This Project Was "Illegally" Packaged On 14 Linux Distros

[@BrodieRobertson]

While the blog author calling this illegal might be taking it a little bit too far and it could have more easily been dealt with by contacting the maintainers, the moral here is if people in the FOSS community don't take licensing super seriously why should anyone expect companies like Microsoft, Google, etc to do the same.

[@Gurj101]

I see interesting. Will have to license even hello world 😂

[@arkvsi8142]

How dare you not being a lawyer

[@boredstudent9468]

Because they have legal departments. Just read the license is like just read the terms and conditions Edit: Especially if its the dependencie of a dependencie of a dependencie. I cant trace all licenses to Ada Lovelace

[@anon_y_mousse]

We absolutely should expect large corporations to take licensing seriously, and we should ourselves as well. However, in the past Microsoft violated the GPL and had *zero* repercussions. Their code generator thing on GitHub may well violate it as well, but IANAL and the laws may not agree and even if they did no prosecutor would take up that case.

[@nezu_cc]

This is the exact reason why I open a "Missing license" issue on any repo without a license that I come accros. Most people are nice, slap MIT on it and move on. But some just reply with "Do whatever the hell you want" and just close the issue without adding a license. Some people sadly don't understand the need for a license.

[@wsippel]

"Do whatever the hell you want" very much is a license, and would be good enough for me.

[@mgord9518]

@@wsippel For stuff like that is why the Unlicense exists. It's great that some people just release code as public domain, but it needs to be communicated with some sort of license file, even if it just says "do whatever the hell you want with it under any circumstances"

[@DeeezNuts]

i just slap wtfpl[.]net on my projects

[@TheUAoB]

In most jurisdictions the default is copyright the author, all rights reserved. Code has to be explicitly placed in the public domain, although the bug reply is probably sufficient, at least for the filer of the bug..

[@mercuriete]

WTFPL is a license. Do what the **** you want public license. It is similar to public domain but with a funny text.

[@felipelopes3171]

Ok, let us dig on the legalese here. Why do we have copyright licenses? It's because the person who published the software wants to have some rights over its distribution. And notice that it's always a civil thing. It's not a crime to infringe copyright, so if you do, it needs someone to take you to court. In the situation you are reporting, all that happened was that some distro was shipping software with a mistaken license. When you see this, what you do is: you alert the distro, and they take action, maybe they contact the developer and say that if he doesn't clarify the license they will remove the software, and it seems that they did something similar to that. But notice that in those three years, it's only copyright infringement if the developer complains about it, because the law is meant to protect HIS software. So, if in three years he made no effort to notify the distros that his software was being incorrectly packaged is itself indication that he did not care to protect his rights. So, in reality, this issue is just that some distro maintainers were careless to package software, but to bring a case to court you would need to provide: (1) proof that the developer was trying to protect his rights, (2) that the distro maintainers were aware of this and took no action, (3) that the wrong packaging of his software caused him material damages. In this video and in the blog post, none of this is presented. So, what most likely would happen if you were to bring this to a court? The judge would be pissed off at you for wasting taxpayers money to process this thing and you would be slapped with a fine for bad-faith litigation. That's the most likely scenario.

[@alexnoyle]

Certain ecosystems have a default license. For example, an open source spigotMC plug-in is GPL3 by default.

[@himabimdimwim]

Lmao open source license drama always makes me laugh. Most of the time, the result is inconsequential. Other times, Microsoft.

[@zeyadkenawi8268]

agreed. the burecracy is too real.

[@gnarlin4964]

Licenses matter. It's absolutely fundamental.

[@vaisakh_km]

​@@gnarlin4964 fundental to?

[@gnarlin4964]

@@vaisakh_km Free and open source software. Without the copyright holder specifying a Free software compatible license for his or her software it'll remain proprietary and illegal to run, share, modify or share modified versions, even if the source code is published.

[@baguettedad]

So my paranoia with licensing was right

[@RadikaRules]

It's less paranoia, and more like common decency

[@mercuriete]

By default on at least music or other pieces of culture, the default is copyright, all right reserved. So I think unspecified license is 100% copyright. Of course copyrighted code is non FOSS until 100 years passed and it became public domain. So if we wait until 2122 there will be no drama, but today we have drama. Edit: from github official documentation: You're under no obligation to choose a license. However, without a license, the default copyright laws apply, meaning that you retain all rights to your source code and no one may reproduce, distribute, or create derivative works from your work.

[@SirWolf404]

Actually Public Domain is also not FOSS, at least if you stick with the OSI definition. PD is at best problematic, just like most of the other non-OSI licences, so I'd avoid using PD software for anything except strictly personal use.

[@firstlast42]

Correct that copyright is usually applied automatically. The rest of OP comment is misleading though. There is only "100% copyright" It cannot be 75% or partial!? And when the software is licensed, for example by applying a FOSS license, copyright is still held by the owner/author. It doesn't just disappear. The conditions of the license could not be enforced unless you still had Copyright.

[@muellerhans]

The 100 years rule is regional.

[@Hauketal]

@@muellerhans Right, most often it is 70 years after the death of the author. County specific variations apply.

[@hansdampf2284]

I didn’t know they do it like this in Arch. In gentoo they really do care about this. Even when you commit something to the guru they make you correct the license. Thankfully there is dev-go/golicense and such. Honestly, figuring this out it one of the main jobs of distributions. Thankfully n gentoo there is Ulrich Müller who watches over this with Argus eyes and every puny contributor is shaking in fear by only hearing the name

[@Cuperino]

I've asked a few developers to add licenses to their codes because to prevent issues like this. Most add an MIT license, a few others don't reply or disappear because they used unlicensed code in their projects, or don't wish to comply with the GPL.

[@BrodieRobertson]

MIT is a pretty sensible choice if you don't really care about the code or what's done with it

[@Cuperino]

@@BrodieRobertson Indeed it is. I like the GPLs better because they also defend your freedom, but the MIT, and BSD-3 clause are great licenses!

[@maxxiong]

The article also mentions the situation of not listing all licenses. That issue is actually specific to a handful of languages that statically link libraries, and any electron app (but I have to assume electron carries it's own license already or something).

[@Your_Degenerate]

Free and Open Sauce Sausage sounds spicy.

[@vaisakh_km]

😑😑

[@lazyh0rse]

If I'm planning on creating new personal project, honestly, it's a pain to decide the license beforehand, I don't know if the project actually holds any value until I complete it. So in the case of this project, I don't blame the maintainer, I do the same thing if I have a side project, in my case if I'm really worried I will just place it as private.

[@eloskowy4954]

Just slap GPL (preferably v3) license on it

[@stereomato]

is it really? i just set bsd3 on my github account settings as default iirc.

[@lazyh0rse]

Well, tbh, I don't like working for free, I do a lot of projects for money, so if a project of mine happened to be used by normies, or useful for the rich people, obviously I will make it proprietary, if it's a useful small utility or something that only developers or technical people will benefit from then on the public domain. I think most people go by that logic.

[@eloskowy4954]

@@lazyh0rse GPL should save you from this. This license makes people able to fork your project but it needs to be open sourced. If a company would like to steal your code and do whatever they want with it, they can't because of license. (I mean, theoretically they can but that would be a legal issue)

[@Zephyrus0]

FSFE's REUSE initiative makes a fuckton of sense now.

[@_Aarius_]

I'm glad the goodguy original maintainer added MIT as soon as he found out

[@wisnoskij]

This really sounds overblown. Is their a single case of any owner of abandoned unlicensed code suing? I doubt this has ever happened. abandoned code is public domain until some court president overrides this imho. Complaining about a package not having a license just makes you sound like an nft bro screaming about deleting your screenshot! This is not really a legal or licencing issue, it is a weirdo yelling at clouds issue.

[@BrodieRobertson]

If you don't take licensing seriously at this level what reason is there to care about Microsoft abusing more recent GPLv3 code, it's not a matter of whether the author will sue or not it's a matter of whether this FOSS experiment we're doing has any legs to stand on, unless the author is long dead the code they write is not in the public domain and is still fully owned by them, this is well established precedent

[@yjk_ch]

"Abandoned code is public domain" All software is copyrighted work, unless the license explicitly says "this is public domain". Also, clarifying license means clarifying what you can and can't do with the software. It's very important.

[@SirWolf404]

@@yjk_ch Indeed, also public domain is not a licence.

[@YvanDaSilva]

Regarding the gomodule without license. Well, that's the thing, gomodule is not made to manage licenses but to manage gomodules independently of the license. There is a whole go blog post about this on go dev: "using-go-modules" and one on "russ Cox's blog post; Our Software Dependency Problem". No license, in most jurisdictions means copyrighted work. So you can't do whatever you want with it. There is plenty of tools for project, libs, deps, licenses management that are independent of package managers, dependency managers, etc. When you build software with deps. It's your duty to actually check compatibility between those licenses and your business licenses. And I mean the tree of licenses, not just what the direct leaf, this is why it must be automated. If you don't do it, then you might as well ignore licenses altogether and risk legal repercussion.

[@pmarreck]

There is no drama like big nerd drama. And Brodie is an excellent narrator of it. ;)

[@sgeskinner]

This reminds me of leftpad, except the results were not immediate and the author, once made aware, was cooperative. With leftpad the author was angry and therefore not cooperative

[@BrodieRobertson]

Leftpad was more obviously destructive this was a situation of how seriously do people take FOSS

[@BetterLivinThruJesus]

definitely like getting some support as a bit of a debian stan

[@jort93z]

It's not a bug, it's a legal issue. So tagging at as "Not a Bug" is correct.

[@Hfil66]

It is a bug if the legal issue makes the product not fit for purpose. It may not be a coding bug, but that does not mean it is not a bug. If the team wishes to distinguish between legal bugs and coding bugs then it is up to them to provide the tools to make that distinction. Maybe it is another bug that their bug tracking tool cannot distinguish between a legal bug and a coding bug, but nonetheless it remains a bug of some sort (something that needs to be addressed to allow the product to be used).

[@jort93z]

@@Hfil66 A bug is a term for an error in a software that makes it behave in an incorrect way. There was no problem with the software. Legal bugs aren't a thing.

[@KabeloMoiloa]

You betcha it is a bug, programming is a normative practise not merely technical. At minimum it is a bug to say to the user "this program is licensed under the BSD license" when no such thing is known, just as much of a bug as Google maps showing you the wrong directions. More interestingly, I'd say that programming is mostly a social (not a technical) practise, social norms like Unicode inform programs just as much as type systems do.

[@xrafter]

4:14 the issue number here is #4. So there where 3 before it that was deleted

[@OcteractSG]

Software licenses are foundational to the Linux ecosystem. While I think so merging should have no restrictions until it has a license that says otherwise, we don’t live in a legal system that works like that. If it has no license, it is not FOSS and is not part of the general Linux ecosystem. I’m not saying that no one can run the software; I’m just saying that unlicensed software does not fit the usual Linux way of free and open source software.

[@DirtPoorWargamer]

As someone who sees intellectual property rights as bullshit that typically does more harm than good, I generally don't care about software licenses. I'll do what I have to publicly in order to avoid legal trouble, but that's the extent of my consideration for them. There's only one main thing I personally care about when it comes to software I write and publicly release (aside from my legal obligations): No code I release for free ends up in software someone is charging for. The only software I personally release is free-as-in-beer: I write it because I need it and can't get it, I release it because I figure someone else might need it too. Already did the work, the software itself was its own reward, and it doesn't cost anything to share; charging for it is greedy. If I'm not making money off of my own work, no one else is going to either. The only other thing any small part of me cares about is being properly credited if you use my work; a bigger part of me thinks that's kind of petty though...

[@DarksurfX]

Can you really say gentoo has a “package”? Technically they don’t, they have a build script that helps you compile and install the code.

[@BrodieRobertson]

Gentoo does offer some binaries

[@lucyinchat]

@@BrodieRobertson to add to that, you can also build and host binaries for your own repos, using portage to create, fetch, and install those binpkgs.

[@MOOBBreezy]

What if I just made something on a whim, just put it on github, and just wanted to share. Then I just completely forgot about it and forgot to put a LICENCE because I was new to this whole thing and didn't know. Can just no one ever can use the project like at all then? Or how does others get to ever use it.

[@BrodieRobertson]

No one is going to care for personal use, but if they were going to use it in a project they want to distribute then it's a problem

[@SirWolf404]

Well any project who would like to use your code, or extend it would be blocked, and companies would not go anywhere near such code. If you intend to share your code and want people to use it, or modify it, then setting a licence is really important.

[@triffid0hunter]

All human-created works get copyright assigned to the author by default, unless it's work-for-hire in which case the copyright is assigned to the payer (with numerous jurisdictional caveats). That basically means 'all rights reserved' in terms of licensing, but since _you_ wrote it, _you_ have all the rights, and can license usage of the work to anyone under any license anytime you like (and even to different people under different licenses which eg Qt and several other dual-licensed projects do) - until and unless you formally transfer ownership of the copyright, or the copyright expires. In this case, the original author provided an open source license _years_ after creating the work, finally allowing its inclusion in open source software.

[@BrodieRobertson]

I would say most works, there are some works which are so simple they are not copyrightable. If I release some source code which is just a blank C main function that's not substantial enough to be copyrightable, where that line is drawn however is to be answered in a court

[@MOOBBreezy]

@@BrodieRobertson is there a tool that just auto generates a license file for you? Like "gen-licence mit/gpl3/whatever" Or perhaps git should promt the user to make a license upon initialization

[@JorgetePanete]

I don't understand the need for licenses in open source code, isn't the Unlicense enough for FOSS?

[@gabrielz4698]

unlicensed code is not open source the default license is all rights reserved, the author can sue anyone that uses the code. of course that is unlikely to happen in a FOSS project but is better to be safe than sorry.

[@JorgetePanete]

@@gabrielz4698 but isn't the Unlicense a license on itself?

[@gabrielz4698]

@@JorgetePanete when a something is unlicensed it defaults to an all rights reserved license so the author can sue anyone uses their work without permission .

[@JorgetePanete]

@@gabrielz4698 I despise everything related to copyright and patents... one of my projects, linked on my profile, has the Unlicense as an attempt of putting it in the public domain, without the need of replicating the "license"

[@gabrielz4698]

@@JorgetePanete I do too, but unfortunately that's the world we live in. you will need to state a license that puts your work under the public domain.

[@marufbepary100]

It should be mandatory for a repo to have a licence if it is public, like you cannot create a public repo unless it has a licence.

[@BrodieRobertson]

I've said the same in the past

[@notuxnobux]

There used to be a limit on github on how many private repos you could create (only 5 private repos for free accounts), which is probably why people just uploaded code without a license. They never expected somebody else to use the code.

[@YvanDaSilva]

It is allowed as Copyrighted work is not evaluated the same everywhere, copyright is complicated to say the least. Legally speaking there is nothing wrong about making a public repo without a license file, at least apparently in western countries. However, I would highly suggest everyone choose a proper license when they go public...

[@bigbay1159]

It's always something but par for the course

[@hansdampf2284]

The beginning. :D Yes this is just true, it’s just chaos

[@user-ro1cc8tz6d]

"I want to clarify that my license was CBT 😈"

[@MFTAQ]

This is crazy.

[@t94xr]

Its a small tiny package, obscure but still used. It is easy to overlook things, things get lost and don't forget, we've had bigger things globally to deal with than the licence of a small package, so its easy to understand that things get caught up, used and before you know it, someones like, oh wait look at this... It's a bit of a laugh, author has taken it well, just glad its of actual use rather than abandoned code just sitting there to be ignored and never used. It's not a big serious issue, its not a critical thing that could bring Linux itself to its knees, its something amusing that has happened.

[@ch4.hayabusa]

There is no way for even a small business to self host GitHub. GitHub is COMPLETELY closed-sourced in every way.

[@9SMTM6]

"distros like arch generally just list whatever the top level license is, which is oookay, but Is technically wrong" I'm not an license expert, but could you tell me situations where this is an issue, other than if the project creator didn't do his diligence, which was the fact there? The issue you show visually/speak mostly about is just that the license isn't very well clarified on Arch, that comment would be a seperate issue.

[@maxxiong]

For FOSS user applications the license literally does not matter. Also, in general the identifies license is the license of the packaged content. Go is statically linked which is why this issues comes up at all. A C program would not list glibc's license as one of it's licenses.

[@Mitsunee_]

idk why this video is randomly reminding me of the wizard of oz... a little module that doesn't have a license~ 🎶

[@breadmoth6443]

this all makes no sense, even if say a project is not under a compatible license , say as an example CDDL and GPL .......since CDDL is technically an open source license still -- why not just fork and re-release under GPL or any other license ?

[@triffid0hunter]

Most licenses (open source or otherwise) don't offer the legal right to change the license, only the copyright owner(s) can do that.

[@breadmoth6443]

@@triffid0hunter so even if you fork a project you are obligated to stay under that license?

[@triffid0hunter]

@@breadmoth6443 of course, your legal permission to fork in the first place comes from the project's licence - and you only get the rights that the licence says you get, all other rights are retained by the copyright holders who actually wrote the code you just forked

[@Endermen1094]

It seems overblown

[@vaisakh_km]

what will i do with my 100+ hello world repos without a license..🥺

[@BrodieRobertson]

Something like Hello World is not substantial enough to be an issue, just like including a main function in your C code doesn't matter it's not a creative endeavor

[@Pieterv24]

Random dependencies with no idea about licenses? I'd like to introduce you to the clusterfuck named NPM...

[@vitluk]

I never understood this spiel about non-licensed **public** code. If you **don't want** it to be distributed by others, make a **private** repo. If the code **is public** and unlicensed, go ham

[@BrodieRobertson]

Don't go ham, bad idea

[@vitluk]

@@BrodieRobertson I'm not saying I'm doing it, I'm not a complete moron, just saying it makes no sense to me that code that u make publicly available to everyone without a license is restrictive by default. I mean, i get that people can forget about the license and get fucked over if they weren't planning on their code being sold as a part of some commercial product, but if you really care about that stuff, license will be the first thing you look at. If not, i'd assume you don't care what happens to the code and how it is used (i certainly feel that way)

[@ahmadshahzad5547]

If someone makes their code publicly available without a license, it should automatically be licensed under MIT or Unlicense or something.

[@Hfil66]

You cannot automatically apply any licence; that would be to second guess the intents of the author. The right answer is simply not to allow code to be released on your platform without having a clear intent stated by the author as to its intended usage. You cannot just take something because it is available without knowing on what terms it was intended to be available.

[@amulyamohan3965]

Can we just have a licence that says "free to use unless you're a corporation worth more than $X"??

[@porteal8986]

I think there are licenses like that, but who would want to use one of those?

[@lucyinchat]

@@porteal8986 I know a few people. I also wrote a license, myself. Berkeley Artistic.

[@porteal8986]

@@lucyinchat alright, I guess I'm just a fan of copyleft

[@meqativ]

licensing ongggg

[@safulkin]

Hey, Developer, stop creating new and fixing old. Here is Legal obligation to fill legal information. This is not fun. Last few years loyers activated around formal licences in repo, in separated file with licence, special tags in code comments, in each file, each line, each pixel.

[@PestisNonSapien_GMO_exHuman]

License files are a waste of inodes. I delete them.

[@androth1502]

meh. seems overexaggerated. basic assumption: no license/copywrite notice = freeware.

[@BrodieRobertson]

No it's all rights reserved for the author, not freeware

[@ezforsaken]

If the code has no license then it should be stolen and relicensed by the first dude that finds it. Best way to stop this non license nonsense.

[@umop3plsdn]

just like inventions and patents amirite??? ya bro... no

[@ezforsaken]

@@umop3plsdn dude it takes like 4 clicks to license your stuff on github, there shouldn't be projects without a license

[@walkergoff3127]

Breh. Don’t be talkin no shit about TURDUKEN.

[@BrodieRobertson]

It might taste good but it sounds like a nightmare

[@mbarrio]

Who f.ing cares...

[@BrodieRobertson]

People who want to take FOSS seriously?

[@PeterWolfe2012]

@@BrodieRobertson People who aren't f.ing tolls?

[@zeyadkenawi8268]

booooring