me this, I'd want to find another job. It's something somebody fresh out of a "Boot Camp" would ask.

> It's something somebody fresh out of a "Boot Camp" would ask.

That’s the idea...the linked post is a part of Stack Exchange’s FAQ library. Perhaps a better title could provide a slightly more useful summary of the content, but HN guidelines discourage editorializing submission titles.

[removed]

In general, the code - as you have written it - is your property, and the smart idea is not.

By submitting the code to StackOverflow, you are exercising a right of ownership. According to their terms, you give them irrevocable rights to publish and license the code onwards, etc.

The problem is that you may have not had the right to grant that license in the first place.

Agreed.

Given that most software made today is a conflation of frameworks, libraries, cloud services, and yes, code snippets, it seems really trite to worry about the copyright issues from copy and pasting a couple lines from a publically accessible forum. There’s no way to get a good take on the legality of a large enough codebase, why even bother?

From the highlighted answer:

> A Short Story To Illustrate:

> Someone else decides the code is a good solution for a problem they are facing, and decides to copy it into their open source GnuFizzBuzz project, covered by the GPL. Five years from now, someone is doing an open source audit on your code (maybe you are selling to a nervous customer, or your company is going public).

> The open source audit finds the snippet of code you got from Stack Overflow, and recognizes it as originating in GnuFizzBuzz.

> You are now stuck explaining how/why you have GPL code mixed into your commercial product, or proving that the code was actually from Stack Overflow. Can you prove that the person posting the code to Stack Overflow owned it to begin with (maybe they actually copied it from GnuFizzBuzz to begin wih).

Isn't that easy to prove with timestamps?

If T(StackOverflow comment) < T(GPL use) < T(your use), you'll still get in trouble.

Why? Doesn't that prove the copyright belongs to the SO commenter (and therefore permissively licensed), not the GPL author?

But you now have to prove you actually got it from SO, not from the GPL project.

Is that actually required, or it the legal team being overly cautious? AFAIK how GPL works is "here's my code. I own the copyright (by default), but I'll license it to you on the condition that you license it back to your users", but if you don't own the copyright to that snippet (as evidenced by someone posting it before you did), then you're not in a position to make demands. It'd be like demanding rent from tenants living in a building that you don't own.

Have you ever participated on an Apache or Eclipse project? Both have a rather robust IP due diligence. Our project scans all (+transitive) Maven deps via https://clearlydefined.io on every release.

This just makes sure you’re using correctly licensed libraries, it’s punishment for honest people.

I can circumvent this system by taking the snippet I need or just wholesale copying the library and changing around a few variables.

Reply on news.ycombinator.com