Hacker News Reader

Comment by bouk | Hacker News Reader

I love that all the discussion here is about the license I wrote and not about the actual project, which is a completely terrible idea and something I created as a lark.

Why did I not spell this out in the blog post? For my own amusement. I also think it shows that licenses really don't matter all that much as some people think, they are not computer code.

View on HN

>>> I also think it shows that licenses really don't matter all that much as some people think, they are not computer code.

They matter as long you're willing to enforce them, and have the time and money to do so.

In that case, you may be able to submit some form of take down request to GitHub against that project and other projects who are using your library.

https://github.com/search?q=bouk%2Fmonkey&type=commits

edit: wow, one of the projects that depended on your library was arduino up to 2020. https://github.com/arduino/arduino-cli/commit/09b4e8804fbd61...

edit2: was also used by AWS up to last week when they removed it. https://github.com/awslabs/karpenter/commit/d84365e8c44178ea...

update: hit the jackpot

the library is currently in use by Heroku/SalesForce to build deploy java apps (or something like that) https://github.com/heroku/java-buildpack/blob/master/go.mod

I wonder what sort of settlement you could get if you were to send them a lawyer for real.

They will be happy to cease use of the code.

The damages probably amount to $0. "Don't use this code, no seriously don't" isn't exactly an advertisement of the value it provide.

They may already have, looks like that archived repository has been replaced with: https://github.com/heroku/heroku-buildpack-java

which doesn't even use go.

And they'd like you to even move away from that replacement to an ever newer replacement: https://github.com/heroku/buildpacks-jvm

There could be many reasons for having an injunction against using code.

Welcome to America in one sentence.

I really don't understand this way of thinking

I'm no lawyer, but don't you usually have to show damages?

Damages would be loss of revenue. He was deprived of the ability to negotiate terms of use for payment.

This is why the GPL is more developer friendly than other licenses. If a business doesn't like the GPL you can offer to relicense your code, ... for money. And money is the restitution you seek when the license is violated.

I'm curious how damages would be calculated in a case like this. Obviously you can't get away with saying "I would have charged them $10 billion for this code, so that's what they should owe me." But on the flipside, should they be able to say they wouldn't have been willing to pay anything for it, therefore they owe zero?

I am curious as well. Since it's not a typical work for hire relationship, it could be a (modest) percentage of profits, or a business contracting fee of ~$500k or so.

Statutory damages can apply, but in the US statutory damages for copyright infringement require registering the copyright prior to the infringement.

The blog post and the README both seem to encourage use of the project. And a license that prevents all use including personal is very rare and not exactly in the spirit of GitHub. So I’m curious why both the blog and your README don’t mention explicitly that you don’t want allow use or explain why. Would it be worth putting something at the top of the README?

> And a license that prevents all use including personal is very rare and not exactly in the spirit of GitHub

Non-free licensed code has been on GitHub for quite some time. It's not only about free software and you should not assume so, as in all software.

Edit: changed FOSS to "free"

Just to clarify, FOSS has significant provisions above and beyond allowing personal use. The term non-free is very different from "not allowed to use at all".

Yeap, you're right. There are lots of terms to describe free and non-free software. I meant "free" in any capacity, for clarification.

So what of it? Show me a court verdict that throws the license out of the window because README led you to believe something.

It would be an interesting precedent, forcing companies to comply with everything their advertisements say and doing away with any sort of fine print and ToS. I’m all for it, in fact. Total Ankh-Morporkization!

OP said: "I also think it shows that licenses really don't matter all that much as some people think". I doubt they would be unable to sleep at night because of a license violation.

I'm glad that I can now say that I've contributed Windows support to a project which I probably violated the license of while working on :P

By technicality, the license has been violated by quite a large variety of corporations: Microsoft, AWS, Heroku, Bilibili, Baidu, Apache, Arduino, etc. [0~6], and much much more [7]

Crazy.

[0]: https://github.com/microsoft/bedrock/blob/a0ab244a80a94133cb...

[1]: https://github.com/awslabs/karpenter/pull/609

[2]: https://github.com/heroku/java-buildpack/blob/master/go.mod#...

[3]: https://github.com/bilibili/overlord/blob/b524449801b5411583...

[4]: https://github.com/baidu/openrasp/blob/f992962207bec063eda6f...

[5]: https://github.com/apache/camel-k/issues/2067

[6]: https://github.com/arduino/arduino-cli/issues/740

[7]: https://sourcegraph.com/search?q=context:global+%28bou.ke%7C...

I've considered making a license that is basically MIT/BSD, but requires that anyone using an automated license checking/compliance system (any corporate users) to pay a fee to use the software.

Why do you think that only corporate users use an automated license checking/compliance system?

If you do personal projects that are open source it's equally important to know what licenses your dependencies have if you release those projects to the public.

The primary difference is that as an individual, you can easily add that new licence to your allowlist. In an enterprise, it might be easier to fork over the money rather than convincing legal to allow your use of the software.

License checking is like code coverage. A part of our profession. It is not only for corporate users.

Individuals run license checkers too.

I would describe an end user count, revenue size, etc in order to apply special circumstances to corporations. Drone.io does a great job of this.

Instead of doing that, why not dual-license your program under CC-BY-NC and AGPLv3, and then sell exceptions?

A lot of legal departments have a mental image of AGPL (and GPL) as a bogeyman that will steal all the company's code if allowed anywhere near the building. I've sat through a presentation one time that tried to paint these licenses as something only basement dwellers use for personal projects. I spoke to the presenter afterwards and told them about projects like Linux and Mongo, and how even AGPL is not as scary as they thought.

The lawyer seemed genuinely surprised and said they would read up on it. I'm pretty sure my bringing this up in a friendly manner caused them to question their assumptions. Had I picked a fight during the presentation I'd just be labeled a basement dweller.

However, this lawyer also told me something interesting. To some extent it doesn't matter whether I was able to change his mind. As long as other lawyers in the field have this bogeyman concept in mind, the use of GPL will get flagged in due diligence, etc. and it's easier to simply not use a component with strong copyleft when developing a product (unless it's as irreplaceable as Linux).

This is a long-winded way of saying that selling exceptions will likely scare off potential purchasers long before they are in a position to consider the purchase. Most shops have a blanket "no GPL ever" policy and a dev won't even bother with the component even for a prototype.

My personal experience as a developer and owner is that it is very difficult and time consuming to understand the risks and to comprehend the *GPL licences.

For example, using an LGPL based JavaScript library just leaves me confused every time. I read the LGPL 3.0, read some stack overflow answers, and read the GNU website. Yet I am left without being 100% certain that I can minify the LGPL JavaScript into a single file with my own source code (because JavaScript is not object code, and because sending JavaScript to the browser is distribution).

With BSD/MIT licences everything is clear and less ambiguous, and if I get something wrong then it is usually something easy to fix.

If I were a general counsel, I wouldn’t trust all my developers to follow the GPL licenses properly nor would I trust developers to correctly avoid simple mistakes. A default ban limits liability, reduces risks of negative publicity, and anyone that needs an exception has to justify it.

Idealistically, I love the GPL, and I truely believe in the goal of share and share alike.

Practically I understand why following the *GPL licences is difficult and that it involves multiple risks for a business, and so many commercial businesses sensibly prefer to avoid the costs.

There was a funny Microsoft license for Xlsx.js (a lib that read Excel files in browser): It was allowed to distribute freely… as long as it runs on Windows:

> (F) Platform Limitation- The licenses granted in sections 2(A) & 2(B) extend only to the software or derivative works that (1) are run on a Microsoft Windows operating system product, and (2) are not Excluded Products.

So you could not deliver it on Safari, but also not on Chrome if it ran on Mac.

Aaaand that is why the JSXLSX implementation was developed, exactly the same as xlsx.js but without the restriction.

https://github.com/stephen-hardy/xlsx.js/issues/8

Why not license it so that any individual or business below $X revenue can use it, but others have to pay a fee?

The issue here is that you're a well-poisoner, putting out code that can't be used, as a joke, while also making a popular blog post and making the software easy to use as a library. Now that it's being used, it's also hard for folks to remove your library and implement something similar without it being considered a derivative.

Sure, it's funny, but it's a joke at the expense of everyone else. This is like going to a party and walking up to every person and making a joke at their expense. Were the jokes funny? Maybe. Does everything think you're an asshole? Almost certainly.

If anything, it’s raising awareness of the fact that just because it’s on GitHub doesn’t mean it’s FOSS, and that developers need to pay attention to licensing before snatching someone’s work up for their own personal & commercial benefit.

In this case the license was silly, but if this library had been GPL, it’d still have been a massive violation by most of those big companies, and that’s something we need to pay more attention to.

One important difference is he didn't walk up to anybody, they walked up to him. He owes nothing to anybody, it's not like he ran a media campaign.

He wrote a blog post that was quite popular at the time. He's in this thread explicitly saying he did it for the lulz. The repo doesn't clearly say not to use it, only the license does.

People shouldn't use software without checking the license, but if you're making a joke, for a pattern that's actually something used in the industry, because you believe that pattern is bad, yeah, you should label it a joke.

He's not a well-poisoner, someone just decided to chug from a bottle clearly marked "do not drink".

If someone spends the time to integrate mystery code without taking the time to check the license allows it then frankly they dug that hole themselves.

On the Internet, unless you sprinkle your words with emoticons, it is hard to convey irony or amusement using text alone.

You absolutely have the power to end the controversy by switching to a more mainstream license then adding a clear disclaimer like “use at your own risk”.

GitHub currently lists 465 projects that depend on your library, which means more than a handful of devs find it useful.

I'm all for FOSS, but I fail to see how saying something like "There would be no problem if you accepted to release it with a less restrictive license" differs from saying that to a GPL library developer because proprietary code was found using it. Why should the first be considered "a controversy" but not the second ?

License aren't computer code, they are social code. That matters more, not less, than computer code, at least until we're all disembodied brains in a large VR matrix - because usually people run code for people purposes, not the reverse. Coders frequently ignore this aspect, but not everybody has this luxury.

I see no reason why disembodied brains wouldn’t find a need for social agreements as well, it’s not like the absence of élan vital would cause them to cease being social. The content and mode of expression of those agreements might be quite different, of course.

(We fleshbags could probably use more widespread application and understanding of formal language and notation as well—the most cumbersome description of linear interpolation I’ve ever seen was in the section on a real estate tax hike in the tax code; it had paragraphs! I mean, I feel for those who didn’t have a good time in high-school algebra, but I don’t see how they could reasonably deal with that monstrosity either.)

"Someone told me that each equation I included in the book would halve the sales." -- Stephen Hawking

Algebrophobia apparently is a thing.

Medically, I’m entirely willing to believe there’s an X-phobia for any X. I just doubt this particular one would cut off more people than avoiding unreasonably long phrasing would include (let alone the weird French lingo the English-speaking world seems to insist on), and making a text accessible as is to literally everyone is plainly impossible. For regulations you’ll have to arrange special accommodations for some groups in any case—it’s only a question of which ones; for contracts it’s just another thing to negotiate.

Culturally, yes, and I can’t help but be awed at how stupid and self-inflicted it is. (See “Mathematician’s lament”, et al.) Introducing algebra into legal practice now would probably be a spectacularly bad idea even if it were possible. That’s why I mentioned “more widespread application and understanding of formal language”. Passing this hurdle is a massive ordeal—if I meaningfully contributed to it and knew that, I could probably die a happy man—but, I mean, we were talking disembodied brains in VR here.

By the way, can anyone explain what it is people actually like about A Brief History of Time? I went on to study some of this stuff, but the book appears both unnecessarily convoluted and surprisingly stingy with actual information compared to my preferred pop sci fare. I like me some enigmatic promises of explanations, but Hawking’s were left mostly unfulfilled, or so it seemed to me.

Yeah, I looked at your project, and immediately wondered why the fact that someone merged a patch using it at all wasn't the suspect issue...

Eh, I feel like rewriting function pointers is a pretty standard trick, amusing (and definitely amusing that people are actually using it) but not terribly novel to the audience that finds these hacks amusing. Combined with the fact that the headline and issue is about the license/it takes multiple clicks to even find out what the library does, and it's not surprising that that's the focus.

Someone posted the actual project here: https://news.ycombinator.com/item?id=28266515 - but since both the url and the title of the OP are specifically about the license, it's not surprising that that was the topic.

That's because this thread is specifically about the license.

Well done! It also made me think GitHub should do more to highlight the license in their UI.

Reply on news.ycombinator.com