Getting forked by Microsoft
philiplaine.com
philiplaine.com
A Microsoft director who ran a portfolio of product teams reached out to ask about a "collaboration". I said I'd be happy to send them my consulting agreement. There was a little grumbling about the rate but I just reiterated that it was my rate. After a lot of legal back and forth, they signed, I answered a bunch of questions for them in a 2-day workshop, and they paid.
If they want you badly enough, they'll pay. Don't work for free.
If the answer to the first question is "No" then you'll be very cheap compared to the second answer no matter how much you cost.
I usually came back with enough notes to save me at least a couple of weeks of work. If you know how to listen, talking to an SME can save you a ton of time.
And from what I understand Microsoft is good at planning interviews to sound like they’re extemporaneous while they’ve actually worked out ahead of time what questions they need to ask you to get what they want.
Note - maybe they don't pay you the developer sometimes, however.
Do not work for free. Large companies have a shit ton of money. All you need to do is provide an economical argument in the form of your rate (which should take into account their expenses for having an employee / team work on it instead, hint: 2 x total compensation). Getting paid is just a matter of the guy who reached out to you to talk to his skip manager to get a verbal 'ok', and then the accounting department takes care of it. They're not going to pass on you just because you asked to be paid for your time - a business is used to paying for services. If they do pass on you without even negotiating your rate, then they were definitely not serious and nothing good would have come out of it for you.
Source: dev working at FAANG with 3rd party companies.
just adding the point that the people who made them giants have all left by now, and the people they have now are incredibly good at internal politics rather than actual biz. You will probably find that they are more interested in how you can make them look good rather than how you can make their company money.
But yes, do not work for free. Large companies have a shit ton of money. Agree 100% with parent.
It was a sales call with a 2-person tech company building some tools in the cloud native space. They were super eager, walking through the product. My manager put the phone on mute and asked "So what are we trying to do here" to the other directors. They replied "We just want to kick the tires to figure out how they built it, we're not going to buy". They let these guys pitch for 20 minutes, periodically asking questions and then muting to mock them. My manager nudged me to ask something, since I ran a similar initiative internally. I asked how they would handle a gnarly case we had and they didn't have a solution yet, but could come up with one (super eager, wanted the deal).
At the end of the call, Gus un-muted the phone and said "This looks great but I'm having a hard time following the demo. Can you fly out and show us in person?". The sellers paused and then started asking when the other was free etc, one was going on vacation but could "make it work" to come out the next week. Gus replied "Great, see you next week".
I left that meeting realizing they were all psychopaths. Notably, Gus had the charism of Gus Fring from Breaking Bad.
Would you be willing to share what your rate was? I think it'd be useful for other FOSS maintainers to get a better understanding of their worth.
I may encounter this situation some day. Could you share how you structured your fees (and give the hourly rate you charged them :P) ?
This factored in my prep time, prototyping, flights (since I didn't live in Redmond, where this team was headquartered, and this was before video calls were more popular), et cetera.
We appreciate your leadership and collaboration on Spegel and see your project solving a real challenge for the cloud native community. I wanted to thank you for your blog post https://philiplaine.com/posts/getting-forked-by-microsoft/, let you know what we’re doing, and address a few points.
We’ve just raised a pull request https://github.com/Azure/peerd/pull/110 amending the license headers in the source files. We absolutely should have done better here: our company policy is to maintain copyright headers in files – we have added headers to the files to attribute your work.
I also wanted to share why we felt making a new project was the appropriate path: the primary reason peerd was created was to add artifact streaming support. When you spoke with our engineers about implementing artifact streaming you said it was probably out of scope for Spegel at that time, which made sense. We made sure to acknowledge the work in Spegel and that it was used as a source of inspiration for peerd which you noted in your blog but we failed to give you the attribution you, that was a mistake and I’m sorry. We hear you loud and clear and are going to make sure we improve our processes to help us be better stewards in the open-source community.
Thanks again for bringing this to our attention. We will improve the way we work and collaborate in open source and are always open to feedback.
I like the thought though
Maybe they should have 3-5 meetings before forking OSS projects though :)
I wonder how many other projects are not attributed correctly. Are you checking up on them also or just waiting for the next HN post?
That said, the author of Spegel should have used another license if he wanted more “recognition” or the like.
As I wrote in my parallel post (https://news.ycombinator.com/item?id=43756102): these copyright violations (not giving proper attribution of the license requires it is copyright violation) from Microsoft's side (the more, the "better", and the clearer the message) can be considered de-facto, implicitly stated corporate messages from Microsoft's side that they are from now on officially fine with copyright violations, and thus everybody is from now on free to violate the copyright on every software product that Microsoft has ever produced.
I mean they made sure to get all the consent from all authors on github before training on it right
Nope, "the revenge of Clippy" is doing the writing.
What would you prefer them do? A public flogging? Bring back the stocks?
I agree with the sentiment with these types of comments (I hate PR fluff too), but the aggression when a company has screwed up and not only admits it but tells you their plan going forward is silly. The best case scenario is it does nothing, worst case it encourages them to ignore it next time it happrns.
This was MIT licensed open source software and an attribution clause was not properly respected. Hardly piracy.
Nobody is expecting this one incident to make Microsoft change. It’s about reputation, which can take a long time to shift, but can be important in the long term.
We don’t have to just accept it when a company issues a statement apologizing for their screwup. It’s perfectly acceptable to say “this apology means little to me, and if you want your reputation to change you need to do more”.
They say:
> We hear you loud and clear and are going to make sure we improve our processes to help us be better stewards in the open-source community. Thanks again for bringing this to our attention. We will improve the way we work and collaborate in open source and are always open to feedback.
…which is a lot of nice words with absolutely NO accountability. They could write a sticky note “do better” and technically that’s all that’s required from their side. Is that okay with you?
Pretty sure their legal department would have my fork obliterated from the face of the earth and I would be crossing my fingers that all I got was a cease and desist letter instead of a lawsuit in Texas.
The TL on the project should have done better, but it was a good sign that they had originally taken the time to acknowledge Spegel's author's help. It's very likely that someone else dealt with the actual code and license text and didn't know any better.
The PR text is reviewed by lawyers. The default advice from lawyers is "do not admit any wrongdoing". They probably suggested that the license text be fixed silently with no apology. The PR department likely convinced them that a public apology would be good for optics and it doesn't seem soulless either.
They should have done better. They admitted that. They may or may not change their internal processes, but it's now in the record book. Case closed.
And the author of Spegel should not have used a different license if he wanted "more <<recognition>>". He wanted the recognition specified by the MIT license.
In other words: there exists some responsible person at Microsoft who violated the copyright (yes, removing the attribution is also a copyright violation!) for Microsoft.
In consideration how Microsoft has been treating copyyright violators for decades, if Microsoft does not give this responsible person the same crual treatment, it should be considered an honest, clear, implicit official statement from Microsoft's side that they are perfectly fine if hackers violate all of Microsoft's copyright. In other words: it means that all of Microsoft's software now (spiritually!) will become public domain.
Also, if Microsot does not make make this responsible person pay the caused damage from their own pocket to the original author of Spegel with the same monatery magnitude as if Microsoft would sue other entities for a violation of copyyright of Microsoft's software, the same statement applies.
https://github.com/Azure/peerd/commit/64b8928943ddd73691d0b5...
You have said many things like this in this thread. I don't think you understand how laws or courts or legal fees work. Good luck defending yourself against MS's army of lawyers during your court proceedings though!
I have no hope that the courts currently (!) agree with this. But let us spread the gospel so that as many people as possible know how Microsoft's "real" stance on copyright is. If a lot of people become aware of this and this truth stays in lots of people's heads for a sufficiently long time, the public opinion might change so that juries (representing the public opinion in courts) will indeed begin to judge against Microsoft in the way that I described.
I'm pretty sure that's exactly how juries shouldn't work.
oh, corporate wording. so you do not really care :D
Better do care a lot about it, and use every syllable of the corporate statement against Microsoft. :-)
I.e. the principle of some martial arts: use the force that the opponent applies against himself/herself.
Addendum: In this particular case
> We hear you loud and clear ..
can be considered as a very official statement from Microsoft that from now on, they cannot claim anymore that they didn't know of something ..., i.e. the hangman's noose is slowly closing. :-)
You are Microsoft. You can do better.
I would love to know what processes MS is considering to prevent this in the future as well as what kind of auditing might be done to look at other projects that started as forks.
That person never learned what plagiarism is throughout their entire academic career, much less once they landed at Microsoft?
This, of course, is incorrect, and a cursory read of the very short licence text would show it to be incorrect.
But I, too, am strongly favouring Hanlon's razor.
> I would love to know what processes MS is considering to prevent this in the future as well as what kind of auditing might be done to look at other projects that started as forks.
In response to:
> ... going to make sure we improve our processes to help us be better stewards in the open-source community.
Hell, I have been reading a lot about them (including the licences themselves and stuff like the GPL FAQ) many times, and in situations like this it's still not entirely clear to me what Microsoft should do (surely there are different valid ways to handle this).
Would you consider yourself competent as a lawyer regarding open source licences? If not, can I say that "you apparently never learned it" and aren't better than the rest of us?
This isn’t complicated, but if you truly don’t understand it then you should speak to a lawyer before incorporating someone else’s code into your or your employer’s project.
Have you read the threads here? My feeling is that there are many mutually exclusive interpretations of what can/should be done.
I don't know if it's simple or not, but what I see is that it's obviously not 100% clear for everybody (me included).
I reiterate that this is not complicated. If you still find it complicated, then you need to speak to an attorney or someone else qualified to give you direction before attempting to use someone else’s code.
We have been doing this for nearly 60 years. Correct examples abound if you’re willing to do basic research.
It seems an option to not take free labour to build a commercial cloud largely as a wrapper of open-source, and maybe find other ways to support the creators.
If one person's labour is that valuable to a company, maybe it will help someone realize that supporting such individuals monetarily might help create the next thing with time that they can't get to today.
Microsoft is a large, wealthy corporation has a big target painted on its back, and, consequently, CELA (corporate, external, and legal affairs) are, for good reason, a very strong force inside Microsoft. You can't just grab some code from someplace at Microsoft. Your PM has to run it past your division's CELA rep, look at the terms, assess exposure, etc. Did that happen?
If not, that's a big hole and you should probably beg forgiveness from them as you ask for an audit of every other piece of code you've picked up.
If it didn't happen, well, I suspect someone in your group just became the new Nelson, the hapless developer, in Microsoft's Standards of Business Conduct videos. You really don't want to be Nelson.
It seems like it would have been a much better strategy to add artifact streaming, submit a pull request and then if the maintainer isn't interested in adding it, proceeding with a fork.
"Probably out of scope" sounds like "I dont have time to implement a feature of that scope"
try to assume good faith :)
If you're discussing with potential collaborators and want to communicate that you don't have time to develop such and such a feature but would be open to accepting a PR, it's very natural to say "I don't have time to develop this feature but would be open to accepting a PR".
Better for whom? Now there is Peerd and Spegel that are different projects. Imagine if Microsoft had opened PRs into Spegel and the maintainer had merged them. Then at some later point Microsoft had decided that they need to have ownership of that project (maybe because they want to have the control over what gets merged into the project because they depend on it). Imagine this ended up with a Microsoft fork of Spegel, becoming more popular than the original one. What would people say?
Probably something along the lines of "embrace, extend, extinguish", right?
We could even crowdfund the lawsuit, I am sure he will win.
More likely, this is a way for someone to get ahead in their career at Microsoft by passing off a successful open source project as their own accomplishment. They can steal users from the original project and justify using Microsoft's resources to maintain it, which puts more resources under their control, and gives them something to talk about during performance reviews.
The open source community should have a way to enforce professional consequences on individuals in situations like this. They are motivated by professional gains after all. That's the only way this will stop happening. Professional consequences does not mean doxxing or other personal attacks, it means losing career opportunities, losing contributor privileges, and becoming known as untrustworthy. These consequences have to be greater than the expected gain from passing a project off as your own at work.
I wonder if a new kind of license could be created which includes projects in some kind of portfolio and violating the license means losing access to the entire portfolio. Similar to how the tech companies added patents to a shared portfolio and patent treachery meant losing access to the portfolio.
It's a space to keep watching.
It baffles me that HN has no idea how large organizations work. The boss's boss's boss has no idea what random worker bees are doing.
How you reckon with that, what you take away from it, is up to you. If you want to hold MS corporate responsible for every decision Aditya and Piotr and Zhong make, you can feel free to, but it won't help you understand how these decisions are made because it's wrong.
It is ultimately the responsibility of the company and its people to create a system where things like this are discouraged or prohibited. Not doing so is tacit approval, especially in this case where they have a significant history of doing the same thing.
Most corporate actions that 3rd parties consider "bad" are the result of someone inside the corporation having an asymmetric payoff from directing the corporation to do the bad thing. They get the upside from a success, but not the downside from failure.
If you want to stop a certain bad behavior, your best bet is to change individual incentives.
Like this isn't some tragedy of the commons situation. This isn't some situation where the company is a cooperative confederation of equal partners. Either shit rolls uphill, or you don't have leadership at all. You don't get to pass the buck on criticism because you made a decision out of self interest, either.
"It's not technically illegal," is the most blasé, low-effort rule for behavior. It's why only twelve-year-olds and lawyers use it as a defense for poor behaviors and poor ethics.
Being a POS earns you a reputation for being a POS, and that includes people publicly pointing you out as a POS in public forums.
Executives are not micro-managing day-to-day implementation decisions of every team, no. They set broad strategic goals, the management layers below them decide how to best operationalize those goals, and the layers below those middle managers make specific implementation decisions to execute those operations.
If you want to think of this as "not actually running the company at all", you're free to. The point is that's how the world works.
That's also the way the world works.
Rephrasing it - there’s a reason it’s Zuckerberg and Pichai and Tim Cook who go to congress, and not the folks implementing it on the ground level.
No initiative? Then it's 100% their fault.
Not a single Microsoft C-suite exec, or anyone within spitting distance of the C-suite, will ever hear about this. Do not mistake your personal media bubble for the general media ecosystem.
Of all the bad arguments, this is the worse.
Whilst there are always bad apples in a big company, a good company stamps out bad behaviour as soon as it becomes aware of it.
This is the nature of OSS. Out right theft in hopes you will never know until it’s too late.
Very rarely do large corporations contribute their fair share back to any project.
Does this make me money and/or solve a problem quickly? Fork it and it’s mine.
Until we stop giving money to large corporations that profit off the free work of others, then it will never stop.
And it won’t because we like low cost solutions that work.
No, it was a whole team at MSFT: https://news.ycombinator.com/item?id=43755745
Failing to abide by the MIT license is copyright infringement. My advice is to contact these guys: https://softwarefreedom.org/ They likely can file a cease and desist on your behalf.
However, I took a closer look at the files in question. The MIT license requires that they retain and provide copyright notices, but you never put copyright notices in your files. The only place where you appear to have placed a copyright notice is in the LICENSE file:
https://github.com/spegel-org/spegel/commit/23ed0d60f66dd292...
Things become interesting when I look at their LICENSE file. They appear to have tried to relicense this to Apache 2.0 before backpedaling and reinstating the MIT license:
https://github.com/Azure/peerd/commit/473a26c808907f2d9f7b7f...
Unless they forked from a very early version of the project that did not even have the LICENSE file, they removed the sole copyright notice you had in the repository. That brings us back to my original thoughts, which is that they have committed copyright infringement, and you should contact OSS friendly lawyers about it.
I am not a lawyer, but I do contribute to various OSS projects and all of the ones to which I have ever contributed have copyright notice headers at the top of every file to ensure proper attribution is maintained no matter where that code is used. Beyond having that sole missing copyright notice reinstated, I am not sure what else you could expect since none of your files have proper copyright headers in them. The SFLC guys would be in a better position to advise you, as they are actual lawyers.
I thought having a LICENSE file in the project's root directory was sufficient. Is it not the case?
That said, file level copyright notices are not perfect (since only the VCS shows who added what lines and that might not be preserved), but it is better than nothing and it is something that is guaranteed to persist as long as people are abiding by licenses. If they are not, that is copyright infringement and the copyright holder can do things like send cease and desist notices in response to the copyright notices being removed.
Also, I must emphasize that I am not a lawyer, but one might argue that it was not willful infringement if someone removed a copyright notice from 1 file by claiming it had been a mistake. However, if they remove it from all files, then nobody is going to believe it was not willful.
Technically if there's no license found then it should be considered automatically copyrighted, with no permissions to copy. So leaving copyright license out actually makes it less open source.
Consider future contributions; the contributor’s copyright should apply only to the files to which they contributed.
Similarly, consider any code that you incorporate from external sources; that code’s copyright and license should only apply to the files in which it has been incorporated.
Lastly, consider the case where the code is copied out of your project to be incorporated in a different project. The license and copyright should follow with those files (and if your files don’t include copyright and license at the top, it’s very likely the person doing that copying will insert it themselves for this same reason).
Sufficient but a good idea to put copyright in all files.
Technically if there's no license found then it should be considered automatically copyrighted, with no permissions to copy. So leaving copyright license out actually makes it less open source.
Obviously Microsoft is still committing copyright infringement and in the wrong here. However, if the author had copyright notices in each file and then Microsoft stripped them out or changed the copyright information, it would make it harder for them to brush it off with "oops, we forgot to commit the correct LICENSE file" like I'm sure they'll do here.
That said, if Microsoft had forked before the LICENSE was added or stated somewhere, they were reusing all-rights-reserved code, which is definitely copyright infringement. Again, I am not a lawyer.
The forgiveness clause in GPL 3 is as much an acknowledgement of actual reality than anything else.
I’ve contributed to plenty of project that don’t have the per-file copyrights. It’s a choice not a mistake.
You are right, provided he did not have a notice saying it was MIT licensed elsewhere.
> I’ve contributed to plenty of project that don’t have the per-file copyrights. It’s a choice not a mistake.
I would consider it to be both a choice and a mistake. The two are not mutually exclusive. There is no evidence in the fork that he is the copyright holder of the original code and it looks like Microsoft is. Part of that is Microsoft’s fault, but part of that is the original author’s fault for not including per file copyright notices, such that Microsoft could add theirs and be the sole one listed in every file.
I would not be surprised if Microsoft’s legal department doing a scan of public repositories for stolen code mistook him for infringing on “their code” given that they have no information that he authored it rather than their employee. It sounds absurd, but it has happened. I know for a fact the sg3 utils author added copyright notices to his code examples because he was getting contacted by companies, whose engineers incorporated his code into their projects without attribution, that thought he had stolen their code:
https://github.com/doug-gilbert/sg3_utils
I know that because he told me by email in 2013.
Absolutely not! This is completely and only M$'s fault, whichever way you look at it. Copying a file and slapping your own license on it, without consideration of the original one, is never acceptable. Don't blaim the victim please.
As for incompetence - well maybe they (M$) need to get better at managing licenses? Accusing others of stealing when the reverse is true only makes everything worse. Let's not try to change the standard way of licensing because some developers can't be bothered to check the license (and even fix typos in comments, apparently).
As an aside, there is no need to add copyright / license to every file. I would even consider it an anti-pattern, because it pollutes the code with noise.
If you look at any major project, you are likely to see license and copyright notices at the top. You even have the Linux foundation pushing to have standardized license notices at the top of every source file:
https://en.wikipedia.org/wiki/Software_Package_Data_Exchange...
That said, the engineer who did this is fairly young (7 years out of college) and does not appear to have any experience working on a fork previously:
https://www.linkedin.com/in/aviraltakkar/
He probably did not realize he had goofed. It does not take much imagination to guess the sequence of events:
* He copies the source files into Visual Studio Code
* Someone internal tells him he needs a license, so he grabs whatever Microsoft suggests while following internal guidance, without realizing that is only for Microsoft originated code.
* Someone internal tells him to put it on GitHub, so it goes up with the wrong license.
* He realizes that the files already had a license and tries to fix it. Presumably someone told him.
* He misses the copyright notice that he failed to copy in the first place when fixing his earlier mistake.
* People here hear about it.
Only because they removed the license and copyright. If they were willing to do that in 1 file, they are willing to do it in many. It's not the authors mistake in any way shape or form.
No: the original author could have made it easier to comply, and you could argue that he acted foolishly in not doing so, but that doesn't make it his fault.
If someone wanted to transplant only a subset of files from one project to another, there would have been no copyright notices to retain.
There's more than one way for Microsoft to have retained the required attribution. The problem is that they didn't pick any of them. The author offered them valuable code, and the requirements of the license weren't onerous -- if they're unwilling to follow them, they should just not use the code.
Does it matter what license you use if they actively ignore the terms in the license you did chose? MIT requires attribution, but they didn't. Why would any other terms be different? You surely could have put "You must license your project the same as the one you forked from" and they still would have ignored it, not sure what the difference would have been.
GPL/AGPL would prevented this somehow, requiring proper attribution via mandatory source code release, and allowing to track project origins. This would make it harder to label it as a "a Microsoft Product from Ground Up", and prevent Sherlocking the original application to a greater degree.
As a result, this would probably forced Microsoft to develop a new one from scratch, because they're allergic to GPL, because if they have breached GPL, they would be forced to comply, since GPL is court tested already.
So, write Free Software. Not Open Source. Esp. for your personal projects.
Source: the MIT license.
There's a copyright line, check. There's the permission notice, check.
The rest is just goodwill and ethics, which is not a very valuable currency in software in these days.
That way anyone touching the project can just add their own line on top.
Done.
EDIT: Example: https://github.com/go-gitea/gitea/blob/main/LICENSE
A more complicated way to do it is to add a folder that contains the original LICENSE file or files. Sometimes there is more than one license, or the license texts differ. In that case, you must preserve all the different variants, even if they all call themselves MIT.
Then, you can optionally add your additional own LICENSE file * only iff* it is compatible with all existing LICENSES. In the case of the MIT license, you may relicense, sublicense, or use a different license in addition, provided it is MIT-compatible. With e.g. GPL you can't. Note that you still have to preserve all the original LICENSE files in the repo.
https://github.com/valkey-io/valkey/blob/unstable/COPYING
Third party licenses retained in a THIRDPARTY file in MariaDB
https://github.com/MariaDB/server/blob/main/THIRDPARTY
Only two good examples I could quickly find.
Once you change the copyright line, you no longer include "the above copyright notice". At that point you're violating the license.
You are also not allowed to change the copyright notice or license text in any way (you may however add to the license, which is a loophole other licenses such as GPL fix.)
Substantial is subject to (legal) debate as the Oracle vs. MS case has shown. Whole functions or large parts of files however should always be considered substantial, as the software would otherwise not work.
I'm seriously flabbergasted at how bad reading comprehension seems to be among coders.
Sorry to deflate your amazement, but I made the remark because I have never seen a permissively licensed repository which changed hands and had multiple copyright lines in the last 20 years or so.
Maybe it's not my reading comprehension (and English is not my native language to begin with), but the behaviors of other coders to begin with.
Maybe we shouldn't point fingers to others and not forget that three are pointing towards ourselves. Eh?
But yes, many people are not complying with the license literally, and it's frustrating to see. I know it basically doesn't matter unless you go to court over it, but still it irks me and screams a sort of carelessness about the rules and social contract.
Sorry for criticising your reading comprehension, I did not mean it as a personal insult.
It's just that I see these types of responses so often, basically every time any licensing question comes up. Twice in this thread. And all that's required is to just read the very short and basic MIT license text itself, no lawyering required.
I can understand the native speaker part, but just know that I myself am not a native speaker either. But I understand that's a huge barrier.
But even native speakers on HN with serious software engineering jobs and skill don't understand it, or don't want to understand. I think it's a bit like when people see math proofs, they mentally just skip over it.
That's the part that continues to amaze me.
I don't see "Copyright (c) 2024 The Spegel Authors" (the "above copyright notice" in https://github.com/spegel-org/spegel/blob/main/LICENSE) anywhere. Where do you see it?
The hacker news post reached someone high enough up at Microsoft to have things changed. They ended placing a combined copyright notice that is a mixture of both versions into the repository to play it safe.
You’d need to patent your idea to stop that.
Citing myself from my comment:
> As a result, this would probably forced Microsoft to develop a new one from scratch, because they're allergic to GPL, because if they have breached GPL, they would be forced to comply, since GPL is court tested already.
So, we seem to agree here.
If they're breaking the license, go talk to a lawyer. You might start by approaching the SFLC [1] (although I haven't heard much from them recently).
> Why I (A/L)GPL
> I want people to appreciate the work I’ve done and the value of what I’ve made.
> Not pass on by waving “sucker” as they drive their fancy cars.
Always choose AGPLv3 no matter what it is you're doing. If they want it, AGPLv3 gives you the leverage to negotiate a licensing deal. You sell them permission to violate it. I even emailed Stallman asking what he thought of this strategy. He thinks it's a net good.
What remains after full compliance with the MIT license choince will be the bulk of the complaints in the article.
So if the author instead used GPL, this wouldn't have been a problem? Call me pessimist, but I don't think Microsoft would have cared if it was MIT, GPL or even missing a license (so copyrighted by the author), they would have made the same choice as they just now did.
I'm sorry, but it's really hard to understand what you mean here, how choosing GPL would have somehow lead to a different outcome.
But reading the article, the author appears to be more disgruntled by the fact that a behemoth forked his project than the mishandling of the copyright that can be fixed with one PR (he is right to be pissed about that, but that's an easily solvable problem, I doubt Microsoft will stand against it).
There is a large difference between "they didn't put in a sentence that they needed to," and "we have 30 users who didn't get the source code that they were required to receive."
I do agree for the author to be _fully_ happy they would probably have wanted something even more restrictive than any traditionally "open" license like GPL, but about any choice would have better aligned with their desires than MIT.
I'm confused how you and others reach this conclusion. No, it doesn't.
The MIT license is one of the shortest free license that exists:
Copyright (c) <year> <copyright holders>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
https://en.m.wikipedia.org/wiki/MIT_License
No where does that require attribution. It has basically one condition: perpetuate the license.
Maybe the author didn't actually use an MIT license, despite claiming to? But as far as the MIT license is concerned, as long as the other party provides the same license for the fork, that's all that's needed.
> I'm confused how you and others reach this conclusion. No, it doesn't.
| Copyright (c) <year> <copyright holders> | | ... | | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
The copyright notice that must be preserved includes the copyright holders' names, and that is a form of attribution.
No, they would have found something else that wasn't a pain to steal.
Which GPL is that? The GPL 2 and 3 are incompatible with each other, making cross contribution between different FOSS projects practically impossible. The "v2 or later" licensing model does nothing to remedy the problem. See Rob Landley's talk on this topic.
The problem this addresses is not that Microsoft forked this project. The problem is that when a corporation like Microsoft does this, they harm our community[0]. Open source thrives because a bunch of individuals and groups collaborate.
Microsoft, is built around the concept of profit for stock owners at any cost. They may collaborate as long as their interest in profit is served, but otherwise, it is back to "Embrace, Extend, Extinguish" [1].
This lack of community ethic is endemic in corporations. It is also an existential threat to our community. Profit at any cost is not collaboration. It is predatory.
And yes, I know, corpies and other greedist will vote this down, blah, blah, blah.
[0] https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor...
[1] https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...
[edit clarity]
I think community source should be accessible and usable outside the community. A community license should have a provision for paid use by corporations. If Microsoft wants to use it that is fine - if they pay.
But if Microsoft wants to fork things, to me that is predatory. If I can't fork windows, why should they be able to fork community software? If they argue that people should pay for their products, it just seems fair to me that they should not get community products for free.
I guess the concept is playing by the same rules?
That violates the first clause of the open source definition:
It probably violates 5 and 6 too.
> But if Microsoft wants to fork things, to me that is predatory. If I can't fork windows, why should they be able to fork community software? If they argue that people should pay for their products, it just seems fair to me that they should not get community products for free.
Windows is not open source software.
Maybe you rather don't actually want your software to be open source. Maybe you rather want your software to be under some copyleft license. Maybe you want to use an OSS license that is inconvenient for cloud providers (while still being an open source license) like the AGPL.
Choose wisely.
OSI is too busy trying to come up with an equally mid (at best) OSAID for another thing thing that corporations already don't and won't care about following, so I don't expect them to prioritize it even if it got raised
I simply do not get this corporate hate. Corporations and individuals can both use it for good and bad. A company might use open source to make a pacemaker to save lives or world improving research, or it might be Facebook and sell personal data.
It exists: https://creativecommons.org/licenses/by-nc-sa/4.0/
I am unclear of where the boundaries could and should be, but in essence we want money to flow into community source projects. Corporations and commercial entities can and should pay a fair amount. If they don't want to pay, they should not be able to profit from the work of the community.
There is nothing preventing the project owner from also granting individual paid commercial licenses. There are a number of GPLv3 (or other restrictive license) projects with a note like "contact us for commercial licenses" in the README.
Licenses aren't exclusive by default. If a company doesn't like the existing license, they are always free to contact the project owner(s) to request a custom license.
Be careful. Changing the license presumably requires the consent of every copyright holder. It's trivial when it's just you but quickly become impossible in practice as the number of contributors increases. Stuff like this is why some projects ask you to reassign your copyright to them.
I think this is what a lot of people would use if it were more known about. I feel like a lot of people do not actually read what a license provides and just default to MIT because it is widely used.
> It exists: https://creativecommons.org/licenses/by-nc-sa/4.0/
CC-NC-SA violates the open source definition.
See "6. No Discrimination Against Fields of Endeavor" in The Open Source Definition https://opensource.org/osd
As you say, their job is to protect the company, not actually understand how IP works. But it's pretty silly when some stupid dev like me knows their supposed area of expertise better than they do.
You are going exactly against the OSS philosophy. OSS shouldn't restrict the use of software just because you don't like it. It was created to fight exactly this. This is also why source available BS (like BSL) is against OSS. OSS is literally about being about hacking and changing software to suit your needs. It was never about the money part. You should create your software as proprietary if you are SO bothered with OSS. And you can always donate and contribute back to the OSS software you use. I don't think butchering OSS philosophy is the way.
The problem here is license illiteracy. Even I who for a while used to think I understood a lot about OSS license just had a doubt now:
When you fork, do you retain the copyright part? Copyright (c) 2024 The Spegel Authors
That is what we need to fix.
So screw this corporate "OSS philosophy", and stop telling people what they "should" do. Those licenses exist and people can use them and this is what happens. We can and should also make different licenses which protect our interests as developers and we don't need corporate shills invoking some philosophical argument to discourage us.
So the point is that we need another license that does gives open source rights to individuals, yet does not permit corporations to take everything and give nothing.
Why doesn't the AGPL fill that role?
Citation needed here, if you're going to make such a bold claim.
The open source movement began as a counter to proprietary closed-source software, and nothing more. It has never been about "fairness" (however you define that) or about preventing anyone from profiting from OSS.
Now that said, fairness matters and I agree that some of what transpires today in the open source world doesn't feel fair.
But that's what new or difference licenses can accomplish, depending on the wants of the authors.
And that's different from the philosophy behind Open Source Software. We should be clear about that.
In addition the origin of Stallman's open source philosophy was a printer he couldn't use because of closed-source software. From the start it was about the rights of the users, not corporations.
https://www.free-soft.org/gpl_history/
> In the early years (1984 to 1988), the GNU Project did not have a single license to cover all its software. What led Stallman to the creation of this copyleft license was his experience with James Gosling, creator of NeWs and the Java programming language, and UniPress, over Emacs. While Stallman created the first Emacs in 1975, Gosling wrote the first C-based Emacs (Gosling Emacs) running on Unix in 1982. Gosling initally allowed free distribution of the Gosling Emacs source code, which Stallman used in early 1985 in the first version (15.34) of GNU Emacs. Gosling later sold rights to Gosling Emacs to UniPress, and Gosling Emacs became UniPress Emacs. UniPress threatened Stallman to stop distributing the Gosling source code, and Stallman was forced to comply. He later replace these parts with his own code. (Emacs version 16.56). (See the Emacs Timeline) To prevent free code from being proprietarized in this manner in the future, Stallman invented the GPL.
https://opensource.com/article/18/2/coining-term-open-source... https://www.gnu.org/philosophy/open-source-misses-the-point....
> The GPL was "To prevent free code from being proprietarized" by for-profit corporations.
You are adding the "by for-profit corporations" here. That's not in the link you provided. Let's distinguish between what was actually said or meant, and your own personal interpretation or editorializing here.
In the GPL context "proprietarized" could apply to anyone. I could write and release proprietary code with restrictive usage limits, and I'm not a corporation. And the GPL wants to prevent me from doing that as well.
The right to see and modify the source code to the software you run is not restricted, or aimed at, individuals or corporations. I think the GPL's goals here are universal, meaning any entity should have those rights.
Which I think is a good thing. We agree on the ideals of free software here, I just think you're layering "for-profit corporations" on top of it in a manner that was never actually part of the philosophy, because it doesn't make those distinctions.
It can certainly be part of your philosophy, but be clear about that.
I beg to differ here. OSS and Free Software movement was conceived for the freedom to change the software to the user's needs. The entire meaning of free as is freedom means as long as I abide by the license properly, I can do whatever I want with it. Whether you like it or not, this means Microsoft can make money out of curl project if they want to. This is the same way we used to burn Ubuntu cd's and resell it back in the early 2000s. It's allowed and IIRC Ubuntu cd cover used to proudly advocate burning, sharing those cds.
This big tech and money in OSS is a new phenomenon. I am neither against them or with them. But just that it is not the reason why OSS or Free Software movement happened.
How is this not exactly helping end-users? Corporations are producers, not users. And no one is complaining about MSFT or any other corporation using OSS as users, but only about co-opting it as a producer.
This is literally why when a company stops open sourcing something, community or other company continues the fork. When a product fails as business and when open sourced, the software itself thrives.
Let me re-iterate, Open Source is purely about the software and the capability to share and make changes. IT IS NOT ABOUT MONEY, BUSINESS, CAPITALISM etc etc etc.
It is not even about collaboration. That is something that came out of Linux development which is one of the most famous Open Source project. All that is necessary is to make the software licensed under an OSS license. And I don't have to get PR from you, I don't need to accept outside collaboration etc etc.
That seems to be the point being debated now. When a megacorp forks an OSS project and cuts out the author, how does that encourage developers? How does that encourage OSS?
And for that matter, perhaps less ideological but practical, how does that encourage small startups who want to be as open as possible while wanting to be able to scratch out a living working on something they care about?
You suggest staying closed source, rather than tweaking an open-source license to limit corporate forks, for the purpose of protecting OSS philosophy. It strikes me as odd.
When a megacorp forks an OSS project, the maintainer should know that it is allowed. If you are MIT licensed, that megacorp can resell your software, create a business around it and make billions in revenue. That is allowed. If they are bothered by it, they either should use a different license or take the software proprietary. To me, the problem here is that Microsoft hasn't properly followed OSS license here. My qtile window manager config file has copyright notice of all the authors. That is how you follow MIT license. Another problem I see here is not knowing how to do license compliance. Also, why should it matter if the one who forks it is an individual or a mega corp. As far as OSS is concerned, it's irrelevant.
> And for that matter, perhaps less ideological but practical, how does that encourage small startups who want to be as open as possible while wanting to be able to scratch out a living working on something they care about?
I have been an OSS guy for a long time. And think OSS in business is a very tricky and hard problem. If you don't have the reason to be OSS, it's better to be honest about it. There are other ways to support OSS. Just support like 10% or even 5% of the dependencies you use as a business and that will make wonders. And be honest about things. Obviously, there are success stories. But if you have seen the recent trend, people are in the mindset that someone forking your OSS is ripping off of them. Not stopping to think that it was allowed all along.
> You suggest staying closed source, rather than tweaking an open-source license to limit corporate forks, for the purpose of protecting OSS philosophy. It strikes me as odd.
Because the moment you "tweak" the OSS license the way you are talking, it stops being OSS. Also, your proprietary software still needs to abide by the OSS licenses it uses. If I use a OSS software, it should abide by the OSS license somewhere in the output.
I think it's better to be honest about OSS than being like... we love OSS (Just like Microsoft <3 Open SOurce) and saying.. you know what? Don't use this software in this industry because that where my business happens. Oh and since you don't agree with my politics, you can't use it. I am not gonna list them, but there are licenses which does these and they are exclusionary. Free as in Freedom is what brings in people to OSS. The moment you start excluding people, it's a slippery slope. It's already happening in politics and else where. Let's just keep software away from it all please.
If you stop people from using your software while they are at work, you stop people from using the software and it is no longer open.
> You are going exactly against the OSS philosophy.
GPL is almost that: community, because if you want to use it in a commercial product you have to make sources available, not to the community but to those who ask for it.
I'm of the opinion that open source is a business tool, and one should use a license that helps one achieve business goals. Those goals can be very personal and about career advancement, or they can be those of a trillion dollar corporation. TFA might benefit from using GPL if they are upset at what MSFT did, or they might work with MSFT to have their work integrated into the original to end the fork, or...
What is this "our community"? My releasing something under the MIT license doesn't mean I'm part of whatever community you're invoking. It means I'm releasing something with an MIT license. That's it.
I certainly don't want to give companies like MS a "pause" before they decide to fork my project. I'm explicitly telling them they can do that. I absolutely do not want them to be hampered by notions of "What will this action look like?"
Don't impose your values on other people's use of my software.
Your code, your license. My code, my license.
If you want a corporation to avoid it like the plague, just make it GPLv3. If you really want to screw them, go with AGPLv3. This way you keep a true open source license, but don't have to worry about corporate control.
Microsoft is currently violating the license, and the author's recourse is this HN post.
Free Software (like GPL) has the philosophy that you can USE the software for any reason. The rights are for the USER. The responsibility kicks in when you redistribute the software. It ensures that you preserve the same freedoms you received when you pass it on.
But if you restrict USING the software, it's not free software anymore.
The flake8 (MIT license) maintainer is upset that ruff is copying his lints, for example.
I find the whole thing bizarre.
What exactly is this supposed to mean? We will not be asked. Only alienated teens care if strangers "accept" them.
Other changes removed the spegel project's LICENSE and added in Microsoft's LICENCE file and copyrights on all files.
Highlight the part of the essay where he is claiming MS didn't have a right to do what they did.
The point of the article was that MS showed interest in his work, asked him about his designs. Said nothing about internal plans to fork it or use it. Then he shows up to a talk and sees them discussing his work.
Reading between the lines, it is 100% clear they didn't feel like telling him they planned to fork his software, and they danced around it. They didn't reach out to him afterward and say "thanks, we are building a fork and your free time was really useful".
The essay isn't claiming a legal issue. It's pointing out a substantial, practical issue with OSS that didn't exist nearly as prominently in the pre-cloud era: megacorps forking software and cutting out the OG developers.
https://github.com/Azure/peerd/commit/473a26c808907f2d9f7b7f...
Unless they forked a very early version that did not even have the LICENSE file, such that they never removed the original notice, this looks like copyright infringement to me. That said, I am not a lawyer.
What does "chore" mean in this context? Is the license just leftover from some MS open source template? If so there is perhaps some leeway, and the author maybe just didn't realize he needed to use the original MIT license file including the notices and not just a template one grabbed from the internet.
Any other explanation for such a "relicensing" would be extremely worrisome.
Unless there was some "conspiracy" to violate the license (my original comment was an attempt at playfully hinting at that possibility, though I don't find it very likely), I'm sure the person who wrote that commit message thought about it for less than three seconds.
It just so happens that the Microsoft engineer who originally changed the license in GitHub went from Senior to Principal engineer at Microsoft in the past two months (according to LinkedIn). So you probably aren't far off.
If this is what happened, I suspect Microsoft will drop this person even quicker than a hot potato, and even quicker than if they told them to rewrite it from scratch but the person took a few shortcuts too many (which would be my guess).
If they wanted to fork it, they could - just keep the attribution and be done with it. The fact that they tried to rewrite it suggests that someone wanted it to be legally not a copy.
There is definitely a type of person who cheats, lies, throws people/teams under the bus, breaks the rules, and cuts corners to get ahead. The ones who are able to not get caught are rewarded.
This is not only a software phenomenon, but almost all aspects of life.
https://vadosware.io/post/the-future-of-free-and-open-source...
I think in this situation it might have convinced Microsoft to contribute rather than fork... But then again, it's Microsoft. Also, they're well under their right to fork and keep the changes as long as the license stays the same, etc.
I think another important point might be that "free software" aims to protect the users of free software, not necessarily the profit-maximizing (I mean to use that phrase neutrally) ability of software developers.
In many cases, project maintainers would not want the changed code anyway because it does not align with their vision for how things should be done. Linus Torvalds and his subsystem maintainers, for example, do not want people to send them code dumps containing the hacks people have done to private Linux source trees. They want proper commits that are done well and have been modified to comply with any feedback that they provide.
What the project maintainer here wanted were collaborators who would work with him as a team (which is not much different than what most OSS developers what), but no license requires that and it is rare to get that.
AGPL may not have convinced Microsoft to collaborate.
And the upstream and buy the product and get the same rights as a user.
But first and foremost it's about the users.
It's not as much about the collaboration by the vendor per se, though users would likely prefer it, and are themselves able to collaborate on equal footing.
I also don't understand the cloud hosting argument, when we had a great whole era of Apache/PHP/MySQL stack based on exactly this idea of commercial hosting.
It was particularly problematic for the FOSS companies because each of these players' plans was to resell the Big Three clouds and live off of the margin, so the instant that the cloud providers decided to just directly compete in the hosting space the original company physically couldn't compete on price.
The moral of the story is that if you're releasing cloud software as FOSS you can't plan your business around the idea that you'll be the only hoster.
I think this isn’t a problem — not everyone has to contribute to any project! People sometimes struggle with the choice between GPL and MIT for similar reasons of popularity.
People who want the widest possible usage/corporate adoption can pick licenses that reflect that and embrace the tradeoff
This subthread started with the implication that people shouldn't be doing that. But you are right, that's exactly what most are doing.
What would be the goal of a license between AGPL and SSPL on the spectrum? Seems like such a license would at the very least be non-free? (which is perfectly ok)
Whether this would be considered non-free is up for debate IMO. Why would a license like this be considered non-free when the GPL is free? Is it the scope of it? The OSI would hate it because they represent the organizations this is meant to curtail.
Though most of this is moot if you can just launder code through a LLM and magically remove any licensing for it.
Do you consider the SSPL to be free? If so, this would be. If not, it probably would not be. Why does SSPL require unsatisfiable numbers of dependencies by the way? It seems pretty clear to me (though, clearly, not free).
> if you can just launder code through a LLM and magically remove any licensing for it.
If you can actually do this, I look forward to unencumbered Windows-compatible source code having run variously leaked source through copilot.
> In order to make sure that all of our copyrights can meet the recordkeeping and other requirements of registration, and in order to be able to enforce the GPL most effectively, FSF requires that each author of code incorporated in FSF projects provide a copyright assignment
FSF is not the average recipient of copyright assignments - I'd be much more comfortable giving copyright assignment to FSF than to pretty much any other entity:
* They're much less likely to rugpull on the contributors and change the licence to something non-free: even pessimistically assuming their leadership got subverted somehow, doing something like this would pretty much be the deathknell to FSF. So there's a known, very high cost to the negative side of CLAs.
* They're much more likely than the average project or corporation to actually use the positive benefits of copyright assignment, to pursue legal action and enforce the Free licences the way it empowers them to.
It seems like what's bothering him is:
> give a single entity, the project steward, a special license distinct from the one that everyone else gets, so that they may use your contribution in any way they please
But that's not a justification.
The project steward is contributing more than 90% of the code, maintain the infrastructure and servers, do the promotion, ...
So yeah, they may give some condition to accept your contribution, but I think that's fair. They don't force you to contribute. And depending of the motivation for your contribution, you get what you want, eg, the feeling of contributing to an open source project presumably used by many people, or having that entity to maintain your patch for free.
I mean, you can fork if you like, but the likelihood that your fork is getting used is not that big, and mean more work from your side to maintain the change.
In a CLA-restricted project, there's only one entitity that can contribute copyleft code. Everyone else must donate the code to them, and they forbid themselves from using other people's copyleft code, because they can't relicense it.
There's a famous talk about this, which resulted in many us referring to Oracle and its billionaire CEO as the "lawn mower."
There’s no reason to worry about the AGPL unless you plan to conceal code from its users. Most software businesses take this approach because it’s hard to sell information that is publicly available, and code is just information. Some businesses make money operating software for others. AWS pays on-call engineers to keep RabbitMQ highly available.
Free Software protects the user from the developer. Permissive licenses protect the developer from the author.
A lot of professional software engineers get confused and think of themselves as the “user” when they’re actually more of a middle man.
Seems it isn't the first time Microsoft leads open source maintainers on, trying to extract information about their projects so they can re-implement it themselves while also breaking the licenses that the authors use. Not sure how people fell so hard for "Microsoft <3 Open Source" but it's never been true, and seems it still isn't, just like "Security is the #1 priority" also never been true for them.
Here is the previous time I can remember that they did something similar:
- https://news.ycombinator.com/item?id=23331287 - The Day AppGet Died (keivan.io) 1930 points | May 27, 2020 | 550 comments
The best advice for open source maintainers who are being approached by large tech companies is to be very wary, and let them contribute/engage like everyone else if they're interested, instead of setting up private meetings and eventually get "forked-but-not-really" without attribution.
Tho pricing tailored to customers works, as long as it's efficient and non-zero.
You set up your standard, and stick to it whomever comes.
Why? Most businesses don't entertain standard rates, either. It's case-by-case negotiations ("call us", "request quote"). Why should I, as a private person putting stuff out there for free, set up "my standard" and stick to it?
But I guess they don't mean set the same price for everyone - but rather stick to your values in what you do.
Interesting moral proposition, I doubt you'd get many followers. I think it's perfectly reasonable to treat people differently from corporations, and random small and medium corporations differently than huge megacorps without losing any sleep.
Specially in business, charging more to those that can pay more is a very common approach.
and all consumers dislike price discrimination. Airlines is the classic example.
It's just that those companies do this because they can. And i hate it. I much prefer a static, single price for a product.
gaben figured that out and successfully expanded into many markets that were considered basket cases for software licensing.
But the US Supreme Court would be one of them.
But the license of a piece of software is not ridiculous - if you chose a very permissive license, you cannot then go and choose who should or shouldnt be profiting off your software. The license was a pre-commitment.
But lots of people make this pre-commitment, but then makes a moral/ethical judgement post-facto when someone rich seems to be able to extract more value out of the software than what "they deserve", and complain about it.
1. A small company which is barely profitable but is building something which aligns with your values and you see as a positive to the world.
2. A massive mega corporation whose only purpose is profit, mistreats employees, and you view as highly unethical.
You shouldn’t treat those the same way. It’s perfectly ethical to offer your work for free to the first one (helping them succeed in creating a better world) and charging up the wazoo (or better yet, refusing to engage in any way with) the second one.
A company is not a person, and can literally have its entire staff changed in short order. Or be bought.
Companies have no morals. Sometimes people in companies do, but again, that person can vanish instantly.
You should treat a company as a person which may receive a brain transplant at any time. Most especially, when writing contracts or having any expectation of what that company will do.
A business that is privately owned, is run by its founders and which represents the lion's share of its officers income and net worth can be dealt with like any other small business.
Some guy who makes bespoke firmware for industrial microcontrollers or very niche audio encoding software isn't Microsoft. You won't be able to do business with him in a useful way if you treat him like Microsoft.
If you want to be extreme don't distribute it to them in the first place. Licenses do not come into effect until after distribution. So you could have a pay-to-download model that comes with a %100 discount if you're a lone developer or an organization with under X amount of revenue. You wouldn't be able to stop someone redistributing it after the fact, but you're not engaging.
Although at work we have a provider of proprietary software that has an APT repository where the URL includes a secret token, so they can track from where it's being accessed.
Well, the standard for software licensing is to sell cheaper licenses to smaller businesses and more expensive licenses to larger businesses.
It's like negotiating with the mafia, you might get something out of it but if you cross the line you'll end up face down in a ditch and authorities will look the other way. Megacorps have stolen, copied, reverse engineered, replicated, etc. things since forever and it always worked out for them.
In this case MS didn't need any help. They could very well take everything and face no real repercussions (this is the reality when the majority is uneducated, and their elected representatives are greedy and spineless). So playing along gives some chance to get something positive out of it.
What’s the scenario here where they could take you to court for refusing to (in GP’s words) doing charity for them?
Scenario 1: Microsoft contacts you and says they want to talk about your open-source project. You never reply.
Scenario 2: Microsoft contacts you (…). You reply “thank you, but I’m not interested. You are of course free to contribute or fork within the constraints of the license.”
Scenario 3: Microsoft contacts (…). You reply “sure! I charge $X/hour or I could do a flat rate of $Y for the meeting. Is that acceptable to you?”
What basis would they have for taking you to court in any situation? As soon as you got a legal letter for any of them, your first step should be to send it to as many news outlets you could think of.
Since this isn't the first time MS does this to a FOSS maintainer, it's clear this tactic doesn't help us.
He was hoping for a fruitful collaboration and offered the help towards this goal. MS taking whatever they wanted anyway just proves that they had no intention to cooperate, let alone to pay handsomely for something that was already free.
Ending up in court means you need to sue the megacorp to enforce the license. This makes it a free lunch for a megacorp.
With every single scenario MS takes whatever they need. They don't have to pay, don't need the help to read code, and you can't afford to force them to respect the license.
P.S.
> As soon as you got a legal letter for any of them, your first step should be to send it to as many news outlets you could think of.
There's a guy rotting away in a El Salvadorian prison with a lot of press to keep him comfort. Not sure your letter will capture the world's attention like you think it will.
Both projects also share in license, so I have less of an issue with it personally. They're both MIT licensed.
If they contributed it upstream, would we be discussing a blog post "how dare evil megacorp submit a PR that only implements their API! embrace extend extinguish!"? Probably.
Considering how often that happens VS how little times stories like that appear on the frontpage of HN, I'd wager a guess that we wouldn't be discussing it like we're discussing the current license violation.
> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
Simply removing the copyright is a violation of the MIT license.
The real question is why did the author choose MIT if they didn’t want allow mega corps to benefit from their work without contributing back. That’s a feature of the license, not a bug.
MIT and BSD type licenses say you can do almost anything you want, but just don't plagiarize, because that would be intellectual misconduct.
In addition to not just removing the copyright notice from sources, the MIT license requires the copyright notice to be present in all derived works. It makes no mention that if you compile a program, the binaries don't have to have copyright notices.
Yes, they mentioned Spegel, but only to thank the authors for "generously sharing their insights" -- that's not even close to the required statement that part of the project is owned and copyrighted by the authors of Spegel.
You really think the author is going to then feel 100% better about it?
They are just another data point in the long list of authors who chose a permissive license and are then shocked when a billion dollar company takes advantage of it.
If they wanted a less permissive license, they could have used one.
> Spegel was published with an MIT license. Software released under an MIT license allows for forking and modifications, without any requirement to contribute these changes back. I default to using the MIT license as it is simple and permissive. The license does not allow removing the original license and purport that the code was created by someone else. It looks as if large parts of the project were copied directly from Spegel without any mention of the original source.
Can you share what you think the author is really complaining about?
What I'm not OK with is a company doing that without attribution. If XYZ company's product is built on code I wrote, I want to be credited -- both so that I can show it to potential employers, and so that users of XYZ company's product are aware that some of the code in it is something they can use for free and modify for their own purposes. If the attribution wasn't important to me, I would have chosen CC0 instead of MIT.
So yeah, if I was the author, I'd probably feel a lot better about if MS re-added the correct attribution. I'd probably still feel miffed that they tried to pull one over on me in the first place -- but I wouldn't be offended by the fact that they're using my software.
If I write something useful and convenient for people, something that makes peoples' lives better, it's probably not going to see a lot of use realistically speaking. I'm not out there making a name for myself, I'm just doing some stuff.
If Microsoft takes my code, turns it into a separate project with a separate name, distributes it as part of their own commercial offering, uses it in their marketing... great! It means that my ideas are making people's lives better. Yes, it's enriching a giant soulless megacorp who, at a high-level, does not actually care about how people feel and only cares about making money off my work, but I care about how people feel, and if it means that my work gets to make people's lives better then that's great - I wasn't going to make money off it anyway, so I lose nothing.
Unless they take implicit or explicit credit for what I made. I don't need my name on the marketing or an invitation to a launch party, but at least make a note in the docs somewhere that "this project was forked from ...." so that I can point to it and say hey, look at this cool thing I helped make happen.
I guess what would really irritate me, when it comes down to it, is not that the giant corporation did this, but that the individual developers did this - some dev out there found my project, decided to use my code, and made the conscious decision to strip out my attribution and claim it as their own. That's what would actually hurt.
MIT is commonly used for cases where you don't want to scare away potential corporate USERS by the "virality" of something like the GPL. This does not mean that the authors are completely fine with their work being repackaged and DISTRIBUTED as if the company wrote it themselves.
If you lose open source you lose a major resource. You should be looking for ways to protect these authors instead of explaining how "technically it's all actually their fault for being generous in the first place."
This position is absurdly scummy.
You don’t get to posture as anti-corporate while handwaving away an actual license violation just because the license was permissive. That’s not protecting the community - that’s making it easier to exploit. You’re not railing against theft, you’re normalizing it.
Either the community’s rights matter, or they don’t. Pick a side.
Quite the contrary. The licence does not have many constraints, but this one is important. Volunteer developers let their code being used in closed source commercial programs. Recognition is the only thing they expect and the whole point of the licence.
--Carl Spackler, quoting the Dalai Lama
What I see is that Microsoft added headers to their Peerd files. Now they read "Copyright Microsoft", which is correct because Microsoft owns some copyright over those modified files. If those files had had a "Copyright Spegel project" before, Microsoft should have kept it and added their own. But those files did not contain such a header as far as I can see.
Feels like Microsoft was not necessarily trying to steal work (they link the original project in their README).
Microsoft got tremendous value for free by forking. Which makes the obligation to deal ethically and honestly very serious.
You don’t get to take something from anyone without meeting the terms they have set for you to take them. That is theft.
(For clarity, I am saying theft of a right. As it does negatively impact the original creator, in terms of competition and lost attribution to the code they wrote, and Microsoft is not paying the “fee” that taking that right depends on.)
And no third person can can ethically speak for the source of the value and state that it’s no big deal for another party to break some part of a contract/license.
How do you know how much this aspect of the license impacted the original creators decision to share their work, their choice of license, or how they feel and and practically impacted about it now!
In this case, we know they clearly feel the violation was harmful to them at some level. They were snubbed, their work left unacknowledged, while Microsoft leached off them, even though doing the right thing would cost Microsoft essentially nothing.
Please don’t socially absolve the powerful from bad behavior toward smaller parties. That’s bad faith, after the fact, and you are not even benefiting from your own disrespect for the license. Always support the (credibly) injured party.
As for offenses against you, you have every right to be generous and overlook those.
(I once took a year sabbatical to work collaboratively on a project, with the presumed (based on what was a clear discussion to me) attributions being a key factor in me deciding it was worth the time and effort, when other factors made that a difficult decision. Only to have my attribution expectations unfulfilled, and no attempt was made by other parties to work things out. The situation was fraught enough that I couldn’t but help feel bitter about it for some time. I am long over it, but I would certainly take the year back if I could.)
Why "to be fair?" This is a trillion-dollar company with enough lawyers on staff to populate a small city.
Why are we cutting Microsoft slack? If anything, it should be held to the highest of standards.
As I understand it, changing the licensing will do nothing to affect the fork Microsoft already made. It might affect the next megacorp from doing the same thing in the future, but Microsoft can keep working on their fork without giving it a second thought.
This is for sure a cautionary tale for every open source contributor. Choose the original open source license very carefully.
Edit: Might I suggest that when picking the original license, you try to imagine how you might feel if the company that you hate the most (could be Microsoft, Google, Amazon, or other) does the most extreme thing allowed by the license.
Did they remove the copyright? All the source files I checked in Spegel don't have a copyright header. To me it feels like it's the author's mistake.
If the file starts with:
// <MIT header>
// Copyright evantbyrne
Then a fork should read:
// <MIT header>
// Copyright evantbyrne
// Copyright Microsoft
But if you did not add "// Copyright evantbyrne", the MIT license doesn't say that Microsoft should add it. I don't even know if it's legal for Microsoft to do it. You have to add your own copyright to the files where you own a copyright.
> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
It needs to appear somewhere regardless of where exactly the license was placed in the source repository.
They can still do it now, and probably they should (someone can even open a PR?).
You can open that PR, if you care to identify which parts were copied and label them all. Really, the people who copied the code in the first place should have done so, and really should have known better, given they work for a massive corporation that claims to love open source and has had a massive interest in copyright over the past three decades. It's not just a "mistake", it's unacceptable for a professional programmer for a corporation to take code from a FOSS project without crediting it. That's a level of incompetence bordering on malpractice for a profession that deals so heavily with copyright on a day to day basis.
edit: According to the MIT license, the notice itself just needs to accompany the code, so I was wrong about the specificity needed. Still, it does mean that any further forks would be unable to remove the license without personally identifying if all the original code was removed. It's always better to identify what code belongs to who.
Wait. When I contribute to an open source project without signing a CLA, I keep the copyright over the lines I contributed. Still, I don't add a comment above every single line saying that it belongs to me. Nobody would accept such a contribution. Even for fairly big patches.
Are you saying that every single open source project that does not make contributors sign a CLA is doing it wrong?
That's not the point, it is not the author's duty to do that and him pointing out Microsoft's wrongdoing is meaningful at least to me because I will be more cautious if I'm ever being approached in a similar way.
That's the thing: Microsoft approaching the author has nothing to do with the wrong attribution. And I am not sure if the original author here is frustrated because of the wrong attribution or just because they would have hope money and fame from the fact that Microsoft reused their code.
Because it's not like Spegel lacks visibility (given the numbers they shared in the article), the link on Peerd's README is probably not bad for Spegel, and the attention here is publicity again. Probably infinitely more than if Microsoft had done the attribution correctly.
Your point seems to be that the author should not have written the blog post and done a PR instead.
My point is that whatever the authors motives are and whether he did a PR or not, his blogpost was informative to me and has value on its own.
It may not be perfect for all cases (e.g. if some sort of dependency is linked but not present in the source tree it is naturally not really accounted for by Debian copyright files) but then there is always the options of either adding copyright information to every source code file (I don't like that style for redundancy but it is for sure a very clear way to do it) or to hand-craft a human-readable variant similar to the Debian approach but less formally.
In any case it seems that nothing is new aobut this and developers working with FOSS software should very well be aware of these concepts.
It’s why con contributor licenses agreements exist in most open source popular projects.
You should just keep the copyright that is already present in the file! But in the case of Spegel, I don't think that the files contain a copyright header in the first place.
The git history has a clear trail showing author and contributor details.
An explicit copyright notice for every file isn't needed.
This is a straightforward, unquestionable license violation, and no amount of corporate FUD will change that.
Of course, the author keeps their copyright on the lines of code. But that's completely different from how the attribution should be done.
Except that they did not do that. They forked it (as the MIT licence permits), added an attribution to their README, and added their own header to the files with their own copyright. It's not their fault if the original author did not add a header in the first place...
Or where do you see that they actually removed a copyright header from the author? None of the source files I checked in Spegel have one.
And no, their note in the readme is not an attribution. It's thanking them for "sharing their insights", which in no way is code attribution.
Microsoft violated copyright here, bar none. There is no other reasonable interpretation.
They actually thanked the project, it doesn't feel like they were trying to steal it. Maybe they will just accept such a PR and that's all.
And with the bad publicity coming back to Microsoft, maybe those engineers will now understand that they should just avoid re-using open source projects when possible. And the next HN post will be about "BigTech reinvents the wheel in order to have control".
We're all nitpicking here: they mentioned the original project in the README. Peerd is quite different from Spegel, it's not just a copy with a small patch.
Sure, they should do it right. But really, a polite, small PR fixing that would probably be a good first step.
> they mentioned the original project in the README
They thank them for their "generous insights". That's not the same thing. If I take chapters unmodified from Harry Potter and thank Rowling for her "generous insight", that's still not okay.
> Peerd is quite different from Spegel, it's not just a copy with a small patch.
Nobody said it was. It does, however, copy functions and other entire blocks of code with comments directly from Spegel without giving attribution. That is wrong. That is plagiarism.
Well, I have been in big companies where it takes a lot of time for the legal department to check those things. Not because it's fundamentally hard, but because the queue of things they have to do is pretty big.
> They thank them for their "generous insights". That's not the same thing.
Sure, it's wrong. But it's not "purposely stealing without giving any credit at all" either. It feels like an engineer did that, tried to give credit and did it wrong. And now we go on and on saying how this engineer is evil.
In this case I still feel like they are more attributing incorrectly (there is a link to the original repo with a "thank you" note) than plagiarizing.
If there was no mention of the original project at all, then I could call it "accidental plagiarism".
Forking and/or copying files from the Spegel code base into the Peerd code base is permitted, but since the Spegel code base had a single license file covering the entire repo, then the onus is on Microsofts engineers to update the code they copied and include the original license terms, for example, by including something like:
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.
// Some code Copyright (c) 2024 The Spegel Authors, under MIT license
If your argument is that they aren't required to do this because the original code didn't have a license header in the file, then it would follow that you are arguing that the MIT license doesn't apply to the code that was copied, in which case Microsoft is using unlicensed code stolen from an open source project.
While I haven't worked at MS specifically, I would assume that like every other tech company I have worked at, they have a team or working group that specializes in adherence to open source licenses specifically to avoid both the legal implications and the bad PR implications of misusing open source software.
My point is that Peerd seems like it's loosely based on Spegel. Maybe a fork that was heavily modified. Not sure if they should track all the code that looks like it was not modified enough and attribute it everywhere.
Probably they should keep a copy of the original LICENSE file somewhere, sure. And if one asks politely, maybe they will do it.
Again: they did credit the original project. So it feels a bit aggressive to say that they "stole it without giving any credit".
Fair use allows for commentary, news reporting, criticism, teaching, research, and scholarship and there are guidelines. Most cases where fair use is sought as a defense requires litigation to clear it up. The other alternative when forking an extremely permissive MIT license is to just follow the license.
> Probably they should keep a copy of the original LICENSE file somewhere, sure. And if one asks politely, maybe they will do it.
They are required to do so by the original license of Spegel. Does Microsoft ask politely when people violate MS licensing by say, pirating their software, or do they work with 3 letter agencies and a massive enforcement team to ensure their licenses are followed?
> My point is that Peerd seems like it's loosely based on Spegel. Maybe a fork that was heavily modified. Not sure if they should track all the code that looks like it was not modified enough and attribute it everywhere.
Yes. Every other tech company I have worked at, including Mozilla, a company that publishes almost everything they do as open source, has had folks dedicated to ensuring license compliance.
> Again: they did credit the original project. So it feels a bit aggressive to say that they "stole it without giving any credit".
They didn't provide credit in the way that the license requires. This isn't a case where a new community member forked or copied code into their first open source project. This is one of the biggest companies in the world with a well-known history of taking and using OSS without proper attribution. I like and use many MS products, but they absolutely do not deserve the benefit of the doubt.
Next time you work in a big company and you feel that the legal department is a PITA and slows you down, remember how people react when they are not, like here :-).
The team that built peerd had the good sense to consult with the author of Spegel before moving forward with their project. A simple note to their business line lawyer (or whatever they call them at Microsoft) at work to say "hey, we are going to use some of this code from this open source project, what do we need to do?" would have taken less time and effort than setting up the meeting with the Spegel person/folks. That is assuming there isn't an easy to find page on how to consume open source software on Microsoft intranet. Every major company I have worked for (HSBC, Mozilla, Amazon, Fastly, Cisco, to name some) has had this going back to 2005. This isn't rocket science.
You also don't need to be a legal expert to comply with most open source licenses, and the MIT license in particular is really easy to comply with. Just copy the code, and whatever file you copy the code into gets an attribution comment at the top.
I would be in favour of checking what small companies do with licences. In my experience, the vast majority of startups blatantly abuse open source all the time.
But here it seems like it's all about an engineer who did some kind of attribution, but didn't do it correctly. And people are happy to say that it's all part of a big evil plan by Microsoft to take over the world.
This is not that though. Seems to be exactly what the maintainer is asserting and that's not OK. :/
I have seen plenty of dev managers refuse to pay for something if they didn't have to.
It's not the money, it's the red tape. Setting up a new vendor, finding the right account, getting the PO approved. Even in a company where that stuff is relatively easy, it's way more friction than a simple meeting where you don't have to ask anyone for permission for anything.
Oh I do.
The person that wanted to setup the meeting likely has no budget control. Big corps like to keep the ability to pay for stuff out of the hands of individuals and isolated in bureaucratic nightmares.
You'd be more than reasonable to demand "$1000/hr with 1 hour minimum" for such a consulting and I'd see HR in MS doing an immediate "hell no" to that.
At least in my company, it very much depends on who's initiating the meeting. If one of our VPs did, then easy, any amount could be approved. However, if it's a team lead, we'd be told to pound sand.
I assumed other companies would be pretty similar.
I'd say my experience is exactly the contrary. Middle managers in my experience in mega corps have a lot of expense latitude for these kinds of things, expedited approvals, corporate credit cards. At least in the finance and tech world.
Normal people aren't constantly engaging in a fight for survival in every aspect of their lives, and I don't think it's a good thing to ask them to. We should expect the people we deal with to be acting in good faith. I think it would be bad actually if I had to consider if you're going to make money off of my idea when talking to you.
Asking everybody to be constantly vigilant of possible exploitation by megacorps puts an undue burden on individuals. We should have strong and durable protections against those megacorps in other ways.
What I'm saying is that this sort of copying should be criminal (not just illegal, but criminal) and Microsoft, the legal entity, should be held accountable and fined. I acknowledge that this isn't currently possible with our legal framework, but we should work to make it possible.
like what? continue to use (pay) for their products and wait for regulations coming from lobbyist countries? /s
I agree with you, if we're talking about people acting as individual humans collaborating together on FOSS.
But this is really about a for-profit corporation acting in its own interests, using people to do its "deeds". Then I think it makes a lot of sense to treat any "Hey, could we chat to you about your project?" with a great deal of skepticism, because they have a goal with that conversation, it it's unlikely to align with your own goals, in most cases.
Ultimately, people from that corporation is reaching out to you because there is a potential/perceived benefit coming out of that conversation that they want to have with you. If it isn't extremely clear to you what that exact benefit is, I'd say the smart thing to do is being cautious, to avoid situations like this which happen from time to time it seems.
You’re not bilking Ed’s Garage, you’re a rounding error on their petty cash account.
https://zedshaw.com/blog/2022-02-05-the-beggar-barons/
> No, this begging is particularly different because it capitalizes on the good will of open source developers.
> Microsoft, Apple, and Google are standing on the internet in their trillion dollar business suits with a sign that reads "Starving and homeless. Any free labor will help."
> They aren't holding people up at gun point. Rather they hold out their Rolex encrusted hand and beg, plead, and shame open source developers until they get free labor.
> Once they get this free labor they rarely give credit.
> They're ungrateful beggars that take their donated work hours, jump in their Teslas, and ride off to make more trillions proclaiming, "Haha! That open source idiot just gave me 10 hours of free labor. What a loser."
It's time we switch to "fair source" or "equitable source".
Put MAU/DAU/ARR/market cap limits in your license. Open to everyone with a market cap under $1B or revenues under $100M. All others, please see our "business@" email.
Place viral terms like the AGPL that requires that all other systems touched by your code to be open - especially the backend/server components that typically remain hidden.
We're giving away power to these companies for free, and they use their scale and reach to turn our software into a larger moat that ensnares us and taxes us in everything else we do.
Your contribution of open source in one area might bubble up as Microsoft or Google's ability to control what you see or how you distribute software to customers. It's intangible and hard to describe these insane advantages and network effects big players like this have to lay people, but I know we as software engineers understand this.
Open source has been weaponized against us. They get free labor and use our work to tax us, pin us down, out compete us, and control us. We need to fight back.
"Open source" was literally created as a corporation-safe neutered form of "free software".
It's very akin to the paradox of tolerance.
I’m still tweaking the execution of the license, but in principle my thinking is, “if you’re using my software to make money, and you’re making a lot of money, you should probably be paying me to use my software”.
A shame though it is, helping everybody the same amount is not likely to get your much gratitude from anyone. But that's the job.
That would also mirror what they do with tools like Visual Studio, which is free until you hit a certain number of developers or revenue.
Most software isn't hard to reverse-engineer, and most people aren't exceptional; if a group is big enough to create a GPL-licensed product that competes with Microsoft's, they're big enough to create an MIT-licensed product that competes with Microsoft's.
I like GP’s comment “don’t discuss anything in private and/or offer priority support without being paid”. Also:
- Ensure you get attribution, and support others who deserve attribution
- Develop open-source alternatives to paid programs
- Donate to others who write open-source
I disagree that open-source contributed much to companies becoming so rich. I believe it was more that people gave them (money and) private data, e.g. made posts and interactions that only exist on their locked-down platform. I doubt a lack of open-source and accessible development tools would’ve prevented Google and Facebook; if anything, they would've been founded by richer or more networked people. And it certainly won't prevent them now.
> Open source has been weaponized against us.
This was always going to be the case. We Free Software advocates have been saying this for decades.
And you're not even to the most important part: this isn't about you, me, or megacorps. It's about users.
"Hey, that guy worked with the author, and he was hired and now is a super top dog there... he must be the true genius behind it"
I mean that for ideas, not materialized code. You guys are so focused on small text files and miss the big picture sometimes.
Licenses are a small angle for those things.
https://sfconservancy.org/copyleft-compliance/enforcement-st...
Also, GPL is about source code, not ideas. Source code is not that relevant.
It was created because Linksys shipped GPL code to customers but didn't provide the source.
My work is with DSLs: domain specific languages. The work is in the idea realm (most of the time is spent there), not the source code implementation, which is often trivial once the language is developed.
The gratification also is different. Seeing others use the language is the best one can hope to achieve nowadays. Maybe publish a book about it, but that sounds more trouble than it is worth (judging by how books on patterns, a similar realm, are often misquoted and misused).
That's why all this talk about licenses sounds like nonsense.
I could have kept it a secret and made a book about it, tying my name to it forever.
However, I want my domain specific languages to run free. People not getting in my nerves about them anymore would be enough compensation.
I agree with you 100% but I'm guessing getting approached by Microsoft can be pretty ego boosting, which is what these companies exploit.
On my end if was a mix of naivete and flattery which made me want to take the meeting. I suspect it is the same case for others. I will not make the same mistake the next time it happens.
I grew up thinking that people would follow the spirit of open source rather than the specific letter of the law. This is obviously not true, and probably never has been.
Clearly it doesn't because companies get caught doing it with GPL software all the time.
... and the only recourse is to sue them into compliance.
Hence my thinking there is. I kept thinking EFF for some reason, but I knew that wasn't right. EFF are the ones who consistently predict which anti-privacy/anti-consumer laws will definitely get passed.
IMO, this is fundamentally a mismatch between how software is developed in practice and how copyright works.
If software was like a book, where it's finished and published once, then simply registering it with the copyright office would be all anyone needs to do: up to $10k/copy statutory damages is a stiff enough deterrent that few large companies would want to take the risk. And even if they did, it'd be easy to find a lawyer to take the case on contingency.
As a non-lawyer, that doesn't seem to match nearly as well with software as a constantly evolving work. But I'm not an expert - maybe periodically submitting versions is enough.
Large corporations should and can be extremely clear about their intention, which is clear to them before they reach out.
So eventually, with this bad publicity, they will add the copyright notice, and move on with whatever else they are doing, in full compliance.
Microsoft might not have fully complied with the licence, adding the copyright notice to fix that, won't change a millimeter from what they are doing.
Sure, the MIT is very permissive so it's very easy for Microsoft to correct their repository so that it's in compliance for the future, but they cannot correct the past. (Unless the original authors allow for it.) The MIT license, being so short, does not have a provision about curing infringements.
So Microsoft seems to be ok with the risk of being sued for infringement etc. That's not something you can correct with your personal decisions as author.
The comment above, which I mostly agree with, is that the point of the MIT license to permit anyone, including large corporations, doing this kind of thing. Since this doesn't seem like an outcome the author is happy with, maybe a different license would be better.
I don't think Microsoft removed the copyright notice. I think that the original author did not add one...
The license doesn't have to be in each file. It's a license for the software. A software is a thing.
> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files
> ...
> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
You:
> I don't think Microsoft removed the copyright notice. I think that the original author did not add one...
Direct quote that from the file containing and requiring the copyright notice in derivative works that was not included in Microsoft's fork. This was also included in a comment which you have replied to:
> The above _copyright notice_ and this permission notice...
I thought people were saying that Microsoft removed the copyright headers and replaced them with them, which they did not.
Microsoft replaced the LICENSE for the whole repository with their own, and thanked Spegel in their README. While this is some kind of attribution, it's not enough for the MIT LICENSE. I don't know exactly what would be good enough, I think having a copy of the Spegel LICENSE file somewhere in their repo would be enough (though possibly less visible than the line in the README, to be fair).
My overall point is that it feels like people are complaining a lot about what seems to be an honest mistake. And not just that: the way Peerd did it is arguably giving more visibility to Spegel than if they had just copied the licence somewhere in their repo. Peerd could possible just copy the licence somewhere less visible and remove the link from their README.
Anything else is noise, they violated the license. They blatantly copied copyrighted works. They can't "oopsie" that away or claim it as a mistake, honest or not. You simply are not allowed to do that.
Suggesting that they "could possible just copy the licence somewhere less visible and remove the link from their README." is wrong. They MUST include the copyright notice and the rest of the license. They don't get to choose whether or not to respect the license. And they don't need to remove the link, That's got nothing to do with the copyright issues. No one at Microsoft thought that call out was somehow the legally required attribution clearly explained in the MIT license.
You do realise that those two statements are not incompatible? If they include the licence somewhere less visible and remove the link from their README, they are still including the copyright notice and the rest of the licence.
The MIT licence does NOT say that you MUST have it at the root of your repository in a file called LICENSE. It does not say that you must clearly identify the parts of the code for which you don't own the copyright or anything like this.
You can read it here: https://opensource.org/license/mit
Like saying I choose to not be the richest person in the world. Sure it could be technically true, but the statement is incorrectly implying that it's up to me, or within my power to make the alternative choice.
It's very strange that you keep using these intentionally awkwardly phrased, misleading-adjacent statements.
The rest of your comment is attempting to refute something no one made a case for in the first place, which coupled with the rest of it makes it seem like you are just trying to argument-bait, so I'll tap out here.
Well, maybe I just can't English :-).
They must include the copyright notice and the permission notice. Now I can imagine different ways to achieve that. They could use one or the other, as long as what needs to be included is included.
Depending on how they do it (while staying in the realm of what they MUST do, i.e. include the copyright and permission notices), it gives more or less visibility do Spegel. My point was that linking to Spegel in the README arguably gives more visibility to Spegel than alternatives that they COULD choose. And to make it very very clear: what I consider alternatives that they COULD choose are those that honour the licence.
So what does Microsoft need to do to be in compliance? I'm not being facetious here. Genuinely curious/want to learn.
If you pick a corporate charity license, don't act surprise when corporations take the charity!
Cloud providers have long taken hard work of open-source projects and packaged it up to be a web administered solution.
There is something to be said for putting together an experience. Including that it wouldn't be possible without everything it does.
Also as polyglot developer, while I happen to have my preferences in regards to technology, I am not married with any of them.
Being MVP, Champion, or whatever program each megacorp happens to have, was never something I saw value in.
Never make a specific technology, or company, part of your identity as person.
As I said, I have misconceptions of .NET, so it is always useful to get to the bottom of it.
Hot reload in general is difficult to make work in something that is mainly compiled, for example it does not work with F# right now, but there is someone in community working on making it a possibility. It's regular activities you'd see in other ecosystems.
E.g. I think NetCoreDbg, as an alternative to closed vsdbg that has usage restrictions, works well enough to fully enable the standard workflow when using VSCodium/Cursor/Neovim/etc. I know people use the latter with both C# and F# without sacrificing user experience in comparison to languages like Rust. It's just text editor, language server + debugger integration and CLI. You would hear about "refactorings" and "advanced features" from those who are used to more IDE-like experience provided by VS or Rider but, for example, many refactorings are also available in VSC/VSCodium because they are just a feature of the language server based on Roslyn analyzers and auto-fixers. It works with anything that integrates that and the language server itself ships with SDK to my knowledge.
All in all, the tooling situation is pretty good with multiple IDEs, commercial and community tools offered to be able to program in .NET languages, most languages HN loves to sign praises to do not have this. The same applies to GUI frameworks too - it's funny to read how .NET is "anti-linux" because out of AvaloniaUI, Uno, MAUI and a bunch of smaller libraries MAUI does not happen to target Linux. Some people just like to hate something, and if the reason for that goes away they come up with a new one.
Drop them a consultation fee in the thousands per hour, get something out of it at least. If they're going to reimplement your project, there's absolutely 0 you can do, they will just hire an intern and tell them the requirements for what you have built without having to meet you, ask them for expenses out of your day covered.
> Gates: ( fiendish laughter )
Edit: apparently Google did not use the author's codebase, instead using an Apache 2.0 licensed codebase [1] explained here [2].
[1]: https://github.com/kubernetes-sigs/gcp-filestore-csi-driver
It's as if we've learned nothing about exploitative corporation behavior for the last 20-30 years even though it's in the news EVERY other day.
And here we are …
I think it's important to highlight that the "Microsoft <3 Linux" narrative deserves some scrutiny too: (https://old.reddit.com/r/linux/comments/lbp1m8/for_anyone_th...)
"without attribution"?
Did we read the same article?
To me it's the Spegel author's fault: there should be a copyright header in every single file, such that Microsoft would have to keep it.
Now if it's not the right way to do it, what about opening a PR and asking to change it? Instead of writing a blog post to complain about them?
Now maybe those engineers thought they did well, will get issues internally because of the bad publicity for Microsoft, and next time they want to use an open source project their legal department will be even more of a pain in the ass because if they aren't, then random people on the Internet use that to do bad publicity for the company.
Why not assuming that they are in good faith here? There are enough reasons to hate Microsoft other than this one.
When you depend on a third-party, you don't add their copyright in your main LICENSE file.
In this case the code is essentially forked, integrated and intermingled, so that is why it should be in the LICENSE file.
If it was file or two, it would be fine to add a comment pointing to the license file in the repo, if it was a directory, or to copy it verbatim to that file. It all the copied code was in a directory then having it in directory would be fine.
In this case it looks like they took the original code and heavily modified it, so the simplest way to solve it is one LICENSE with both notices.
I don't think that the licence asks to do anything like that. Where in the MIT licence do you see that?
If some of the peerd code was lifted from Spegel, it's blatant stealing. Code attribution is the only thing a MIT license asks people to honor, and Microsoft couldn't even do that.
Could we say "it's incorrect attribution"?
> and Microsoft couldn't even do that.
Did you consider it may have been done by an engineer who, in good faith, thought they were giving proper credit by adding it to the README? Would you want that engineer fired because of the bad attribution?
It's not like Microsoft is making millions out of this. Sure, they should fix the attribution. It's a mistake.
Most startups/small companies I've seen rely heavily on open source and fail to honour every single licence. This is bad and nobody cares. Here, Microsoft mentioned the project in the README (which is not enough, but not nothing), and I'm pretty sure that they can fix it if someone opens an issue. But overall, companies like Microsoft do honour licences a lot better than startups in my experience.
BigTech is evil for many reasons, but maybe we could consider that this is just an honest mistake.
But corporations hiding behind their workers is a no-go. Corporations get to enjoy their successes, and it's fair to hold them accountable for their failures. Least Microsoft can do is a bit of public comms work detailing what they will do to ensure these mistakes are not repeated in the future.
From the authors reaction they chose the wrong license for the project.
Both myself and my other half have separately been directly on the receiving end of the "brain rape" by major companies that everyone here will have heard of, both of which went nowhere except for the supposedly interested acquirer to become ever more angry that the crown jewels were simply not offered up on a plate.
This situation is surprising in that he did get an acknowledgement at all. These companies are not good actors, and have a casual disregard for the IP of everyone else that should be immediately obvious.
I’m assuming the complaint is more about Microsoft duplicity in asking for information as opposed to the forking of the code. The latter is fine - the license explicitly allows it.
> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
Microsoft didn't follow these terms. They copied "substantial portions of the Software" and didn't include the notice.
In my opinion, it's the Spegel author's fault: they should have added a notice in every single file!
https://github.com/Azure/peerd/blob/main/LICENSE
If you read that file you'd think that Microsoft was the copyright holder, but they very clearly aren't.
Peerd seems very different from Spegel, so Microsoft does hold quite a bit of copyright over Peerd.
Now I genuinely wonder if the main LICENSE should say "copyright Spegel and Microsoft", or if somewhere in the repo Microsoft should just have a copy of the Spegel LICENSE file?
a) Keep any code that you've pulled in from another project in its own directory structure with a license file indicating where it came from and its licensing terms.
b) If you intend to modify the code or integrate it more tightly with your own, copy the notice into each source file that was taken and perhaps put a pre-amble along the lines of "Portions of this file were copied from XXX under the MIT license as follows:". Ideally you would make a commit with the file in its initial state as copied, and then if you ever need to determine what came from where and how it was licensed, it shouldn't be too difficult.
It just says that some people put a lot of effort into making sure that they could easily prove that they didn't infringe copyright.
Give them a (somewhat) open source IDE and they start believing you are friend of open source in general.
Open source license is there for reasons, he can sue them if they did it wrong.
Can’t they just read the source themselves? Why do they need the maintainer?
And this is done by the owners of Github. Throw away open source licenses, create your own, make anyone who forks your code perpetually pay for your work, or ask money for your work.
"Luckily, I persisted. Spegel still continues strong with over 1.7k stars and 14.4 million pulls"
Yeah, your time is your most precious resource and what you get in return? Recognition? virtual stars, pulls, essentially numbers, essentially nothing. And then you get robbed.
WAKE THE FUCK UP PEOPLE.
Contributing to someone else's open source project is for schmucks and juniors. Authoring a "new" open source project in the company's name, getting recognition and solving problems is seen as "leading the industry" and whatever other wankery sophistry they come up with to try to motivate employees with.
Because all these actions will get associated with .NET teams even if the latter go to great lengths to collaborate with community and ensure that new feature work does not step onto the toes of existing popular community libraries (for example Swashbuckle or eventing/messaging framework that was postponed/cancelled not to interrupt the work of other libraries including MassTransit, which is a bit ironic as MassTransit went full commercial later).
https://www.youtube.com/watch?v=_STfy0QQjJY
Also, many large orgs are known to do this.
Billion dollar companies are not hanging out with you to be your friend, even if you're at the table for a reason (you belong there because you know something they don't).
When speaking with big companies, you are not there to impress them.
Speak for impact + meaning, they are so big and brilliant and rich and should already know how.
There are examples where a large corporation simply sponsored the developer and development of an open source project. This should be the way.
https://www.latimes.com/archives/la-xpm-1994-02-24-fi-26671-...
They've engaged many naive people/companies, milked them of their knowledge after signing NDAs, and then stabbed them in the back, stealing eveything.
They're big enough, and have unlimited legal resources to vigorously defend any legal challenge, and also to launch legal attacks at will.
After the DOJ anti-trust case, they preemptively put every major law firm on retainer, so nobody else could retain them in an effort vs. Microsoft, without creating a conflict of interest.
They are still evil, but less so after Gates and Ballmer.
If Matt Groening thinks you’re a gaggle of assholes you’re probably even worse.
i disagree with that. factual? sure, but unbiased? why? it's your project, and you have every right to be biased towards it. on the contrary, i expect you to, and i actually believe that not being biased towards your own project is very difficult so that i don't expect many people to be able to not be biased.
How can you not be biased? You built something. You want people to use it (assumption).
> fix: amend copyright attributions #110 > > This commit amends copyright attributions that were omitted due to an oversight on part of the Peerd authors. Copyright header attributions in a few files have been updated to include "2023 Xenit AB and 2024 The Spegel Authors". The attribution in the LICENSE file has also been updated to reflect the same.
It's not a new practice, and it's not exclusive to Microsoft either, it's something every developer should be acutely aware of, in case they're interested in avoiding it.
I’m still salty about teaching someone something they didn’t know about caching in an interview and not making it to another round of interviews after that. If it was a huge company I’d be furious.
I analyzed the 2 repositories for copy/pasted lines using PMD's CPD (copy/paste detector) - using the first commit of peerd and one from spegel that was from around the same time.
There are some clear duplications, e.g. 178 lines here: https://github.com/Azure/peerd/blob/64b8928943ddd73691d0b5d8... correspond to this: https://github.com/spegel-org/spegel/blob/ed21d4da925b9a179c...
Also 44 lines here: https://github.com/spegel-org/spegel/blob/ed21d4da925b9a179c... and https://github.com/Azure/peerd/blob/64b8928943ddd73691d0b5d8... but the full files are almost identical, only a few edits that break the complete equality.
Also https://github.com/spegel-org/spegel/blob/ed21d4da925b9a179c... matches https://github.com/Azure/peerd/blob/64b8928943ddd73691d0b5d8...
I haven't looked deep enough to see how much of the differences are obfuscation and how much are meaningful changes. File names are all changed, many structs and variable names as well.
See this gist for full list of duplications: https://gist.github.com/corneliusroemer/c58cf0faf957d9001b58...
Here it is:
Copyright (c) <year> <copyright holders>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included
in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
IN THE SOFTWARE.
What's good about being "permissive"?
I keep hearing this argument, but I still don't understand, what's the incentive for authors of one-man projects to choose anything "permissive".
Do you enjoy your project getting forked, walled off and exploited for profit by someone who has never done you any good?
AGPLv3 still allows forking, still allows making profit (if your business model is sane). But it is at least backed by some prominent figures and organizations, and there are precedents where companies were forced to comply.
That said, I fully support larger projects being GPL, which I think is a more reasonable license for projects that involve dozens or hundreds of contributors and are depended on by millions around the world. But the role of the MIT and Apache style licenses has always felt a little more confusing.
I've also leaned toward CC0-style licensing for some of my smaller projects, that are shared for explanatory or artistic purposes. The reasoning is that GPL-style licenses give the code its own 'weight' as a unit, that keeps others from lifing good ideas from the code and incorporating them into their own projects as they wish, at any point in the next ~135 years. (The barriers aren't just the stereotypical "how dare they make me share my code!" but also the realities of license compatibility, having to make sure never to lose any version of the source, and so on.)
I agree with GP that this isn't necessarily the best idea for large projects that exist for their own sake and that companies might find great profit in copying. But it's not like all projects fit that description.
During ZIRP-boom-times, having a successful popular open source project could be a ticket to kudos and a high paying job and a certain level of responsibility and satisfaction. BigCos spread the money around, and your job as a SWE ended up being gluing together a bunch of these open source pieces to solve corporate problems. And on the whole people felt like their corporate jobs were giving a fair deal, and a decent dividend for the open source work they were doing.
In that context why would you pick a license that your generous employer couldn't use?
The GPL and the free software movement is borne out of an earlier era, GenX and younger boomers who lived through seeing their hard work exploited and stolen from them. Or corporate entities that cut budgets, laid people off en masse, exploded in stock market crisis, etc and suddenly the good will was lost.
I think we'll see a bit of a resurgence in the GPL, as some people try to protect the work they've done.
(I do thnk the personality of Stallman himself has become a bit of a problem to be associated with)
On one hand we have a guy, who just pointed out that the age of consent is a culture-dependent concept. On the other we have a guy who literally visited Epstein's island to fuck minors (as defined by his country of residence).
One is now considered "a bit of a problem". The other is a beloved public figure.
There may be something to that, but speaking as a GenX'er myself, I release most of my OSS code using the Apache License. I really don't care if anybody - from a single student in a 3rd world country, to a Fortune 50 megacorp - uses the code, so long as they abide by the license.
I'm not going to say there's NO circumstance where that might ever change. But to date, that's been my approach and I don't particularly see it ever changing.
I mean, consider an alternate timeline. It's clear MS had their own, strong vision for the project, that overlapped with but wasn't identical to his. Is it actually that much more considerate to show up with two dozen new developers suddenly flooding a single-maintainer project with pull requests, some of which completely restructure the code and re-orient it towards a new vision that the original maintainer might not want?
Either the maintainer is now doing loads of unpaid labor for MS, and is the bottleneck; or he ends up having to step back and let the new MS developers bulldoze the project and take it over anyway.
What would have been a better approach?
i.e. they could have emailed the author to ask:
1. "Would you rather us fork your project (new name), or would you rather donate your project to us under its original name, as well as give us the ability to rename it (which we will)"
2. "Would you like a $300 microsoft store gift card as thanks for writing some code we're planning to use?"
3. "Would you be open to providing a paid ($600 microsoft gift card) 1-hour consulting meeting to ramp our engineers up on your codebase? We won't actually listen since our engineers can in fact read, but we'll pay you"
4. "Also, just in case you don't know who microsoft is, we do have a careers page over here, and our team doesn't have headcount but other teams do <link>"
It sounds like microsoft didn't do any of that, which as you say is well within their right, but emailing to ask is polite.
In fact they do distribute and contribute to lots of GPL software, including Linux. I can't be sure their involvement benefits anyone other than themselves, but theybdo at least participate.
systemd author is employed by Microsoft.
Depending on your views on MS and systemd, that's either a net positive or negative for the linux community.
A tactical move in both good and evil MS scenarios.
Hell no. If they want to profit off my work, pay me. This is something I'm doing for fun, on my own terms. It’s Free for anyone to use as they want, so long as they keep it Free, too.
Only open source it if it fucks big tech. E.g. bittorrent or an alternative browser. Or an app on your local machine as a SaaS alternative.
We are no longer talking about open source software if you distribute blobs in place of source code.
Any court cases supporting this form of liability?
The author of the GPL code can release binary-only blobs released under something other than the GPL. Suggesting that the copyright holder cannot relicense their code how they want is absurd.
Saying the "GPL does not allow binary blobs" implies that the author is not allowed to release binary blogs, which is not true in the slightest.
The Free Software Foundation (FSF) describes this copyleft aspect of the GPL in terms of "derivative works" associated with GPL-licensed software. When two components are related to each other in a derivative way, then the GPL says that the derivative must likewise be licensed accordingly.
So in this example, does win.bat simply execute commands to get win.com started? Is win.bat a glorified shell script wrapper? If so, then win.com would NOT be derived from win.bat. The cart follows the horse. But instead, if win.bat exposed some symbols or other binary API features that win.com was coupled to and depended on, then you could rightly argue that the win.com would be a derivative of win.bat.
More practical of an example, if a database is licensed under the GPL, clients that connect to the database using the socket interface do not constitute a derived work. Or components in a micro-service architecture do not necessarily need be licensed all under the GPL when a single component is.
Pluggable architectures are possible with the GPL. And of course, your interpretation of what exactly that means is subjective and requires case law to help understand.
[edit]
And to reinforce what the parent of yours is saying, the author in the original example can do whatever they want with the software, since they own the copyright for both the GPL and proprietary components.
The GPL is simply a license for non-copyright holders. It allows others to be able to use a piece of proprietary software without having to establish any additional authority with the owner. e.g. it's the means to convey how others can use the software and does not constrain the owners/authors of the software. Other licensing options may be available, if the copyright holder allows.
>>> At this point I'd include some of the code as binary blobs and "pay me for the source!". In addition to GPL!
So, the proposal is to hide the source code and IIUC if someone does this, the whole complete project can not be released as GPL.
Give downstream how much they are willing to give upstream.
The incentive is generally that people enjoy having their projects used, be that by commercial companies or otherwise.
That's the point!
GPL family of licenses would've made a difference in this aspect for libraries (because afair if you link to GPL code, you must be GPL). But for an app? You can use it, fork it, modify it... Just make sure you make your changes available under the same license. Seems very fair to me.
In practice, it does in many cases. Many companies have a blanket policy of avoiding these licences. But I agree that they make more sense for apps than libraries.
The GPL licensed git.
If I'm forced to use MacOS, I'm fine installing git, GNU make or whatever I want for myself. But I don't see any downsides in Apple being unable to distribute those applications together with their OS.
Why would they do that? I didn't, because macOS ships with version 2.39.5 as /usr/bin/git. You're free to upgrade to a newer version, of course, but the included one is recent enough for most uses.
And my point was: this is fine. Even if it was true.
But as this is not the case, I see even fewer arguments against GPL licenses.
It only governs distribution and especially prevents distributors from locking their users in, and from placing restrictions on their users' use of the software.
If the service provider is the "user," and performing actions with it on behalf of the ultimate user is "use," and not "distribution," then you are technically correct. It restricts the service provider from forcing their customers to be dependent on the them and/or restricting the end users' use of the service, like the GPL does for proprietary software the user runs on their machine.
I personally disagree that running something on behalf of a user makes you the end user, but there's always the GPL if you think that.
Think: smartphones (Android), routers, smarthome/IoT devices, other embedded devices.
Linux developers made an intentional decision to stick with GPLv2 and to remove the "or later version" option, so you can't include it into GPLv3 projects as you can with most other GPLv2 software.
GPLv3 avoidance is why Apple ships ancient versions of Rsync, Bash and Make on its current OSes instead of the current versions, and replaced Samba with its own inferior SMB service.
If software is GPLv2, it's penalized relative to more permissive options when it comes to picking one. In practice it means that it's avoided unless it's "too big to avoid", or because the very nature of what you're doing requires it - this is the case for e.g. Linux and R.
If software is GPLv3, it's considered radioactive and is avoided at all costs, even if it means rewriting large amounts of code from scratch.
Then again I've seen companies publishing stuff on GitHub, when asked about the license; slapping GPLv3 on it but also forcing you to take a license with them for commercial use. Yea no, thanks. You just made a poison pill somehow even more lethal.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
https://fsfe.org/activities/gplv3/patents-and-gplv3.en.html#...
Eben Moglen speaking at the GPLv3 launch, January 16th 2006
...
We recognise that for parties who have extensive portfolios that are extensively cross-licensed, what we are saying here for the first time creates questions concerning their cross-licenses in relation to their distribution.
We recognise also that to say that you must "act to shield" is not explicit enough. We recognise that this is a very hard problem and though we have worked long at it we have no unique solution to offer you, even as a beginning for conversation.
...Like seriously, maybe Oracle comes and sues Apple for patent infringement, and Apples only defense is to counter sue Oracle for using bash on their Macbooks?? They lost that defense when they stopped distributing bash, why not just distribute it under GPLv3 anyway?
Let's say {some company} and Apple have a cross patent licensing for some set of patents.
Apple releases some softer under GPLv3. {Some company} sues someone else for a patent in bash. Since Apple licenses that patent and distributes bash, Apple is now obligated ("must act to shield") the distribution of bash that includes that patent.
If you distribute a covered work knowingly relying on a patent license, you must act to shield downstream users against the possible patent infringement claims from which your license protects you.
https://github.com/apple-oss-distributions/bash/tree/bash-13...
There's Apple's bash distribution. If this was the GPLv3 version of bash and apple distributed a version that {some company} decided was infringing, and {some company} sued you - "I got it from Apple. Apple Legal, help me."
It really does. It stops it being used by people who need or want to use other licences. I believe it stops it being used on iOS and (probably) Android apps. The GPL world and the permissive licence worlds are walled off from each other in significant ways for lots of reasons.
Source: I maintain an app where I didn't choose and can't change the licence. And I come across code I can't touch almost every week.
I fully agree that (A)GPLv3 code effectively stops code from being used by many large companies (every place I’ve worked in the last decade has a near blanket policy on refusing to use code licensed that way except in very specific and exigent circumstances), but it isn’t necessarily true that app developers can’t use (or can’t choose to license) (A)GPL code in their iOS apps, provided they abide by the terms of the license.
Most developers won’t — or can’t — but the advent of dynamic linking of libraries in iOS, as well as the EU-mandated third-party app stores (which aren’t available outside the EU, but still), make the situation a lot more grey from the black and white stands the FSF attempted to take in the early 2010s. And to my knowledge there have been no legal challenges about the use of GPL code in iOS apps, so the issue is essentially unsettled.
That said, in most of the cases where I have seen iOS apps use GPL code, the full app source was available (and that may or may not fulfill the redistribution requirements but I’m not a lawyer and I’m not going to cosplay as one).
On Android, where full Google Play alternatives like F-Droid are available, plenty of GPLv3 apps exist, even if they aren’t available on Google Play.
But yes, when it comes to incorporating GPL code into a non-GPL app, that is much more difficult in the realm of mobile than it is for other types of applications.
I'm not sure you can dynamically link to GPL in this case (LGPL maybe )? And I recall that there's also issues around signed bundles used on the various stores.
But the fact that we're not sure and the fact that we're having this conversation rather proves my point. People who aren't fully in the GPL world usually have to steer clear of GPL code entirely. This goes double for hobbyists and small orgs who can't afford a legal team.
> even if they aren’t available on Google Play.
As much as it's regretful this is a huge issue for most people who want to make apps that other people can use.
If there was no other choice, I may consider something LGPL or with the linking exception, but not until I had exhausted a search for something more permissive. To this day, I've never used GPL in any of my code, open source or closed. I've been writing code for 35 years daily.
Why? Do you also avoid libraries with an even number of consonants in the name?
Nevermind that Red Hat built a billion dollar business on top of GPL licensed code. Never mind the millions of embedded systems being sold with GPL code in them. Nevermind Google, Facebook, Netflix, etc., etc. all eating Microsoft's lunch a thousand times over using GPL code. Businesses better stay away! It's dangerous!
The more limitations added on a license, the less open it is.
It's unintuitive, but permissive licenses are not the best way to acheive this. GPL's "limitations" are designed to maintain the right and abilty to remix code for the end user. So if say Microsoft forks your library and its fork becomes more popular, they can't make it proprietary after capturing the market and effectively stop people from remixing what you made.
Neither can they stop people from such remixing if the project used a permissive license. The GP's project will still be there, still freely available for anyone to use however they see fit. Nobody is stopped from using it in any way.
I'm fine with people using my code, not fine with companies profiteering off my work. If you want to use it commercially, pay for it.
What I’ll never understand is people who release their project with a permissive license and then get upset when a big company distributes their own version of the project in accordance with the license. If you don’t want that sort of appropriation then you need to pick a license that doesn’t allow it.
Copyright (c) 2024 The Spegel Authors
> The above copyright notice [...] shall be included in all copies or substantial portions of the Software.
To me, licenses like MIT or BSD pretty much imply "do whatever you want with this" I know it's not exactly that but if you really care to keep some control over what others do with the code, you need a more restrictive license (and even then people are still going to copy it, especially in the LLM era).
It certainly would be better.
Forks tend not to have -perfect- relationships and tend to cause a bit of mutual annoyance. But attribution is important-- it's the most basic step.
When this maintainer is asked how the projects are related, it'd sure be nice if both projects are telling the same story, instead of one illegally lying about it.
Whether the MIT license is the right one to choose is probably a different debate.
You can't just cherrypick the things you like about a license. All of the conditions of the license apply.
You're thinking about what people can do with the code, like copying, editing, and distributing. This is not it. We're talking about giving credit to the original author, as per the license.
In this context, not "citing the original author" in the copyright statement, labeling the repository as a "fork" on GitHub, clearly crediting the original author in a way that clearly describes the fact that a significant portion of their code is used in the new project isn't just a violation of the license, it's plagiarism.
So in that sense it could be better potentially.
So they are exaggerating?
Make sure you pick a license that reflects what you want, then.
The MIT licence already requires attribution, and that is what the author picked.
In other words, he's saying that even if it had been some other license, he wants attribution.
That's silly. If you want attribution, say it up front (which could simply mean picking the MIT license).
I have the same reasoning as to why I pick the AGPLv3 license as the default for my new projects. I want any benefits from my code to continue to benefit everyone, even if someone is profiting off of it.
My JS canvas library is licensed using MIT. From my personal perspective, I wouldn't have any problem with some $MegaCorp coming along and forking it, and even claiming it as their own creation. But ... why? Because one of the main drivers for my development of the library over the past few years is to proof-of-concept the idea that 2D Canvas API based infographics and interactives can be made - with the help of a JS library - performant, responsive and (most importantly!) as accessible to every end user as reasonably possible. My ideal outcome would be to embarrass other JS canvas library maintainers into taking canvas responsiveness and accessibility seriously. If that needs a $MegaCorp to come along and fork the library to bring my dream closer to reality then I ain't gonna stand in their way!
Of course I'd still continue to develop my version of the library - it's become my passion and obsession and there's always improvements to be made, new ideas to be explored.
Very likely, you'll end up with a $MegaCorp-backed competitor driven by goals very different from yours.
It was effective against companies that relied on interoperability and profited when people used their software projects. On the other hand, if someone wants to add features that my project can't support, it changes nothing about my life or work.
When the goal is "make the best software possible", the $MegaCorp would only compete by making software that is better that what is available in the open source ecosystem. That doesn't take anything away from anyone else. It is a Pareto improvement: people can pay and have even better software, or not pay and use the still-good free option.
Big companies have resources to mimic it anyway, right? If they really want some tech, they can reproduce it.
Having a good idea flourish, whether it is in Microsoft's hands, manifested within Clojure, or in any other fruitful form, is good enough.
There is no license for a raw idea anyway. For the essence of it. Seeing it used means success, it means "you were right".
The secret counsel of idea honor keepers will eventually figure it out and make some kind of repairs.
Since the terms of the license were violated, there's not much to learn about which license was chosen. The only lesson to learn is that big tech will steal everything that isn't nailed to the ground, and then some.
If you can't use a library because it's GPLv3, then the company would need to invest some time and money into reimplementing the features they want. Guess who gets more paid work?
By far the biggest risk for most projects is "nobody notices it and nobody uses it".
And if someone "takes" your project and uses it - you've usually still got it. Software is funny like that.
At least I can't recall any such cases.
Do you have any examples?
The problem that occurred in this case is someone at Microsoft taking the code without following the license at all.
This goes back to the fact that not everyone can choose to use a GPL licence and in a world of compromise and collaboration, that can be a blocker.
My app project is Apache for historical reasons and can't be changed. https://github.com/icosa-foundation/open-brush/actions
(and I'm not sure if I would move to GPL if I could but that's a separate discussion)
I regularly come across interesting libraries that I can't use (half of CGAL for example)
> Does it matter what license you use if they actively ignore the terms in the license you did chose? MIT requires attribution, but they didn't. Why would any other terms be different? You surely could have put "You must license your project the same as the one you forked from" and they still would have ignored it, not sure what the difference would have been.
Honestly, that is EXACTLY how I feel about it. If I use GPL code in my code then my code must also be GPL (if I distribute). The term seems to fit to me.
And no, I've never worked for MS.
It's actually the same as any other copyrighted code (and in the US, all code is automatically copyrighted and restricted). You cannot just take code and use it in your project. GPL code is nothing special.
If you're not redistributing the GPL library, then it doesn't matter. If you are, then there are all sorts of other licenses which come with the same (or greater) headaches.
I avoid those as well
If one wanted a different linguistic of pseudo philosophical spin, one could argue that a society would be more permissive than ours in a similar sense that MIT is more permissive than GNU, if it allowed free killing of random people for no reason. Nobody wants to live in such a society and it would not develop as fast as our society. I want to live in a society that permits collaboration, editing, and modification of software I use under the guarantee of the license.
That is a fair point. I admit I'm speaking purely from a selfish dev perspective. I am glad there are other licenses available, and that people are free to choose what fits them. I myself simply won't use GPL code, however, for the reasons I've specified.
This strain of rent-seeking behavior by some that open source their code but then believe they are entitled to compensation or forced contributions if the wrong people use it per license is distasteful and a bad look. It highlights the extent to which for many people the motivations behind their “open source” are not actually, you know, open source. For many, open source is about the utility of the source code and nothing more.
Licenses like AGPLv3 aren’t just about the utility of open source, they try to litigate concepts like fairness and justice at the same time, and open source isn’t a great venue for that.
Permissive licenses generally allow source code to coexist within almost any legal scenario into which source code may be placed. This is why I only use permissive licenses both for my own open source and for the open source I use.
All source code is automatically copyrighted and restricted (at least in the US) and you must follow copyright laws and license agreements for all source code that you copy and distribute. GPL licensed code is not special in this regard. How you use GPL software has zero restrictions.
No one has to like it but that is the reality. Pretending these aren’t real and valid concerns, often by people who have no power to change these things even if they want to, does a disservice to the health of the open source ecosystem.
It is why I stopped releasing GPL code and went purely permissive. I’ve seen the issues it causes people who just want to use the code many times. (Ironically, even for me with my own GPL code but at least I can relicense.)
What if your code is used to actively make the world worse? Is that part of your goal? There's no shortage of corporations making mountains of money doing exactly that, after all.
it is good if you do not plan to go for violators anyway
I made some photos and published them on Wikimedia Commons (say, of random bicycle infrastructure).
I am fine with people using them without attribution, I expect that their use overall furthers my goals rather than damages it and if I would release it on CC-BY-SA 4.0 or similar I would not go to court over missing attribution.
Therefore I selected CC0, no reason to make things more complicated only to people following license.
I selected AGPL/GPL for some software where I would be happy to burn pile of money in case of license violation, up to and including litigating it in court for 10 years.
For me personally, because I believe in freedom and permissive licenses grant more freedom than others do. I don't really care for licenses which attach unnecessary strings to what recipients can and cannot do with the software.
I also think in practice microsoft would have been less likely to actually take the code, and probably would just have reimplemented the ideas in it if it was GPL
I would love a license that says if your company has a physical presence in 10+ countries, one of its executive owns a yacht, or even is publicly listed, you need to purchase a license from the owners. (As a bonus, if the company is primarily selling subscriptions, the license should be in subscription form in return). Free (GPL/MIT/whatever) for everyone else.
Even such a crude stupid license would be an improvement over today for many. Most importantly I think a large amount of code is already closed today, because of the risks. This results in worse technical solutions, eg SaaS instead of libs & docker images that are easy to fix yourself. I don’t understand the fear mongering about licenses that Amazon and Microsoft don’t like. At the absolute minimum, contribute the changes back.
They want widespread usage of their project, but always decry not like that when Amazon or Microsoft is responsible for the usage.
Maintainers often pick permissive licenses specifically because they want companies to use the code. They want their project to grow and be adopted, and they reason that GPL would stifle adoption.
I don't really like the tactic of making your code as convenient as possible for anyone to grab off the shelf when they want to use it, and then later turning around and saying they should pay you. Why not do the payment part up front (by GPL-licensing the code and then selling dual licenses to interested companies)? Because then you wouldn't have any takers. Better to wait until people have integrated it into their systems before informing them that they ought to pay you.
Unlike permissively licensed software, where you can add proprietary features.
But, if the argument is that the GPL is too permissive to achieve what the author wants, why on earth was the author using the MIT license?
Maybe I should reconsider, but I never thought anyone would remove an MIT license. That sounds like plagiarism (though they did put a thank you in their repo)
Yes, that's the whole point of open source? Most contributions to the most popular libraries and frameworks (not necessarily end products) are from employees on their paid corporate time to begin with.
How did you count?
> most popular libraries
How did you measure?
I agree this is the case for Linux kernel, for example. But I don't know if it applies to entire ecosystem.
> Yes, that's the whole point of open source?
I think it's a gross oversimplification. For some reason there is not much code in public domain.
People do want different things in exchange for their work. Hence different licenses. Some want to receive credit for their work, some want to enrich the opensource ecosystem, make it more sustainable. Which brings me to my final point.
> are from employees on their paid corporate time to begin with
It's natural for companies to open their code under permissive licenses. Very often such code is just a first free sample of whatever they are selling: consulting services, a SaaS, etc.. So it makes sense to have an attitude "do whatever with the code, just please-please-please use it".
For an individual developer working on a one-man project the incentives structure can't be similar to one of a company. Hence my trouble understating why people pick MIT/Apache/BSD for their projects.
Obviously, a more permissive license is going to let people do whatever they want with "your" code, as it doesn't really belong to you anymore. If you want tight control then it's a bad choice, but a more permissive license is almost always going to mean your project is more widely used, for better or worse.
Some of us don't believe that the code we write is "ours" in any meaningful way, and don't think strangers using it have any obligation to us just because we typed it once long ago.
Personally, I am happy if my code is of use. If people are using it for evil I'll fight the evil, not try to withhold good things from the world to avoid that possible case. It is an approach that is rooted in sufficiency mindset, rather than capitalistic notions of false scarcity.
My project being forked doesn't cost me anything at all, but caring about it being forked or enforcing a license would cost me time and energy I have no desire to spend. Permissive licenses accurately communicate the levels of fucks I give, while keeping assholes from trying to sue me over having used my contributions to the collective wealth of the profession.
If I make the world better for everyone, of course a bunch of people who never did anything for me are going to be a part of "everyone", basically by definition. What is wild here is that Microsoft didn't follow the extremely minimal requirements of the permissive license.
"No."
<Fork happens>
:shrug: - of course, the failure to preserve the license is an egregious error which amounts to infringement. But it's easily remedied.
And if the downstream project has a popular feature that can't / shouldn't land upstream, then that's okay - that's what everyone prefers.
"$BIGCO shouldn't be using my software, certainly not outside of how I intended it to be used!" - this attitude is totally contrary to both Free Software and Open Source IMO.
If you don't like it then you should probably consider a more restrictive license.
That said, Microsoft isn't a person and has no agency by itself. It is specific persons/developers/managers violating the licenses and stringing along open source developers in bad faith.
Who are these people? Why is the blame not falling on them, specifically?
Who exactly did what it's a Microsoft internal thing, unless Microsoft demonstrates that this has been done in bad faith and Microsoft did everything what is "reasonable" to avoid this happening ...
Up until the dotcom boom (and in the earlier days of it), one of the questions I'd heard of software startups was something like, "What will you do when Microsoft decides to own your space?"
Fortunately, the broad tech industry overall got a decade or two reprieve from that, though it might be starting to return.
A long related question, when partnering with Microsoft, which sounds like it still applies, is "What's your plan for when Microsoft stabs you in the back?"
Microsoft never had a self image of "Don't Be Evil", and is more a close releative of Cantrill's Lawnmower.
My suspicion is that ruthlessness and the long-con have deep roots in Microsoft's culture.
Microsoft only appears to play nice when it has to, and is shameless otherwise.
I know it isn't mainstream, but companies try to avoid those licenses as much as possible.
Tinfoil hat: sometimes I wonder if companies astroturfed support for permissive licenses. Getting the entire Rust ecosystem to avoid copyleft was a huge win, for example.
And now that copyleft Gnu tools are being replaced with permissive uutils in Ubuntu, it seems they won, whether or not they were the ones to push it.
The vast majority of the rust (and Go) ecosystems is non-copyleft because you cannot satisfy the GPL in any meaningful way and satisfy your corporate legal department’s IP lawyers.
In fact, I wish an even stronger license existed which allowed the original author to dictate who can build on top of the project to avoid exactly these kinds of situations where a powerful actor completely disempowers the authors while technically following the license (I assume MS will "fix" their error by fixing the licensing information but will continue to compete with Spegel with the intent to make it irrelevant).
Such licenses exist. They're just not Free or Open Source. They can't be, by definition.
What people who want such things really are after is the leverage to dictate a form of morality - if you dont have money, you are allowed to use the project for free, and give back advertising/clout. But if you have money, or could get a lot of money for said project, then they want their pay day.
> 2. Additional Commercial Terms. If, on the Llama 2 version release date, the monthly active users of the products or services made available by or for Licensee, or Licensee's affiliates, is greater than 700 million monthly active users in the preceding calendar month, you must request a license from Meta...
ref: https://github.com/meta-llama/llama/blob/main/LICENSE
But again, not open source...
(IE, don't let your ego run away.)
Why?
In my case, I was working for an industry-leading product that required a bit of reverse-engineering into MacOS. We got stuck on a new release of MacOS, so we did a bit of digging and found an open-source project that successfully reverse-engineered what we were trying to do.
(Basically, integrating in the right-click menu in Finder required reverse engineering prior to 2014; and every version of MacOS required redoing the reverse engineering.)
It was a legal grey area to copy how the open-source project reverse engineered MacOS, so I reached out to the open-source project and tried to collaborate. We exchanged a few emails and then I found a problem...
Basically, their solution had rather large memory consumption in Finder if the user had very large folders. Our customers had very large folders. (Edit, 200,000+ files were common.) We still wanted to collaborate, so I proposed a fix that fixed the problem.
But, then "radio silence" from the original authors. We forked and complied with the license. I always hoped they never begrudged us.
(Ultimately, Apple released an API so we didn't have to reverse engineer MacOS.)
This sentence is true but a bit confusing, because there are no licenses that require anyone to contribute changes back upstream.
You can run derivative AGPLv3 software to service the public without distributing your changes to the source code without violating the license as long as nobody asks for the code.
> The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.
If you're interpreting that as something different than "publish", I think you're splitting hairs.
In practice, the goal is met because someone is likely to request the source for AGPL software. Publishing the code is not a requirement of the license though.
The MIT license is the "easiest" license because there are no responsibility for the maintainer..
This isn't true either. You can privately fork AGPLv3 software without violating the license. You only have to provide the source (on demand!) to people who you provide the software to in executable form (where "executable form" includes network based access to the services executing the software in the case of the AGPL).
GPLv3.
Microsoft has been a bully for years: https://www.fsf.org/news/microsoft_response
They can't change, regardless of how much marketing money they put into "We love opensource".
[0] https://github.com/spegel-org/spegel
[1] https://en.wikipedia.org/wiki/You_Wouldn%27t_Steal_a_Car
When you download a movie from torrents, you don't submit it for an Oscar nomination claiming you've made it. You just copy a file to your computer intending to kill a few hours of your time while playing it back.
Microsoft®™, however, not only copied the code, but claimed it's theirs.
Claiming the code as authored by themselves did not leave the original author without their code. This would not be true had they stolen it.
https://www.congress.gov/bill/116th-congress/house-bill/8356...
The original researchers still have their ideas and work, it was "just" copied. Still, we call it stealing and theft.
In this case, code was taken and the credit was stolen.
2 (transitive, of ideas, words, music, a look, credit, etc.) To appropriate without giving credit or acknowledgement.
“I choose a lazy person to do a hard job. Because a lazy person will find an easy way to do it.”
So I put a PCB of my product in his hand (it had some through-hole components), and squeezed it really hard, and asked him "If it doesn't exist, why is it making you bleed?"
All this at a meeting/presentation where my bot was literally running circles around theirs because mine worked and theirs stalled.
I think I have video of this somewhere, but there's no audio.
The guy left Google a year later, tried to sell bots independently, and folded. I on the other hand am still here.
It was a bit of a weird interaction overall. Why would someone say "this doesn't exist" while staring at it? I figured that haptic feedback would help with their solipsism at the time.
But giving a (presumably) free consultation to Microsoft is a self-own. History has shown that you should never give the benefit of the doubt to Microsoft, and you should certainly never trust them (unless you have a contract and a good lawyer). Not knowing this can only be the result of willful ignorance. I can't offer sympathy for that.
Hopefully, this person learned the right lessons from this experience.
“It’s your fault for inviting them in” is victim blaming and horizontal aggression. The people at the top of the pyramid love it when the peasants fight each other. Saves them getting callouses.
Open source licensing isn't a party, it's a business decision you make as a participant in the intellectual property economy. If you make a stupid and/or uninformed decision, you're opening yourself up to exploitation. It is victim blaming because this situation is entirely the victim's fault.
I don't even know what you mean by "horizontal aggression", and your comment about peasants makes no sense in this context. How does advocating that people be informed and use appropriate licenses count as in-fighting, or beneficial to big tech companies? If anything it's literally the opposite.
What do you think I mean by horizontal aggression?
If that's what the license says, why is the author complaining? Microsoft is complying with the license.
That's what you get for not picking the one of the license from the GPL family.
> However, I am not the first and unfortunately not the last person to come across this David versus Goliath-esque experience.
Again, this situation was completely avoidable. Stallman had foreseen this kind of situations literally forty years ago. That's why the Free Software movement exists.
Tangentially related: has anyone notice how the whole Grafana ecosystem is going strong and unaffected by forks and corporate take-overs? I'm pretty sure that the AGPL license is playing a big role into that.
"The license does not allow removing the original license and purport that the code was created by someone else. It looks as if large parts of the project were copied directly from Spegel without any mention of the original source"Even if megacorp does nothing else for you, that NOTICE file can at least contain information about who you are as the original author, links to your website, etc.
Using it then complaining about its effects because you don't like the company is silly.
Use a different license if this is important to you.
Well, yes, that seems to be the conclusion OP has come to.
Copyright (c) 2024 The Spegel Authors
Which should be retained when you are forking it right? Or am I wrong?
I bet the Spyglass people had the same thought.
Sez who?
Far too many times big company's take what they choose and give you nothing. Use licenses for your advantage, heck dual license if needed. Not sure what the desire is of a Eutopia open source world view, where not everyone has the vision or plays by the rules anyway.
spegel did not follow best practices to put the copyright in the file itself: https://github.com/spegel-org/spegel/blob/main/internal/web/...
Ideally starting with something like this
// SPDX-License-Identifier: MIT
Nevertheless, I'm going to keep writing (latest piece [1]) about my post-open source journey in the hopes of clicking with a handful of people in the next generation.
[1]: https://lgug2z.com/articles/on-evils-in-software-licensing/ - feel free to hit me up off-platform if you want to discuss
Last week I relicensed most of my previously released Minecraft mods (except those with trivial code and those with missing source code) to AGPL plus a bunch of exceptions.
Their improvements are available under MIT license. They would have been fully within their rights to not release and put in a proprietary product but did not do this.
Instead everyone can benefit from their improvements. Author can steal whatever he wants for his upstream.
(I can’t find any details of “Microsoft MIT” and the above is premised on it being functionally MIT.)
Meet for a week. Bring in one of their grey beards. Learn all our deets in anticipation of acquisition. Then silence...according to my understanding, not being privy to executive level discussions.
A bit later, release their own take on the problem area ... tragic.
It was very bad for us.
Even as a premise. Your domain is enough of a concern for Bigcorp to spend executive time on. Bigcorp wants to acquire your employer because and they think they can get more value out of it than the asking price.
Your own executives will ignore the threat that due diligence means to your business in the case a deal fails to be completed, because this is their promotion cycle. But you are a potentially redundant cog that is unlikely to be a more efficient part at Bigcorp. After all, you don’t already work for them.
Who are they?
Did you manage to reach out to any of the people at MSFT you originally spoke to to ask wtf?
Seems both you and Microsoft needs to actually read through the MIT license, it isn't that long or complicated :)
> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
That part is even in it's own paragraph and everything, really hard to miss for anyone who even glances at the license.
What percentage of copying is “substantial”?
That’s the problem with concisely written licenses, the legal world thrives on definitions and terms of art, and when you leave something open to interpretation you invite the probability that a nefarious (or even sufficiently amoral actor like a large corporation) actor will point to the language you use and interpret it differently.
To win any argument in a court of law you must now spend time and money to win the argument. Something an open source maintainer likely doesn’t have, and since the license doesn’t specify damages, there’s no way to even write in a penalty for failure to adhere such that a court of law would consider it under contract law, and then you have to prove damages.
At least in Virginia, each party pays their own lawyers fees, even if they win. You can only collect lawyers fees when statutes allow you to, or there has been sufficient bad faith from the other side that the court uses its own power to sanction.
Oh, and let’s say you win and somehow you are able to prove damages. Now you have to spend money to collect on the judgment. That’s money you’re not getting back.
The point here is that we’ve written software licenses as contracts that assume good faith and do not punish bad actors, when we would need to treat corporations as if they are bad actors and write licenses accordingly.
The reality is that licenses do not mean anything unless you are actually able to enforce it. So I really do not think the license would have mattered in this case.
Sorry it happened to you but it seems like you just picked the wrong license.
Use AGPLv3.
That being said, it's not cool to remove the attribution even internally. Then again, I use MIT without the attribution clause for this very reason.
The author of Spegel released it as MIT, which means that anyone can fork it as long as they keep the attribution. So if every file of the original project has a header containing the copyright, Microsoft has to keep it. Looking at Spegel, I haven't found a single source file containing an MIT header and copyright.
Microsoft added their header with their copyright in Peerd (because now that they changed the files, they own a copyright over parts of those files). Nothing says that they must add a line for the original author, and I could imagine that it's legally a risk for them to do it.
Moreover, a copyleft license wouldn't have changed anything here (except maybe discouraging Microsoft from reusing any of that code).
If you don't want anyone to reuse your code, don't open source it. The whole point of open source it is that you allow others to reuse it.
> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
The license is saying you have to retain the license itself; it doesn't say anything about any other attribution notices that exists in the source files or anywhere else. It doesn't specify where you have to put the license; it could be in a comment in the code, or it could be in a file next to the code, and that doesn't change anything about the terms of the license.
If the original author put the license in comments, you can keep it in comments, but you could also move it to a standalone file. If the original author put it in a standalone file, you can keep it there or you can move it to a comment, but you can't remove it. If you distribute a compiled binary, you need to be sure you're including the license alongside the binary as well.
If Microsoft distributes a "substantial portion" of the software, and they do not include a copy of the original license (including the copyright statement at the top attributing the original author), they're in violation.
Engineers in big companies are quick to criticise how the legal department is a pain in the ass, but when I see the reactions here, I completely understand why it is.
I agree, op should make a PR, state their case, and then complain if it's not merged.
He already gave them permission. I think he is overemphasizing the meeting they had and under-emphasizing already giving away his work.
Commercial entities will always exploit your work - you need to force them to give back, they will never do the positive sum game by default
> A negative impact from the creation of Peerd is that it has created confusion among new users. I am frequently asked about the differences between Spegel and Peerd.
I can't imagine any quantifiable damages here. No business or revenue was impacted. Just chatter in an open source project.
But I wonder if an argument can be made that by flagrantly violating the license, Microsoft is devaluing the whole concept of the relevant license and similar ones. The entire body of source code that was created partly because of trusting that those licenses mean something is worth an enormous amount.
So I'm guessing the perhaps there could be a class action lawsuit on behalf of the entire open source community that uses that class of license.
Sometimes I wonder if all the shitting on free software in general is in fact cynical and in bad faith by actors who want your labour for free.
The leopard doesn't change its spots. The scorpion stings the frog. Microsoft screws over people. Lessons learned in childhood that still hold true today.
1. Open source worked as expected. Some MIT-licensed code was forked under the same licence, giving users more options and contributing further to the open-source codebase.
2. I don’t understand the claim about users being confused between Spegel and Peerd. These are two products with different names and maintainers. Maybe some users are also confused between Ubuntu and Red Hat Linux - so what? I’m glad users have more choices.
3. The point about the original author not being given enough credit is the only valid one. The legal side, discussed in other comments, seems to suggest they’re within their rights, but they could have done better.
Licenses like the GNU Affero General Public License (AGPL) might prevent some corporations from using an open-source project because they do not want to release the source code of their own modifications to it. Sadly, corporate compliance often prohibits the usage of copyleft projects altogether, even if nobody plans to modify anything. Especially the legal departments of large “enterprizy” organizations often prefer software with licenses like MIT as they want it simple and “risk”-free.
But who cares? If these corporate users do not contribute back, there is simply not benefit in having them as users.
Except you do not care about open source community but about hypergrowth. This seems not to be true for this case, but the impression comes to mind that many start-ups use open source not because of freedom but as an argument for adoption in the enterprise ecosystem. They avoid choosing (A)GPLv3 licenses to facilitate easier corporate adoption without generating enough revenue, while being funded by venture capital and without getting contributions back by organization who could easily afford giving back something. Then, after being adopted, they complain.
There’s a reason why Linux (GPL licensed) is still around, growing, and making money for so many while companies behind widespread open source projects often fail financially and burning insane amounts of money. It might work out for individuals and owners when getting bought, but it hurts users and ecosystems who relied on something.
Eventually the MS fork will be so far behind yours that they will come back to talk to you. And this time, you will be prepared.
The OSI considers any open source license that tries to restrict or disincentivize this "not open source." Look into OSI and note that it is effectively captured and controlled by these corporations.
People using that gift is the point. Forks aren’t just permitted, they are encouraged. That’s why we release free software.
You aren’t in competition with Microsoft and their fork. There is no such thing as marketshare when there is no market.
Especially amongst Linux users… :-)
They took you by your word and did exactly that.
What did you think a license is for? For artistic expression? It's a contract. If you want to get paid, put that in your license.
I recommend AGPL 3. Then nobody will rip you off. And if they do, you can drag them to court over it.
But seriously, it sounds like a weird version of "not invented here syndrome" where you are somehow OK with copy-pasting most of it.
Use AGPL, Fair Source or BSL. That's the only way forward. I for one will be using AGPL in everything. If a trillion dollar company cannot pay for services it is a fucking shame. Absolutely disgusting. Microsoft should be ashamed.
Boo Microsoft. Winget still sucks.
I read recently that Microsoft is adopting rust more and more. I think that’s a step in the right direction for an OS with such a huge marketshare. That said, I’m just waiting for Rust.Net or Managed Rust to get excreted in a thinly veiled attempt to split the community, steal mindshare, and take over the project.
Are American lawyers that can read three-paragraph licenses so prohibitively expensive?
Use a GPL of some form, whichever one is up to you.
Can someone please explain why?
Then sometimes you get into a date with her, but discovers she isn't what you expected. It was the snobbiness that made you more eager to know her.
Then, disappointed, you break up with her and she starts telling everyone you have bad breath, your friends are idiots, and that you are dumb and ugly (but she secretly still likes you).
When you're adult you start to realize that none of it is really that important. She is probably nicer than you remember. And you were just a kid.
All this HN discussion reminds me of those teenage years somehow. Like a twisted psychology distortion of it. It is kind of funny actually.
For the rest - if you chose MIT license for your work you should expect it can be used by someone to create software based on it, including commercially licenses
I would treat anything you're releasing as MIT as the gift to the world. This is how Open Source suppose to work - people building on each other work, often without properly thanking authors and maintainers.
If you want to reserve some rights - chose who can use your software and for what purpose, ie ensure "Microsofts" of this world can't use your code in a way you do not approve, you should not release it as Open Source.
It's ridiculous that companies with literal trillion dollar market caps coast on the back open source.
A lot of OSS developers get "got" by the ideological arguments of OSS and shy away from doing "source available" (which if we set down the Kool-Aid, is in effect open source because...the source is open).
If you're an independent or small team and want to protect your IP as best you can while keeping source available for learning/auditing, check it out.
The fact that you have "fill in the blanks here" in a "legal" document makes this actively harmful.
I respect the sentiment, but it's entirely the wrong direction. Better looking at the Creative Commons license picker/builder as a better example of a starting point.
It doesn't. At the end of the day, all legal documents are just words on a page. When in doubt, you can hire a lawyer or paralegal to review what you've written to ensure it's sound.
This is why people keep getting burned. They make foolish excuses, use the wrong licenses, and then they're surprised when a big fish swallows them whole.
That said, Microsoft provides extremely generous Startup Assistance (to the tune of > 150K of Azure credits). Disclaimer: I'm not affiliated with MS but I did their program, also did the Gcloud and AWS programs back in the day. No negative comparisons, but off the top of my head the Azure program is awesome. I really enjoyed working with Azure, and it does what it says on the tin.
You can apply here: https://www.microsoft.com/en-us/startups/