Hacker News Reader

Comment by raphaelrobert | Hacker News Reader

I love that Kagi now uses Privacy Pass, and they look like a cool company in general.

That being said, they essentially took the IETF draft I worked on for a while [1] and also my Rust implementation [2]. They built a thin wrapper [3] around my implementation and now call it "Kagi’s implementation of Privacy Pass". I think giving me some credit would have been in order. IETF work and work on open-source software is mostly voluntary, unpaid, and often happens outside of working hours. It's not motivating to be treated like that. Kagi, you can do better.

[1] https://datatracker.ietf.org/doc/draft-ietf-privacypass-batc... [2] https://github.com/raphaelrobert/privacypass [3] https://github.com/kagisearch/privacypass-lib/blob/e4d6b354d...

View on HN

Honestly, I think what TFA calls "Kagi’s implementation of Privacy Pass" is the integration of the feature into their server and clients, not the RFC (which they acknowledge), or the protocol implementation.

[I work at Kagi]

Indeed, this is the intended interpretation of "Kagi's implementation of Privacy Pass" - we're talking about building out the server infrastructure, the UX, the browser extensions, the mobile applications, the Orion browser integration, the support and documentation, the Tor service, etc. The cryptography is obviously an extremely important piece, but it is far from the only piece.

As other commenters have noted, the code in question is MIT licensed [1] and we're pulling it in as a standard dependency [2], it's not like we've gone out of our way to obscure its origin. The MIT license does not require us to do anything more.

That said, I can understand the author wanting more visible attribution, and that's very reasonable, we'll add a blurb to the blog post acknowledging his contribution to Kagi's deployment of Privacy Pass.

[1] https://github.com/raphaelrobert/privacypass/blob/main/LICEN...

[2] https://github.com/kagisearch/privacypass-lib/blob/e4d6b354d...

Understood, and thanks for updating the blog post. The discussion in the comments was interesting, and I'd like to clarify a few points. From my side, there never were any doubts about licensing compliance. I picked MIT precisely so that folks can use the implementation without further obligations, I wanted the implementation to be as useful as possible. What startled me was the combination of a for-profit company writing a blog post about a new feature (that will likely further increase profit in the future), using my implementation as the core of the feature (and therefore likely save a bunch of money) and not giving any credit to either the IETF batched tokens draft or the implementation. Anyway, the blog post has been amended now – thanks for that. Case closed.

PS: If you want to go above and beyond, you can spell my last name right in the blog post – it's Robert, not Roberts.

> PS: If you want to go above and beyond, you can spell my last name right in the blog post – it's Robert, not Roberts.

That was on me, fixed!

So if they add “credit to raphaelrobert”, or a copy of your license to their code somewhere, Kagi will be compliant?

I’ve never had any of my open source software used, and I typically license it with MIT, so I’m curious how other groups and organizations actually comply with the license.

They are compliant, the code being used is under the MIT license.

Yeah I'm as big of a FOSS fan as the next guy on here but you really can't complain about how someone uses your code if you used the MIT License...one of the most permissive licenses in existence.

If someone wants attribution or something then they should use a license that requires that thing.

There’s a gap between what is legally required and what is common courtesy.

I’m under no obligation to thank someone for holding a door for me; if I fail to do so it does not mean that person should switch to a different door-holding license in the future. It just means I’m a bit of a jerk.

When lifting an entire (permissive licensed) implementation it’s good form to say thanks.

You're not wrong. But the door-holding example isn't really a good one because there's no such thing as a license for door-holding.

For FOSS, on the other hand, licenses are a well-established thing. And developers have free reign to pick a license for their code and they very commonly pick MIT...totally on their own volition. Which strips them of all privileges. It's like writing a book and explicitly setting it into the public domain. If that's what you want to do, that's great, but very commonly I don't think it's what developers actually want to do.

In the world of copyright, the long-standing legal default is for the author to own their work for a certain amount of time, whether or not the copyright is explicitly claimed. Because making public domain the legal default would be utterly insane.

I guess what I'm saying here is my beef isn't with entities that choose to be jerks—that's annoying and always gonna happen to some extent—it's more with the all-too-common decision to use the MIT License. And when I see people complain about it...I understand the sentiment but I also can't help but think that the folks complaining had it coming and it was totally avoidable.

I knew door holding was weak, but I think the principle holds. To me, it is reasonable to release under MIT with expectation of helping lots of people, and also to expect (not require) some credit if a notable company adopts kit and kaboodle.

Door holding falls under a social contract.

So does saying thanks. That was my point :)

I guess I kind of disagree. Some projects might pull in 50-800 deps, and then they will run on servers with utilities written by folks. Who are you supposed to thank and who not? You could literally thank thousands of people after writing a ten-line Python script.

I like that the Kagi folks stepped up and thanked you when you requested it, and I like that you wrote this code and made it available. But going around the internet trying to get explicit thanks seems more like the norm breaking here.

You can if they don't include the copyright header: "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software."

Which, as far as I can tell they haven't done. Their MIT licence claims their own copyright. No reference to the library used in readme.

https://github.com/kagisearch/privacypass-lib/blob/main/LICE...

https://github.com/kagisearch/privacypass-lib/blob/main/READ...

Usually when using apps that use MIT licensed libs they also implement a notice in a user-facing way. Google maps for instance has a (albeit hidden) section in their settings menu referencing at least one MIT licensed library.

They’re pulling it in as a dependency. it’s not a fork.

As soon as you run cargo build the source code will be fetched including the original license. That’s better than a settings menu with just a license!

Kagi isn't MIT compliant if they lifted code and removed the copyright of the original author (as claimed by OP) only to replace it with theirs.

https://github.com/kagisearch/privacypass-lib/blob/83c9be8cb...

Kagi's repository doesn't contain any of raphaelrobert's code directly. It's used as a library: https://github.com/kagisearch/privacypass-lib/blob/main/src/...

MIT licence explicitly requires maintaining the original copyright header, and licence.

>Copyright (c) <year> <copyright holders>

>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

>*The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.*

>[...]

Captured 14 Feb 2025 ~12:15pm EST from README header

> This repository contains the source code of the core library implementing the Privacy Pass API used by Kagi.

Yeah... that doesn't feel great. Though I do think the folks at Kagi would be open to more accurately reframing that as "core library implementing a Crystal Lang wrapper for raphaelrobert/privacypass". It's likely unintentional, they were probably just focusing on getting it working and didn't get someone to reread this stuff.

Reply on news.ycombinator.com