Microsoft forked MIT licensed repo and changed the copyright [fixed] | Hacker News Reader

Microsoft forked MIT licensed repo and changed the copyright [fixed]

github.com

1,326 pointsmkdirp538 comments

I lead the Microsoft Open Source Programs Office team. I'm sorry this happened.

We have merged a pull request that restored the correct LICENSE file and copyright, and are in touch with the upstream author Leśny Rumcajs who emailed us this morning. We'll look to revert the entire commit that our bot made, too, since it updated the README with a boilerplate getting started guide.

The bug was caused by a bot that was designed to commit template files in new repositories. It's code that I wrote to try to prevent other problems we have had with releasing projects in the past. It's not supposed to run on forks.

I'm going to make sure that we sit down and audit all of our forked repositories and revert similar changes to any other projects.

We have a lot of process around forking, and have had to put controls in place to make sure that people are aware of that guidance. Starting a few years ago, we even "lock" forks to enforce our process. We prefer that people fork projects into their individual GitHub accounts, instead of our organization, to encourage that they participate with the upstream project. In this situation, a team got approval to fork the repository, but hasn't yet gotten started.

To be as open as I can, I'd like to point to the bug:

- The templates we apply on new repositories live at https://github.com/microsoft/repo-templates

- The bug seems to be at this line of the new repository workflow: https://github.com/microsoft/opensource-management-portal/bl...

- The system we have in place even tries to educate our engineers with this log message (https://github.com/microsoft/opensource-management-portal/bl...): "this.log.push({ message: `Repository ${subMessage}, template files will not be committed. Please check the LICENSE and other files to understand existing obligations.` });"

A lot of commenters are sharpening their pitchforks, but this comment, in my opinion, makes it very likely that it was an honest mistake. Amazing what taking personal responsibility and earnestly apologizing can do to restore trust and credibility!

Yeah, I think this is an example of addressing a mistake that other companies should take note of. I don’t trust Microsoft-sized corporations as a matter of principle, and I don’t typically give them the benefit of the doubt, but when one of their own engineers explains in human-readable terms what specifically happened—on a holiday, no less—I’m impressed enough to believe him. Some PR flack showing up with vague boilerplate about how Microsoft values the open-source community and they’ll look into it would only have encouraged more outrage.

I always appreciate communication that acknowledges I’m a person, not a data point or a customer. I wish more companies ditched the greasy PR approach and allowed folks like Jeff to do their talking for them.

I think a key reason that corps do try to avoid admitting fault, is because in a lawsuit that can be used as evidence for a guilty verdict in a civil lawsuit in some of the most slam dunk ways.

If we remove this feature of common law legal systems, I think you will get far more admissions of fault like this one.

If you hurt people, organizations, etc for admitting their mistakes, they're going to stop doing it.

> makes it very likely that it was an honest mistake.

I don’t have any doubt that it was an honest mistake. They also took accountability for the mistake, shared their steps to prevent it from happening again, and they’re in contact with the original repo author directly.

At this point, anyone digging for excuses to further demonize Microsoft isn’t interested in honest discussion about this issue. This is a textbook mistake followed by rapid resolution (on Christmas Day, no less), with great communication on top.

Here in "honest mistake" they try to patent somebody's method: https://www.theregister.com/2021/03/13/microsoft_ans_patent/

It was obviously a mistake. Still nice to have someone involved give the backstory.

Yes, very nice writeup from Microsoft.

Had a similar experience with AzureCli v2.30, where the environment variable to ignore certificate errors suddenly did not work anymore.

It turned out it was removed but there was no mention of it in the release notes.

On the GitHub page quick response was provided by Microsoft.

If you read the comments, most people believed it was an honest mistake. What we didn’t agree with was that it was an excusable mistake. Microsoft have since acknowledged it’s not excusable and thus will rectify that error. So as far as I see it, all parties, both for and against MS, should be satisfied with the outcome.

In a way I'm glad that this is not taken lightly. We all need to be informed and calm, but mega-corporations should be held to higher standards. They should feel breath of an angry mob once in a while. I imagine, that if reactions to things like that would be just "meh, it's probably just a mistake" it would not be resolved as quickly or it could just be ignored. But now that it is all cleared up let's go home and Merry Christmas.

A phrase I've come to appreciate:

> Prescribe not to malice that which may well be a buggy edge case.

Intent is a red herring, especially when the actions of an organization, rather than an individual are being considered. More important are the actions' consequences and the organization's propensity for repeating them.

Honestly, doing this all on Christmas nonetheless. This sort of thing is why I never want to be in leadership roles.

What happened here was obviously a mistake. The thread is full of lurid accusations, because those are fun to write and talk about, but it shouldn't take even a minute's thought to see how dumb a heist this would have been.

The thread would have been a lot more fun if we could have spent it talking about what prompted your team to build this thingy, and bounce other people's approaches to the same problem off, and maybe share some war stories about dumb things bots have done on our behalf.

Thanks, regardless, for the information you've provided here. It's interesting.

> The thread is full of lurid accusations, because those are fun to write and talk about, but it shouldn't take even a minute's thought to see how dumb a heist this would have been.

Another good reminder that Hacker News is not above assuming the worst and gathering pitchfork mobs like any other social media.

The issue looked like a mistake from the start to anyone paying attention (committed by a bot, changes were consistent with a boilerplate LICENSE file being checked in).

If someone at Microsoft wanted to steal some code, forking it on Github and then publicly documenting the history of the code in the most visible way possible would truly be the dumbest way to do it.

Especially here, when the smoking gun is a change to an MIT licensed project. One of the torch-holding commenters remarked that developers at Microsoft ought to know enough about how licenses work to know what a big deal this was. Physician, heal thyself.

> Another good reminder that Hacker News is not above assuming the worst and gathering pitchfork mobs like any other social media.

I would go so far as to say almost no group is, they just have different preconceptions that encourage assumptions of malice in different ways and directions.

There is no substitute for more facts about the situation, no matter how much we'd like to assume the details that aren't given.

It's not just bots, it's real people: https://github.com/microsoft/cups/commit/8100595a3a3a6d5c7d0...

It doesn't matter how "dumb a heist this would have been". This is Microsoft and their track record with respect to illicit and/or illegitimate behavior needs to be continually scrutinized. They put themselves in this position. They have made plenty of intentionally dishonest "mistakes" over the years.

Track records matter and Microsoft doesn't have a clean one. Scrutiny of companies of their size should be the norm. Maybe they would do more to improve "mistakes" if more people held them accountable in a continuous fashion.

"Scrutiny" doesn't mean making up nonsense issues, which is what this is. There's no amount of weasel words you're going to apply that's going to make changing an MIT license in a public git repository part of a terrifying conspiracy --- or a conspiracy of any sort.

> The thread would have been a lot more fun

The Microsoft STL issues are usually quite fun and entertaining, at least if you don't have to use it: https://github.com/microsoft/STL/issues/1603

This is my favorite part of the culture change which is happening at Microsoft.

We are still working on it. And, it will take time.

Jeff's team, my team, the java team whose forked repo this unintentionally highlighted are working with dozens of other teams every week. Satya says we're all in on open source.

Hold Jeff and Me and all the leaders of Microsoft to that vision. Keep us accountable. And, know this takes time. Let's make technology and humanity healthier and more sustainable in 2022.

Unlike the sibling to my comment, I appreciate both this and the GP.

I was all in on MS as a kid/young teen.

Eventually I started looking at the actions of Microsoft, and as stupid as it is, felt betrayed.

I still don't trust MS, and still hate the direction Windows is heading, I will probably never daily drive it again.

However, comments like these give me hope that MS can turn itself around. Maybe some day MS will be the company I thought it was!

Tl;dr: Thanks for making changes!

> Satya says we're all in on open source.

You're not, just as your competitors aren't.

None of the secret sauces are Open Source: Windows, Office, Visual Studio, SQL Server, the Azure control stuff, and I don't expect them to be.

You're half in, at best, only Red Hat was all in. And they were bought out by IBM, so here we are.

Edit: I guess the truth hurts :-)

I realize that Microsoft is composed of many pieces, but that doesnt prevent me from treating it like a single entity. And that entity has IMHO done horrible things to it's own products and customers, so I'd rather they keep theirs hands off FLOSS as much as possible.

But if you treat it like a single entity, that means you also treat all the people working there like that entity. The janitor working at Microsoft doesn't deserve your ire, nor the secretaries, etc. But they work there, and carry around their logos on their backpacks and what not. Those people have feelings, and those feelings feel bad when the entity they work for is lashed out at. It does make one feel bad when one's company is raked over the coals, because it makes one feel responsible, even if one doesn't even know what's going on.

So, for the sake of the feelings of the innocent people who work there, I would ask everyone to please modulate the volume and intensity of ire that they project. Please speak truth to power, but don't be harsher than is needed to get your point across.

Jeff's reply needs no addendum.

But as for some background: I am a PM for Microsoft Build of OpenJDK and from late last year to around May this year I made contributions to the gRPC_bench repo as a Microsoft employee for some experiments we have been working on, to evaluate and improve different ways of implementing gRPC exchange in Java. [1]

This fork was intended for newer experiments, one of them being about coding and running these benchmarks on GitHub Codespaces. For that, I needed the repo on an org where we, as employees, have Codespaces enabled.

The rest is HN history (back to Jeff's reply above [2]).

Merry Christmas all!

[1] https://github.com/LesnyRumcajs/grpc_bench/commits?author=br...

[2] https://news.ycombinator.com/item?id=29685628

FYI: when linking to a line of code, simply press Y on your keyboard to have Github switch from the _branchname/path/to/file.xyz_ URL to the _sha1/path/to/file.xyz_ URL. The former can result in your URL pointing to unrelated code if lines are added or removed in future commits on the referenced branch.

https://github.com/microsoft/opensource-management-portal/bl...

TIL. Thanks!

Amusingly, this works on gitlab too. I was surprised that the shortcut was "so good that competitors had to implement it."

It's like Super+E: You never know you need it until you try it, and it doesn't work on your DE :-(

Really appreciate the prompt and transparent response, Jeff. Especially at a time when I assume you were not expecting to jump in on duty.

I hope that despite all the harsh words, you can have sympathy with that behind them are legitimate concerns and suspicion stemming from past bad behavior from various part of your organization. Due to this, and Microsoft's position of power, you have a much, much lower budget for these kinds of mistakes compared to the most other orgs.

Even if there was nothing intentionally malicious at play here, it would not be far-fetched for an outsider to interpret as "implicit maliciousness through neglect".

Here's hoping that 2022 will be a year of bridging the divide and sincere alignment.

Yes, it would be far-fetched. The conspiracy theory here is self-evidently implausible. We need to stop pretending that the accusations here were made in good faith, or are anything more than wishcasting. People write about these things because it's a lot more fun for them than to write about what actually might have happened, even if what actually happened is probably a better, more lastingly valuable conversation to have.

So, I'm of the opinion that a collective (for example a company) can exhibit malicious behavior despite no malicious intention of any particular individual in it. It can be emergent, and moreso the larger the organization. Along similar lines of systemic discrimination, there does not need to exist any conscious conspiracy or malintent. For better or worse, the whole is greater than the sum of its parts.

This comment speaks towards that this is the case:

https://news.ycombinator.com/item?id=29686347

> I know Jeff personally and he's great. This happens all the time at Microsoft though. Teams try to do OSS themselves, haven't a clue how GitHub or licensing works (e.g. they think the CLA transfers copyright), and after a slap aside the head, I send them to Jeff for guidance and all is well.

(I mostly agree with your sentiment, though. I do get the impression that leadership is sincere in wanting to do right. It's just that it's not that black-and-white or easy. As another MS employee commented, this is something that has to take time and they need to be held accountable along the way. https://news.ycombinator.com/item?id=29684127)

I know Jeff personally and he's great. This happens all the time at Microsoft though. Teams try to do OSS themselves, haven't a clue how GitHub or licensing works (e.g. they think the CLA transfers copyright), and after a slap aside the head, I send them to Jeff for guidance and all is well.

I'm really sorry you had to deal with this during the festive period.

I certainly understand how scandalous this looks to crowds like Hacker News.

But this seems a little bit blown out of proportion, as if Microsoft just forked the kernel or something and put their name on the license.

>I certainly understand how scandalous this looks to crowds like Hacker News.

I don't. I'm with the Microsoft employee who was pissed at how people think it's edgy to diss on Microsoft. What were the chances that Microsoft was openly doing that? Some dude who has now deleted his post said Microsoft was trying to "create a monopoly of web IDEs". These are clearly people who barely have a passing knowledge of how Microsoft works these days.

People think critical thinking means complaining endlessly. It doesn't. You can't think critically if you don't think clearly. And you can't think clearly if you're only looking for a reason to lift the pitchforks.

I don't know if you're aware of other not-that-ancient incidents like these?

https://keivan.io/the-day-appget-died/

https://web.archive.org/web/20180715225433/https://threadrea...

It took significant public outrage and press coverage before either of those were even acknowledged, a long time after.

> What were the chances that Microsoft was openly doing that?

After reading the above, is it really that edgy to be assuming the worst? If it's truly just recurring instances of different rogue employees, doesn't that speak to a systemic and/or cultural issue that needs to be addressed with additional internal safeguards and/or deterrents to prevent it from happening again?

To the credit of the relevant team here, today this was promptly addressed as soon as it got their attention. But it will take more than that to set to rest decades of precedence.

(I did not partake in the flaming and don't find it constructive or beneficial; just saying I have full understanding of the suspicion and understand that MS are still on probation)

Do you mind addressing the reason why an employee did exactly what you are claiming the bot did in error?

https://github.com/microsoft/cups/commit/8100595a3a3a6d5c7d0...

Again, this is a person, not a robot. How does this play into a "software bug"?

Honestly, I'm not sure what happened here.

My guess is that they were going through a checklist of what to do when releasing open source changes, and didn't understand what they were doing.

A lot of why we've had to put some guardrails in our system has been to point people to guidance and training on open source.

I've sent the team that works on this repository an e-mail, but I don't expect to get a response on the holiday.

Thanks for the response. Mistakes happen, human or computer, not the end of the world, and I get it. I was just more curious to know if there is a manual process for this type of forking that was not being vetted via the bot, and to bring another example to your attention.

Just don't shoot down the poor schmuck, mistakes happen.

The pitchforks will come down, anyway :-)

If you read the repo history carefully, you'll see a bot was responsible for rewriting the "LICENSE" file from an Apache license to the Microsoft (c) stamped MIT license. This human commit simply copied that same language to the file named "LICENSE.txt". It's unclear why they did that, but that human was not responsible for introducing the license text into the repo.

? Instead of a software bug, it was a human error. Is it really surprising that with a company of Microsoft's size, some employees fuck up? Likely the employee was trying to say that the contributions in this fork that were not present in upstream are covered by the new license, but failed to do so properly (by leaving the original license intact and identifying precisely which files the new license applied to and which it didn't).

Courts will take a far more generous view than you are here. If Microsoft is not profiting from the change, and fixes it promptly when pointed out, the courts will shrug at any case - no harm, no foul. It's not even clear to me that it's illegal to have the wrong license on GitHub, assuming the shipping product does not violate the correct license. As nobody has pointed to any infringing Microsoft product... What are we talking about?

Damn dude. You posted this comment on CHRISTMAS no less. Either your phone exploded or you are a VERY PASSIONATE hacker news fan. Either way ... props to you for trying your best to straighten this out immediately.

This feels like the sort of thing where straightening it out immediately, even on christmas day, was well worthwhile simply because it would let him enjoy his christmas dinner without worrying about an inevitable building dramastorm.

That is not, however, a complaint - being smart enough and giving a damn enough to realise that straightening it out immediately was a really good idea is impressive and laudable in and of itself.

I saw your comment on the cups repo. Please don't feel horrible about it. An honest mistake is an honest mistake, as long as the issues are remediated. Merry Christmas

Please consider https://github.com/microsoft/azuredatastudio/issues/102#issu...

>SQL Operations Studio was built on the back of many open source projects that all use the MIT License for a reason: it's the right way to keep moving the community forward, empowering your users to do cool stuff and build useful things for the community.

>We're just asking SQL Operations Studio to use the same license that Visual Studio Code does.

Thanks for explaining. Out of curiosity, does Microsoft have any external-facing GPL-licensed projects? Are there any restrictions to using (i.e. open sourcing something developed internally or forking something from outside MS) GPL-licensed projects? Specifically, would teams be able to get approval to fork GPL repos?

Git for Windows comes to mind. Teams can absolutely get approval for any open source license; however, for a GPL project, we'd have their open source legal team work with them to brief them on the license obligations and requirements, such as publishing code to https://3rdpartysource.microsoft.com/.

Interesting, so that's specifically for GPL-licensed projects? Or am I misunderstanding and you would have dev teams work with Legal for any open source licensed project?

Leśny Rumcajs? :)

For those that don't know Polish it means Forest Rumcajs (https://en.wikipedia.org/wiki/Rumcajs), probably a joke of the author that wants to be anonymous.

Thanks, this is the correct sort of response to this problem. It wasn't clear by the title this was an automated change, hence the pitchforks.

I figured something like this was the cause. I must say I'm quite disappointed by all of the negative comments before anyone from MS had a chance to explain what happened.

Hugs Jeff, keep up the good work and hopefully the rest of your holidays are a lot more cheerful

Thank you for the full transparency, sadly we may hear for years of people saying how Microsoft blatantly ripped off someone else's copyright, but that's probably okay, those people probably wouldn't use your projects for whatever reason anyway, when in fact it was a bot meant to keep you guys from releasing code prematurely without a reasonable license to begin with (at least that's what it sounds like?).

Thank you for being transparent about this and dealing with it appropriately, even on Christmas. I think that goes a long way.

Thanks for clarifying. This also highlights the lack of sufficient testing, and subpar processes, eg automation should be tested against critical paths, and changing a license should require human approval.

Agree. The lack of tests has been the biggest regret of mine for this project. It started as a hackathon project a long time ago, and as it grew up, it never got the testing investment it deserved. I imagine the code coverage is about 0.001% and there's no end-to-end tests in place.

My local tooling doesn't fail as visibly as this but it certain fails just as catastrophically leaving me feeling excessively silly.

So, yeah, hugops, mate.

Thank you for taking responsibility for this and for the transparency.

It is good to be reminded that care and integrity can exist, even in large corporations.

Feels like the reverse Streisand effect at play here; a high-profile minor fuckup that helps popularize a positive thing. This was fun to meme on, but I'm glad Microsoft appears to be on an upward slant ethically. It also makes me more comfortable being a Microsoft customer.

> It's code that I wrote to try to prevent other problems [...]

Don't worry, man, nobody expects people from Microsoft to write code that behaves as intended. Merry Christmas.

And here I was ready to sharpen my pitchfork. Thanks for communicating the error and the correction. I know this time of year can be especially challenging.

I have enormous respect for your response here.

It was immediately obvious that it was a script gone awry. Sorry your team had to spend your holiday on something so trivial.

Thank you for showing up on Christmas to address this. Have a great holiday!

Good job owning the mistake and planning to prevent it in the future.

Very nice to see someone take ownership of a problem. Thanks Jeff :)

Thanks for jumping in and trying to explain what actually happened.

Very well handled, kudos

So, you are adding licenses automatically? This seems pretty risky. Why not just prevent commits that don't have a license? Shouldn't there be a human somewhere in that loop?

Hanlon's razor to the rescue!

The attitude in these threads always boggles my mind. When YOU, your teammates or someone else you know makes a mistake, then it’s just a mistake. But when someone at Microsoft makes a mistake it’s because Microsoft is evil and by extension so is the person who offended.

“It’s a big company”, you say. They should have a process! And I’m sad to say, they do/will have a process exactly because of this attitude. Then, everyone wonders why it takes forever to fix that bug they’re furious about or why features are slow to come.

Full disclosure: I work for MS, though have nothing to do with this. It’s a huge company. I know hundreds of people and most of them are upstanding and try to do the right thing.

This is their process. Very hard to argue these are all mistakes:

ippsample (Apache -> MIT) https://github.com/microsoft/ippsample/commit/938bff17c72868...

huggingface-transformers (Apache -> MIT): https://github.com/microsoft/huggingface-transformers/commit...

health-cards-tests (MIT changed) https://github.com/microsoft/health-cards-tests/commit/5649b...

CUPS (Apache -> MIT) https://github.com/microsoft/cups/commit/ad69bcc78bdea3fea3f...

Credit to this reddit comment: https://www.reddit.com/r/opensource/comments/roa9xz/comment/...

This is a bot that is supposed to configure the right license when employees start a new repo in the Microsoft GitHub org.

It seems the automation is also triggered when Repos are forked into the Microsoft GitHub org which isn't correct behavior.

This isn't a deliberate action. If it were plenty of employees (myself included) would be outraged. I assume it's a bug in the bot - an edge case that was not considered. It is very rare to fork something into the Microsoft GitHub org after all.

I'll pass it along to some people I know.

MS dev here. Thanks for calling this out. I contacted the GH@MS admins to look into this and to consider adding some safeguards to the tooling so this doesn't happen in the future.

Wrong. The more links, the easier it is to argue that it's a mistake. Automation is hard, you know? Especially if no one noticed these and called them out on it until now.

(deleted)

Microsoft, a collective group of people trying to do the right thing, has made many choices over their time. Many of those choices have been in direct violation of things like, but not limited to, the spirit of the Internet, anti-competiton, spying on their customers, and many other negative things. Should we have let those things slide because Microsoft employs others that weren't involved? No. You can say this may have been a mistake but that is a slippery slope. Microsoft deserves negative press on "mistakes" because this acts as a balance to keep the power they wield in check. Beyond that you have a significant bias against biting the hand that feeds.

In my opinion, this gets a strong reaction because:

1. They made similar mistakes in the past.

2. They didn't fix it for half a year.

3. They can expect strong financial benefits from making these mistakes.

4. They've recently burned a lot of goodwill by deliberately infringing licenses on a large scale when they trained Copilot.

5. They could have easily prevented this kind of mistakes.

My summary would be that Microsoft deserves to be punished for making this mistake. If nothing bad happens now, then we'll have the same discussion again in half a year from now.

What financial benefits do they stand to gain by changing the name on an MIT license?

also, never forget CP/M: https://www.wired.com/2012/08/ms-dos-examined-for-thef/

This isn’t just one person making a silly mistake. This is a catalogue of failings. Where’s the peer review? Are you suggesting that anything published in the main branch on Microsoft’s GH org gets commit without any branch protection? And as pointed out by others, this isn’t even an isolated case.

A healthy org doesn’t blame individuals, it blames failures in process. Thus Microsoft should own this mistake. Stating it’s the fault of an individual sounds more like your team operates a blame culture. Which, frankly, is a major red flag for a failing organisation.

It's an automated bot, and it's an edge case that wasn't considered and is going to get fixed soon.

There are genuine mistakes, and there are some due to incompetency. Both can be somewhat execused.

However, if you look at the changelog, I don't know how you are gonna say with a straight face that it's a "mistake".

How is running a bot to change copyright notices a /mistake/?

> Full disclosure: I work for MS

It is difficult to see the reality distortion field you are in from the inside.

This breaks several of the HN guidelines and crosses into personal attack. We ban accounts that post like that, so please don't.

https://news.ycombinator.com/newsguidelines.html

I used to work for MS and... it's still easy to see it from the inside lol

when $new_repo in $msft_github: echo $standard_license > LICENSE.md

Could just be normal practices, and doesn’t check if a license already exists because it’s usually handling non-forked OSS repos. What’s the phrase? “Never ascribe to malice that which is adequately explained by incompetence”.

The difference is, most engineers I know respect and understand licenses. If you work at Microsoft - a software company - you should too.

Respecting a license is completely orthogonal to the unintended behavior of an automation used on something it wasn’t really meant for (fork rather than a new repo)

This is the peril of the imaginary "corporation" identity. People expect a company to be one coherent and consistent entity, but although a company can be managed well, establish culture and processes, and progress towards cohesion, it can never become as coherent as one person. And a person is not that coherent in the first place.

I am sure I subconsciously make the same mistake when I think about other companies. But I am making conscious effort to get better, take a more forgiving view on the humankind and give people as well as corporations chance to try again and be a better version of themselves, build the mental capability to remember that corporations are comprised of real people, and people make mistakes, and reasonable people who make up the majority of the population are constantly seeking (just struggling) to be better versions of themselves.

Ok. I worked at MS from 2005-2015. As I recall, there was this huge formal legal process and due diligence around including a single line of open source code. Is that not still the case? Am I remembering it wrong?

Github changed everything. All sorts of automation and open source involvement happened, with new bots and systems.

You have to take "companies doing good" always with a grain of salt. They're profit seeking companies, who act aggressively in their own interests.

It doesn't have to be a debate on "good vs evil" I've always hated those terms applied in these contexts, it's childish and for the naive. Fix the problem and move on.

'Profit-seeking companies' begs a common pejorative that actively reduces the variety in the pool of companies. It may not be descriptive of the companies for which this is not an overarching motivation. Many of them really want to make a happy customer by crafting as good a thing possible for the price they charge, and be well by their employees.

That said, I can relate the the cynicism especially for the giants. But painting them all as 'profit-seeking corporations' may deaden a satisfaction that comes from being a customer for a company you believe is good.

A company is merely a useful legal and organizational fiction. It's all people all the way down and those people don't act in a different moral context when they act on behalf of a company.

Microsoft is a rather special case of a company that has virtually no goodwill in the open source world. These are the dividends that result from statements and actions over decades. So when something like this occurs, the default reaction is often 'of course... it is Microsoft after all'.

Few people are likely to know <insert employee here> but many people are very familiar with decades of bad behavior undertaken by Microsoft not as isolated misdeeds but as a matter of policy. Lacking personal context misdeeds or mistakes are extremely apt to be interpreted in context of literal decades of bad behavior by Microsoft.

I mean come on the seismic change in leadership at Microsoft is just former lower echelon leaders during the time frame that MS was doing wrong now moving up and taking the helm.

We are after all talking about the company that tried to destroy the competition by funneling money into a fraudulent lawsuit/pr campaign that was a front for a pump and dump. The only thing separating MS leadership and felony charges is meeting notes between them and SCO and the fact that important people don't go prison in the US if can at all be avoided. Lest we forget the current CEO was at this time an executive VP as well.

Maybe it boggles your mind merely because you yourself are an ethical person who comports themselves properly professionally and would want people to see your efforts good and bad in context of who you are. This is entirely reasonable but people don't know you personally whereas your company makes headlines for bad behavior.

If you had a history of behaving as badly as Microsoft, I'd be as harsh on you as I am on Microsoft.

But when someone at Microsoft makes a mistake…

For many it’s not just Microsoft. Many assume negative intent from others most of the time. It much be such a frustrating, draining way to live.

I am finding it hard to accept that it is an honest mistake.

From my personal experience, every software engineer that works in a company of this scale is obligated to take a training course on software licensing and understand the differences, and the "dos and don'ts".

If Microsoft doesn't have such a program in place then that's a big problem and should expect harsh criticisms when such events take place and if they do then it probably needs to be revised because it doesn't seem adequate.

On the other hand, outside the context of MS, if a software engineer doesn't feel they are doing something dirty as they are replacing the license or the thought of I might get in trouble with legal doing that doesn't cross their mind, then they probably shouldn't be allowed to be at the front line taking actions that represents the company's name.

It was a bug in a bot, not someone deliberately changing the license.

Along similar lines as my comment here: https://news.ycombinator.com/item?id=29684127

...Given that several engineers employed at Microsoft have been part of armchairing this along everyone else now, why is not one of y'all (not necessarily you but come on, this is getting absurd, holidays aside) still just busy discussing around it rather than spending the <5 minutes required per repo to start actually fixing the fallout of it?

if I did this to microsoft do you think I’d be granted the same leeway? could I tell them they need to cut me some slack because i’m one person and “there’s a process”?

It's a bug, but it's also an example of what I think of as differential accountability:

* Bugs in the bot inevitably assign ownership to the writer rather than from the writer.

* Bugs in the billing system invariably overcharge customers

* Bugs in the image recognition system invariably select white people.

Well-meaning people still follow their incentives. Corners have to get cut somewhere.

I totally agree this isn't specific to MS. We have seen the enemy, and it is us.

This isn't true – the only billing system bug I've seen undercharged. Also if it was an overcharge, they would have made customer whole, whereas they wrote off the undercharge.

Microsoft doesn't really gain anything here – there's a clear "forked from" qualifier in the repo, they aren't republishing these packages, etc. The only people who noticed noticed in a negative light.

I believe "moral hazard" is the term of art for what you describe.

I'm just curious, is Microsoft actually in violation of the MIT license here?

All future changes to this repo are copyright Microsoft, so Microsoft's copyright should be in the statement.

Arguably there should be an additional statement indicating that LesnyRumcajs holds copyright to bits of code that Microsoft hasn't changed.

But

(1) exactly which bits have LesnyRumcajs's copyright would have to be verified by examining source control history. Since LesnyRumcajs's copyright statement is visible on any commit where LesnyRumcajs holds copyright, this setup makes actually makes it easy to verify which portions LesnyRumcajs has copyright claims on.

(2) Including LesnyRumcajs's copyright statement in repo history seems to be all that the MIT license requires. The license doesn't forbid there being another more easily accessible copyright notice that doesn't list all copyright holders. It only requires that LesnyRumcajs's statement be included in all copies of the software, which it currently is.

What you're saying doesn't make any sense. If what you're saying was true you could take any MIT repro, fork it and replace the license with a fully proprietary copyright claim or any other license. You absolutely can't take code and just change the license to anything more permissive without the original copyright holders permission.

It's definitely the case that at a given snapshot of the repository which has copyrighted code owned by someone else the copyright notice has to be there at that same revision.

Microsoft has lawyers and more layers of management than grandma's lasagna.

MS and other bigcos have a history of being evil. It’s the correct assumption.

> I know hundreds of people and most of them are upstanding and try to do the right thing.

How can you work for Microsoft AND do the "right" thing? I guess it depends on your role, but still...

Folks who work at mega corporations with outrageous amounts of power have a correspondingly large responsibility to the communities they interact with. Their mistakes have a much larger impact. Honest mistakes by hugely powerful entities are not mere trivia. They have an effect on the rest of the world commensurate with their power. Thus they should be held to a much higher standard than everyone else.

It is reasonable to have different expectations from large corporations with enormous resources than you would have for an independent developer.

The road to hell is paved with good intentions.

I highly agree with this.

Everytime I've taken the route that there is some evil, no good as come out of it but when you give a group of people the benifit of the doubt, I would argue the majority of the time it's just a mistake.

I feel like the only people with an attitude against Microsoft these days are teenagers trying to look edgy and critical thinking or pretending they are insiders.

I don't work for Microsoft.

There is not an attitude for the whole thread. Understandably you feel defensive but there is no need to.

If you care about this issue, try to get it fixed within your company and move on.

You can't ascribe one attitude to a thread of hundreds of commenters and then shame us for ascribing an attitude to a company.

A third way: individual people can make an honest mistake and Microsoft is still evil.

You should see how HN would react if Google has done anything remotely close to it. If it was Google your comment would be downvoted to oblivion instead of being the top comment. Not to mention you'd be disparaged for protecting your employer.

Y’all are not entitled to the benefit of the doubt any more than obviously-evil companies like Facebook are.

We've banned this account for repeatedly breaking the site guidelines and ignoring our requests to stop (most recently https://news.ycombinator.com/item?id=29501677).

If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. They're here: https://news.ycombinator.com/newsguidelines.html.

We particularly don't want the online callout/shaming culture here. nhttps://hn.algolia.com/?sort=byDate&type=comment&dateRange=a...

For those of us that remember the “old” Microsoft, they are still obviously evil. Nothing they have done will change that view. Incidents like this prove that this zebra cannot change its stripes.

Never. Trust. Microsoft.

Yeah, get that promotion! Developers, developers, developers!

I think your comments does not add anything meaningful to discussion. Yes, Microsoft screwed up. Yes, a Microsoft employee is trying to make excuses for them. This does not mean we couldn't have a civilized discussion, though.

Posting like this will get you banned here, so please don't. It's not what this site is for, and it destroys what it is for.

https://news.ycombinator.com/newsguidelines.html

I don't think that just because some "bot" did this Microsoft is to be excused. Someone decided that using a piece of software to automatically alter license files. This is a genuinely stupid idea. And they already fucked up in the same way with the CUPS project. Will they learn without someone taking them to court over this? I don't think so.

I think people should be as forgiving as Microsoft would be if someone “accidentally” changed the licence of Microsoft software and started distributing it.

My copy of Daz's Windows Loader accidentally activated my Windows pre-upgrade.

It was just accidentally run in a script. No worries right?

The license on something that was already open source?

The bot's job was to get MS-originated repos onto the correct standard license for MS open source code. That forked repos got their license changed is an unintentional bug, not something anyone "decided" to do.

An unintentional bug that keeps happening. The correct remediation is to disable the bot or feature until it stops violating the law.

> Someone decided that using a piece of software to automatically alter license files.

That doesn’t seem to be the purpose of the bot. It’s supposed to add them to new repos, not alter existing. This ensures that all their projects have an explicit license rather than ambiguously public.

> Will they learn without someone taking them to court over this?

Only on hackernews I see this level of crazyness. You need to reduce your caffein intake drastically.

This sort of attack will get you banned here, regardless of how right you are or feel you are. If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it. Note this one:

"When disagreeing, please reply to the argument instead of calling names. 'That is idiotic; 1 + 1 is 2, not 3' can be shortened to '1 + 1 is 2, not 3."

and this one:

"Please don't sneer, including at the rest of the community."

People on HN are completly crazy and uneducated... Whenever there is something like this you can be sure you will find hundreds of insulting or mean comments on the commit or PR... It gives a really bad image of the community.

1) bot changes license

2) bot2 takes data for copilot

3) we are "sorry" for bot 1

4) bot2 took data

The relevant Reddit thread also points out that MSFT has illegally relicensed Apache licensed Apple software in the same way. Apple is very litigious…

https://github.com/microsoft/cups

I created an issue in the original cups repo: https://github.com/OpenPrinting/cups/issues/315

I was contemplating a PR with original license, but your course of action is much better.

I guess this is grounds for a valid DMCA take down? They are obviously breaking license agreement, effectively stealing copyrighted software.

It looks like Jeff Wilcox who seems to be in a decision making position about this has addressed this (on Christmas no less), and I think whilst this is bad and definitely violating, I don’t think there was any ill intent, and I hope we can all put the pitchforks down for a while.

I observe some confused comments on this page that seem to argue that the MIT license doesn't come with a requirement to keep the copyright line intact (which is demonstrably false, you don't get two paragraphs into the license without finding the attribution requirement).

The part that caught my interest is: How many people consciously picked the MIT license when they actually meant a non-attribution license?

I think most people explicitly choose MIT for this. It's a very very free license, allowing you to do pretty much anything you want with the code. Among the opensource developers I know the one thing they consistently care about is attribution for the work they've done for free.

I like your last question. Can you give an example of a "non-attribution license"?

So sure, this is far from a good look. But the verdict is still out on if it is an unfortunate mistake or malicious.

It's far from the first time I see this kind of reaction and, IMO, rather than everyone spending time on piling on the flamewar, how about opening the door for MS to set this straight and do the right thing? Assume good faith even if you personally don't sincerely believe it? Give them an easy way to save face and present a plausible narrative rather than having everyone dig their trenches deeper? If you'd prefer MS not to screw people over, it helps no one to solidify them in doing just that.

Already so many people shouting "YOU ARE THE DEVIL", not one going "hey, looks like this is a mistake, let's sort it out". IMO the latter is more constructive. It's almost as if people want Microsoft to do bad things. Remember it's a huge organization with all kinds of people and ideologies internally. It's too early to tell which way the individual behind this particular change is leaning.

It took me all of 1-2 minutes to make this PR[0], probably less than any of the meme pictures in that commit thread. Let's see how it goes. Last time it went through[1].

[0]: https://github.com/microsoft/grpc_bench/pull/1

[1]: https://github.com/dotnet/sdk/pull/22262

EDIT: ...And, it's merged. I'm assuming the rest of the affected repos will be fixed as well and an apologetic blog post issued by Monday. Anyone who feels that's too long time can always open corresponding PRs instead of wasting their time by replying to this with how that's not our job. Happy holidays.

Another aspect of this: Rejecting such a change, or indefinitely leaving it hanging as open, is a much worse look than simply ignoring all the complaints (which is already bad enough but has more plausible deniability). Providing a ready-to-merge PR is effectively pushing them to take a public stance.

Seems like it's probably a mistake, did you try to contact them? https://opensource.microsoft.com/ https://twitter.com/OpenAtMicrosoft

Contacting Microsoft is always a mistake. They don’t want to hear from anyone and their process reflects this.

1) What's your source for that assertion

2) Assuming it's even true, what should this person do instead?

3) What do you think the outcome would be if this person did contact Microsoft? Since it's a mistake, I assume something bad?

A 'mistake' they are actually doing since a long time now. Here is the cups equivalent with a license change from apache to mit for the CUPS system.

https://github.com/microsoft/cups/commit/ad69bcc78bdea3fea3f...

Why the scare quotes around mistake? Are you implying that it's intentional? Or negligence? It seems like nobody noticed the CUPS license change until now, so it's irrelevant, right?

MS dev here. I contacted the internal repo owners to bring this to their attention, people may be out for the holidays but I expect it to get fixed up soon.

Seems like a mistake to me. Microsoft recently adopted one of my Open Source projects and part of the agreement was they would keep the original license. This was a request on their part, I had no choice in the matter. They know what they're doing, I don't think they would do this deliberately. (Licence here: https://github.com/microsoft/vscode-gradle/blob/main/LICENSE...)

Microsoft is not a person. And, by its size, is not a single entity with homogeneous values and procedures.

You interacted with one part of Microsoft, maybe we are seeing the works of another part.

The account which did the change has this description:

> This is the open source management service account used for performing key GitHub operations on behalf of Microsoft employees and users.

Combined with the nonsense README change, this looks like a bot mis-use accident.

Edit: to clarify, in no way am I saying that this is a "honest mistake" which does not deserve scrutiny.

I would't call a honest mistake some bot that is created to change code to a MS license. First of all, this kind of thing needs to be done after careful review, if they're doing it in an automated fashion there is almost the certainty that they'll take somebody else's work as their own.

Which is fine, and surely an honest mistake. Automation is great, but the way I see it is, how many other projects have been forked and automatically re-licensed, and then profited from without proper attribution? An accident still needs to be flagged, and still needs to be corrected. They also need to be learned from and avoided in the future.

Ok, but this is still illegal, right?

This is very obviously a mistake and I don’t know how can anyone assume otherwise.

No judgment from me since I suspect it is also an accident and I’ve made enough in my life that I don’t get super judgy in most cases. But what purpose is there for a bot that forks and makes changes like adding template files? Copyright aside, I don’t understand the value of this bot.

This is a clear violation of the MIT License. MSFT can and should get in hot water over this. The copyright doesn’t belong to them, just a license to use the software.

They’ll be in hot water on social media because of a the automation mishap. Then it’ll be corrected. There will be no legal hot water.

Since they also removed a full stop at the end...

What is the point of using all caps? For me it makes legal texts like these really annoying to read. I'm not a native English speaker, is that really correct English writing? Aren't there clear rules when to use capitalization? Like, at the beginning of sentences. Feels like they are abusing the language.

Can they just lower case the paragraphs, to make things more convenient to read? Or does that change the legal meaning? For me it would feel like they would stop screaming :-)

Apparently it comes from commercial codes from the ‘50s, which says that important text must be conspicuous [1]

Conspicuous could mean all caps, contrasting text, or different colors. My guess is that CAPITALIZATION was used because most typewriters at the time could do caps, whereas doing different font sizes, colors, bold would have required a special expensive machine. When technology evolved, lawyers being process oriented creatures, stuck with all caps because it was the way things were always done, and therefore safe to do.

[1] https://www.termsfeed.com/blog/all-caps-legal-agreements/

https://www.termsfeed.com/blog/all-caps-legal-agreements/amp...

It’s legally important

There is a rampant practice where companies and organizations flippantly and often fraudulently stamp copyright notices on everything they touch—including public domain materials such as the U.S. Constitution, works of William Shakespeare, prints of the Mona Lisa, copies of the 9/11 Commission Report, and compositions of J.S. Bach. [0]

It seems Microsoft has now automated this practice.

[0] http://www.copyfraud.com

Edit: It's easy to jump the gun and start accusing Microsoft of something nefarious here. To be clear, I'm personally giving Microsoft the benefit of the doubt and assuming that this was an honest mistake, and that the folks at Microsoft who had something to do with setting this up were well-meaning.

My point is that we're living in a culture that, as a standard practice, sprinkles "(c) [year] [company]" on things like salt, that such claims are frequently invalid or misleading, and that this broader issue may be partly to blame for incidents like the one we are discussing today.

Could be it got caught by mistake?

I know I can run "Update Copyright" on my projects in JetBrains - could just be an innocent mistake that hit the wrong folder.

I know everyone jumps on the big corp as everything they do is intentional, but it's the holidays, someone was doing a bit of work, maybe not fully concentrating and hit push.

Seeing how quickly this was plastered everywhere, and the responses to it, do you really, like REALLY think that this is a deliberate play?

Is this the commitment, Microsoft shows towards Open source. Things never change.

This is a perfect example of a huge company using the cover of bullshit to do whatever they want.

"Oops. We f*d up? Well, you can't talk with a human unless you pay us lots of money. Oh - you don't have money for a lawyer? Tough. Good luck getting through our layers of trained monkeys."

It’s fixed

https://github.com/microsoft/grpc_bench/pull/1/commits/30561...

Reminder: if you want to protect your software or your community from similar issues you can use [A]GPL and let Free Software Conservancy handle any legal battle on your behalf:

https://sfconservancy.org/copyleft-compliance/

Yeah, everyone has a second chance but Microsoft has had n-th chances.

Make no mistake, gravity will always pull MS towards their default behavior. Just wait for VS Code becoming a subscription-based product.

Yes, there will always be a community maintained project. But it will not be MS Certified…

Someone has pushed a button and it's run the equivalent of cookiecutter on the repo.

Original author could send a DMCA, or they could simply enjoy Christmas and assume a ticket will undo this sometime in January.

This, the reason why we have the DMCA is to protect copyright holders, now the copyright holders should exercise their right.

What? no, this goes entirely against the idea of laws.

Copyright laws have one major purpose: protect the right holders. It does so by giving them tools to mitigate their loses by deterring people from infringing.

If a right holder has to invest more time in complaining on people about infringement than actually having time to do other stuff, like creating, then we've got it all wrong.

Someone did this at an university. They replaced my name in the MIT license with the name of the institute. After I let them know that this is not OK, they reverted it.

It seems people are outraged because they don't like it, but they don't seem to be talking about whether it's actually legal.

IANAL, but the MIT license specifically does not say you have to redistribute with the same copyright owner notice. It says the copyright notice and terms must remain, and that you can sublicense it. It doesn't say you can't change the copyright notice.

Probably just a setting in someone's IDE or a bot that they didn't understand what it was doing.

Makes me wonder if Microsoft GitHub should not make it a more specific action to relicense a repo.

That would solve any ambiguities around the script Microsoft wrote.

"Are you sure you want to change the license?" Yes / No.

Perhaps a specific API call when you are doing it with a script.

A PR reverting this is already approved and merged: https://github.com/microsoft/grpc_bench/pull/1

Thanks, 3np

The repo page still has:

> This repo has been populated by an initial template to help get you started. Please make sure to update the content to build a great experience for community-building.

Perhaps this is "updating content"?

Hey, why are the comments repeating on the page? Is this a UI bug?

What's surprising to me about all the negative reactions Microsoft receives, especially on here, is that from my point of view, they are currently the most open out of all the big companies (Google, Facebook, Apple, etc). I cannot remember a time Apple has admitted to anything or made any effort to have anything that could be considered open, but they do no wrong in most people's eyes, where even a simple mistake by Microsoft gets turned into some nefarious narrative.

Please, Google contributes far more to open source than both. Between Chromium (which seemingly most other browsers are based on now as well as things like VSCode) to Android, GSoC, Golang, Dart/Flutter, the Linux kernel and a bunch of other random stuff, Google has probably done as much or more for the open source ecosystem than pretty much anyone.

Pretty much MS' only useful contributions to open source are from MS Research, everything else feels like a Trojan horse, designed to make you like them and then lock you in to something proprietary later.

Lots of plugins don't work on open-source VSCode, they tried a bait and switch with .NET features, Windows 11 has a bunch of anti-patterns, GitHub is being dodgy about how they train Copilot, etc...

Perhaps I'm the one misinterpreting your comment, and the others have it right.

I'm assuming you mean open as in communication. Apple basically is a stone wall, facebook just spouts empty platitudes, google processes are opaque and unyielding (unless you know a someone or raise a massive community response on social media), but Microsoft continues to be staffed by humans.

They aren't a shining pillar of FOSS, but they've taken some good steps in the right direction in the past few years. And of all of them, user feedback, support, and escalation seems to still be handled by people instead of algorithms

Releases of all open source things Apple uses, by OS: https://opensource.apple.com/releases/

These mostly link to repositories under one of their GitHub organizations: https://github.com/apple-oss-distributions/

Apple's open source projects: https://opensource.apple.com/projects/

Which mostly link to repositories under their main GitHub organization: https://github.com/orgs/apple/repositories

> ...from my point of view, they are currently the most open out of all the big companies (Google, Facebook, Apple, etc)

I'm curious to know how you're measuring openness. I agree Apple is the least open of the group, but Facebook and Google owe their existence to FLOSS, and were always in harmony with it from their origins.

> I cannot remember a time Apple has admitted to anything or made any effort to have anything that could be considered open…

This was a while back, but Tim Cook apologized[0] after a poorly received rollout of Apple Maps. That said, I applaud this response and agree that more like it is needed across the industry.

[0] https://techcrunch.com/2012/09/28/tim-cook-apologizes-for-ap...

Google contributed the enormous k8s to the community, which has thankfully made Microsoft's proprietary Service Fabric mostly go away.

Apple have caught huge flak recently e.g. for the phone-local image scanning software.

what surprises me the most about Microsoft related hate is that, despite the fact that they had (still have pretty much) control over the OS market they never locked their system down or charged people in any capacity.

People take it for granted that you can just run what you want on your windows machine but they could have turned it into smartphone style locked down system. Imagine if every app developer in history had to fork 15-30% of their sales over to Microsoft just for building on Windows, they could have made a trillion bucks or something.

Literally half the operating system is open source macOS, they have an entire site dedicated to it. opensource.apple.com.

Oh and don't forget googles ridiculous amount of effort poured into Android open-source source tree, just to name one of many.

I honestly can't tell if you are trolling here or not.

Apple is active in their OSS work although, if you go look at their OSS project forms and such. Look at webkit, swift, etc.

We detached this subthread from https://news.ycombinator.com/item?id=29685852.

Yes they are still working on world domination and needs to act kind and responsible, unlike Google and Apple that is ahead of them.

If Microsoft had the most popular search engine and the most popular mobile operating system, they would be gathering all our data and putting ai robots to answer our questions.

These big tech companies do not have the best interest of us in mind. They are a force for centralization of power into the hands of billionaires.

It doesn't have to be this way but it requires users to smell the coffee and want another Internet and another big tech industry.

Can it be identified only in a PR or is there any tool that can search through all forks? Maybe it’s too small problem to solve though.

To quote Thomas Jefferson, "eternal vigilance is the price we pay for liberty".

Did the original author agree to give their project over to Microsoft?

So you can't do that? I do it all the time when I fork something.

Correct. You don’t own the code just because you forked it. The original copyright holders retain ownership, and you must abide by their license. You can’t swap out the license unless they explicitly allow you to do so.

One can add their copyrights, relicense in some cases, but absolutely cannot remove existing copyrights. I don't think any FOSS license (save for the "public domain" ones) allow for that.

You need to go revert all of those commits ASAP.

EDIT: also if there are any forks of your project, you should ask people who forked it to restore the original copyright notice as well. If the original copyright holder sees your name instead of theirs, they'll know who to sue.

That can get you into seriously hot water, I would suggest you stop doing that until you've had some interaction with an IP lawyer.

Hey if anyone considering down voting this guy - it is important question as a lot of people might not understand those things.

I see it as a honest question.

Instead of voting down, vote up so more people can read replies and see that it is not something that should be done.

Maybe read the license before agreeing to its terms.

You (or possibly your employer) own the copyright to the code you produce. And you are fine to say something like "copyright $me $yearIMadeACommit". What you can't do is claim copyright on work you did not produce or remove existing copyright notices.

Free or open source licenses aren’t a lack of copyright. They are an exercise of copyright. All of that code that you didn’t write is still copyrighted by their original authors. You simply have permission to use it under the criteria outlined in the license.

No, you cannot.

I'd advise you to fixup any forks on GitHub, e.g. https://github.com/fiatjaf/jiq/blob/master/LICENSE, which are currently in breach of license.

You'll need to inform anyone who forked your code, too.

This is something you agreed to in the following part of the license:

> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Sure this might be an innocent mistake, but if you were to infringe a nanometer on Microsoft intellectual property, never in hell would they be like „oh an innocent mistake, we don‘t sue you into oblivion then!“

Oops, a bot just removed bandwidth limits for Windows source code on a bittorrent seedbox.

I was asked to run out Intune on Android [0], which is a Mobile Device Manager from Microsoft, (aka MDM) [1].

We needed an always-on VPN. Intune supports several, but all insist you run some proprietary server software. If you don't understand why that would make someone feel uncomfortable, PulseSecure [2] was one of those options. There is open source GPL software that replaces the proprietary back ends called OpenConnect [3], but that violates their client licensing.

Then I discovered Microsoft has their own VPN called mstunnel. That's when I felt like I had fallen down the rabbit hole. I dismissed mstunnel initially because since it is a Microsoft Product, it would run only on Windows, right? Turns out it only runs on Linux. I thought you installed the mstunnel client on Android, because among other things it existed - but nope it was superceded by this thing called "Defender for EndPoint".

The server came as a Docker install, but we didn't have the required version of Docker so I unpacked it and ran it in a chroot. That all worked in the end, but in the process of unpacking it I discovered what it was under the hood. It had two things - an "agent" written in dotnet whose sole function as far as I could tell was verify with Microsoft's servers you have paid for it and ... a copy of free as in beer OpenConnect.

Nothing wrong with that really. In fact it's the reverse - it being OpenConnect under the hood gave me a lot of confidence I wasn't dealing with another PulseSecure. The only fly in the ointment is OpenConnect is GPL. They are completely free to use it the way they did - in fact I suspect the OpenConnect authors would be very happy to see the project used in that way. But you do have to comply with the licence. There was no attribution whatsoever, let alone instructions on a copy of the source as the licence requires.

I'm sure it's just an oversight, just like the subject of this article. Maybe it's another mess for Jeff to fix. I don't know you from a bar of soap Jeff, but keep up the good work.

[0] Intune provides a uniform MDM like experience across many platforms - including Windows. If you need to control Windows like that you probably don't have much choice, you have to use a Microsoft product. Maybe it works very well on Windows, but it's an ugly, buggy thing on Android, and the UI is a confusing mess. If you only need an MDM for Android I can heartily recommend headwind (https://h-mdm.com/), which we rolled out before Intune because it took literally months to get the licences (in fact, we still don't have them). Headwind is open source, is cheaper than Intune and has free tier, and frankly was a joy to work with - once you discovered their doco was all in the FAQ's.

[1] For the uninitiated, all Android devices (and iOS) allow a company to take control of a device by installing an MDM, something that can happen only immediately after a factory reset. Thereafter Android displays "your company can see everything you do on this device".

[2] https://threatpost.com/pulse-secure-critical-zero-day-active...

[3] https://www.infradead.org/openconnect/

Ok Jeff

We forgive you...

;)

Microsoft

The larger issue is that anyone using GitHub is donating their work for re-use without attribution through Copilot.

In return, you receive hosting from GitHub.

The writing is on the wall. You MUST host your own code on a stand-alone website.

Here is an example. This Go program (a compiler) generates and serves its own website: https://NN-512.com

It runs on a Linode shared CPU cloud instance that costs $5 per month: https://www.linode.com/pricing

Another example, look at what Fabrice Bellard does: https://bellard.org

That "issue" is unrelated. You've just hijacked the thread to talk about it.

Also the point you're making is controversial, and definitely isn't widely agreed on. As a human, I can read public code on Github, and use my internal neural network (brain) to regurgitate sections of code, and don't need to attribute anyone (who can say which codebase I'm recalling code from? I certainly can't). So a neural network doing the same thing, but external to a human, is certainly questionanble, but it isn't a cut-and-dry case of copying without attribution.

> The larger issue is that anyone using GitHub is donating their work for re-use without attribution through Copilot.

Wrong. Lets say a GPL project is not hosted on GitHub officially. I can easily setup a mirror for it though on GitHub as the GPL doesn't prevent me from doing it...

Point is that anyone can put my work on GitHub, even if I don't want to.Assuming the project is under a free license though.

To be honest, can't humans go through various open source repositories and copy the bits they like?

If you don't like that,don't release your code as open source. I'm not going to host my open source projects on my own website. That's just hard, it's much more difficult to get people to check it out if it's on Broblog.net

I personally don't believe extremely short code snippets, like the ones copilot tends to copy are problematic.

If you treat copilot like a human, and you ask it a question ( like "#find median of list") that human either (A) will put together all the things they've learned over thousands of hours of simply looking at code in the programming language and how the syntax works, then provide a new code block, or (B) remember "oh, I remember this extract string of text and what comes after it. Here's the next 10 lines from that snippet". In that B scenario, would the human be infringing on the original's copyright? Arguably yes; but is situation (A) also copyright infringement, or is it like getting code help from a friend?

In these situations, whether it be originating from a human or robot, the knowledge comes from looking at public code on GitHub and it's always been a risk that your public code might not be used with proper attribution at some point. Think about how many OSS projects have core code and algorithms copied daily by companies with no public name and keep all of their source code private - it's surely caused more damage than CoPilot ever will.

> The writing is on the wall. You MUST host your own code on a stand-alone website.

Even if Microsoft currently only uses GitHub-hosted code as an input to Copilot, their theory of the legality does not depend on code being hosted there and applies to any code they can get their hands on. The idea that hosting code publicly at some non-GitHub location is going to keep it out of Copilot is not well justified.

> The writing is on the wall. You MUST host your own code on a stand-alone website.

How would self hosting your code prevent Microsoft/GitHub from using it in the Copilot training dataset? If using content from GitHub irrespective of their license to train Copilot is legal, so is training from code available on your website.

> Here is an example. This Go program (a compiler) generates and serves its own website: https://NN-512.com

Not a very good one - clicking the link produces a download dialog on Firefox (I'm guessing because the website neglects to indicate a Content-Type).

Ironically this is an argument against trying to do everything yourself - you might waste time chasing the long tail of thousands of little details that had been solved many times over elsewhere.

> The larger issue is that anyone using Github is donating their work for re-use without attribution through Copilot.

I think this can only be valid of Github's terms of use clearly specify that or the chosen license allows it.

I actually see copilot benefiting GPL projects: suppose a programmer uses copilot to develop a proprietary software and copilot regurgitates GPL'ed code: now the proprietary software is a derivative work and must be GPL'ed too.

How does your license prevent someone redistributing source code over GitHub? What does copilot claim as far as licensing rights beyond fair use?

You may be practically limiting copilots use of your code but I don't see any licensing difference if Microsoft hosts Copyright code or scrapes copyright code.

This seems to be the new reality. Sad we get fooled over and over by the same companies.

Anyone who puts anything on the web is at the same risk. For example, ask Google how old Queen Elizabeth is [1]. Google tells you the answer in a big font at the top of the result page. Google sourced the answer apparently from usnews.com but you didn't even have to click the usnews link. Google "took" the answer from them and deprived that website of a click.

So yeah, you are donating your work to Google when you put it on a publicly accessible web site.

[1] https://www.google.com/search?q=how+old+is+queen+elizabeth

The following is pure conjecture with zero evidence:

I think that’s on purpose, not to “steal” code from GPL’ed softwares’ authors, but to get GPL’ed code into commercial projects. Then Microsoft can say “oops, we were right all along! The GPL is so dangerously viral that you can’t even host your software on the same server!”

I know that sounds stupid, unless you were there for the Halloween Documents. After all these years, it seems to me that Microsoft hasn’t done the 180 they portray.

I'm including licensing notices in several of my private repositories to prevent inclusion in ML training data sets.

I might put this in my public ones as well.

This is a feature in fossil since the beginning. And fossil is good enough to be used by sqlite, it could be used by other projects.

"Not Github" is also a good place to start.

I am a happy Sourcehut customer. Roughly the same cost as a VPS, but comes with tech support.

Is the copilot thing true for paid accounts as well?

is it possible that microsoft bought the rights to the software

The original copyright holder claims on reddit[0] that it was forked, and there doesn't seem to be any implication of buying the rights to the software.

[0] https://www.reddit.com/r/opensource/comments/roa9xz/microsof...

This comment shows they've done it to other pieces of software, including things like… CUPS: https://news.ycombinator.com/item?id=29684567

For some reason I doubt they've bought the copyright to CUPS.

How did it used to go?

Embrace, Extend, and Extinguish

But now not even bothering with the extend. I’d guess this is a mistake of some kind.

Dismiss, Embrace, Extend and Extinguish - if I remember the early histories of Netscape and Java accurately.

I didn't think code was copyrightable in the first place.

Any work, no matter how trivial, is eligible for copyright as long as it is an original artifact with a distinct identity.

This might be true about trivial pieces of code, which this one is not

They changed the copyright holder on this fork, but left the MIT license in place. How does this harm anyone?

It violates the license that specifically says (IANAL):

> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

It looks like Microsoft developed this all along. Yes, git keeps history, but it's unethical and ugly to begin with.

Also, I'm not sure you can just change the copyright information, and change the history of the code like that.

However, this is typical of Microsoft. Like DOS, like Windows App Store / Packaging ripoff (they asked the guy some questions, sherlocked his software, even didn't thank him later), etc.

>> They changed the copyright holder on this fork, but left the MIT license in place. How does this harm anyone?

Here you go:

https://github.com/microsoft/TypeScript

Just fork TypeScript, change the copyright holder to yourself, and do what you want with it. I sure Microsoft won't mind.

You can't own something by just saying you do!

Only the copyright owner can license the work to others, or issue under a different license if they like.

They copied a copyrighted work in a way that was not permitted by the copyright holder.

that’s still breaking the license

Reply on news.ycombinator.com