Comment by Twirrim | Hacker News Reader

Comment by Twirrim | Hacker News Reader

Years ago, I interviewed a candidate for a role on my team. As usual, one of the ways I break the ice with candidates is to get them to talk "war stories".

The team he'd worked on had produced a tool that was only ever intended to be used by the team to solve a particular problem they had. It contained proprietary code.

Unknown to the team, word had spread about the tool, and others had started to use it, including solutions architects. Who started shipping it to customers to use, who absolutely loved it.

That'd be fine except one of the core libraries it used was GPLv3 licensed, and there was non-open source proprietary code used in the tool.

The nightmare scenario he found himself in was having to rapidly re-architect the tool around a non-GPLv3 licensed library, without breaking any functionality, all the while having to have regular sync up meetings with a furious CEO and Legal department (who, to be clear, were mad about the situation, not this particular developer or his team, who weren't to blame)

I worked in support and came up with a quick script to check for a very specific issue. It was super simple and really just applied to one customer to find one bug they encountered. It really didn't do much more than look through a bunch of counters and a bunch of if statements ...

Next thing I knew someone had copied it and started running as a rule on every data set / customer they could get their hands on, and of course it was false positive city.

Finally after lots of emails where I would just type "Don't use that script, it doesn't work." some engineer wandered up the stairs to support to talk to me.

They were fielding escalation after escalation for these false positives. Support would run the script, see some flags, and turn their brain off and escalate. Management was so scared of this bug / issue that they would do the same.

So he tells me to use a trick he used with a similar situation.

I announced a new and improved script and management militantly demanded everyone use it, and that all escalation using the 'outdated ' script would be rejected.

The new script just identified if it was the right customer for that script and set a bit if it wasn't. If that bit was set the engineer knew immediately they could ignore the output and would say that their analysis didn't find the problem in question and advised some basic troubleshooting next steps (copy and pasted mostly).

The support soon realized that just running that script wasn't getting them much more than a few minutes of breathing room away from the case, management realized this too and saw all these next steps coming back and the focus switched to 'hey we should do these next steps all the time too'.

That was also one of the ways I started to understand how the engineering team worked and really helped start a good relationship with them.

That was a very valuable anecdote, thank you!

> having to rapidly re-architect the tool around a non-GPLv3 licensed library

... or just go with it and have it be open source? The old version is already open and free for anyone to request the code of. No rush at that point, you can withhold updates for a little while while you rearchitect this or take the situation as it is and have the next few bugfix releases also fall under GPL until you get around to replacing the core component (iff one insists that the future additions must absolutely be proprietary).

Quickly removing the code doesn't change the previously released versions' license.

It does hopefully prevent any of your customers from ever asking for it.

> Quickly removing the code doesn't change the previously released versions' license.

But would $BIG_CORP publish source on request for a proprietary product just because they built one version with a GPL library by mistake and later fixed it? Has this been successful, ever?

Isn't this how OpenWRT got started?

Depends on the composition of CORP. If it is comprised of developers with strong respect for OSS or FS community they might not stand for non-disclosure. OTOH, plenty of orgs would be mainly folks without a strong opinion either way and would just follow executive direction.

The license of the previous code didn't magically become the GPL altogether, instead it by default became un-distributable. They were required to (a) stop distribution of the existing code since it at best had no clear license, and (b) if they wanted, going forward remedy the license by clearly making it GPL or doing the rewrite of the dependency. Or even reach out to the library author and ask for an LGPL or other alternative - there is sometimes (often?) some flexibility there.

The built-in conflict resolution in the GPL is no-distribution.

Depends who had rights to the proprietary code. If it was someone else's (for example, if the internal version had used both GPLed code and some proprietary third-party library), open sourcing the whole thing just might not be possible.

> ... or just go with it and have it be open source?

They didn't have the legal right to do so.

How is that? The company added code to a GPL project, that means it is a derivative work and also comes with software freedoms, or at least that's how the story reads to me since there is no mention of other claims or parties to the mix. That means the company owns the copyright to the added code and is free to comply with the contract (license).

Company A writes library with commercial license.

Company B uses that library and a GPL library in a product. They distribute the product.

Company B has no right to relive se Company A’s commercially licensed library under the GPL. Hence, stop distribution and replace GPL library.

See:

> ... since there is no mention of other claims or parties to the mix [like company A]. That means the company [B] owns the copyright to the added code and is free to comply with the contract (license).

I'm also not sure whether the confidentiality clause would weigh heavier than a 'must provide source on request' clause, perhaps it could be resolved by not distributing the part that's covered by the confidentiality clause since another standalone library is clearly not a derivative work of the GPL-licensed library. Then only B has to distribute what they made for everyone's benefit.

An app so killer they're willing to rewrite a part of it. Nice problem to have!

> one of the core libraries it used was GPLv3 licensed

it's still untested in the real world if gplv3 "taints" derivative work that broadly.

Would they had to open source the entire solution? or just changes made to the library? nobody knows, and there's a lot of FUD to promote BSD licenses instead of sitting down and properly defining the limits in a practical way.

Reply on news.ycombinator.com