Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Unbelievable Demo

brendangregg.com

Post reply on HN
Print view View original

431–440 of 478 posts

Re: An Unbelievable Demo

#431

Post by cowsandmilk »

Aachen wrote: post #340
Twirrim wrote: post #330

Earlier quoted context omitted.

> ... or just go with it and have it be open source? They didn't have the legal right to do so.

How is that? The company added code to a GPL project, that means it is a derivative work and also comes with software freedoms, or at least that's how the story reads to me since there is no mention of other claims or parties to the mix. That means the company owns the copyright to the added code and is free to comply with the contract (license).

Company A writes library with commercial license.

Company B uses that library and a GPL library in a product. They distribute the product.

Company B has no right to relive se Company A’s commercially licensed library under the GPL. Hence, stop distribution and replace GPL library.

Re: An Unbelievable Demo

#432

Post by cperciva »

yuppiemephisto wrote: post #429
cperciva wrote: post #345

Earlier quoted context omitted.

I think you're giving cperciva too much credit. He was just as arrogant as people thought, and he was definitely defensive.

TIL. Sounded reasonable to me, so quite likely I'm arrogant too. Tarsnap's still there though, so I'd say that's a good defense.

I didn't say that I was wrong.

But I was having a bad day, and I said things in a different and more abrasive way than I normally would.

Re: An Unbelievable Demo

#433

Post by grahamburger »

I recently had an experience kind of like this. I run a website about a kind of niche topic. I got a call from someone at a FAANG one day working in a similar space who wanted to chat about it. I get these calls pretty regularly and agreed, always happy to chat about it. While she was showing me some of what they were working on it started to look very familiar, and I realized that a lot of the ideas had been copied from my site. In some cases they had literally copy/pasted my content. I mentioned this to her and she got uncomfortable and admitted to something like "yeah we took a lot of inspiration from your work." Frankly I don't care that much, I put the info out there to be used and use it they did! But attribution (or an acquisition offer) would have been nice.

Re: An Unbelievable Demo

#434

Post by rubicon33 »

throwaway3699 wrote: post #75
rubicon33 wrote: post #63

Earlier quoted context omitted.

I don't understand what bsdiff does, or is. I am a software developer and I frankly have no clue what I would ever use bsdiff for! I've read what it does (libraries for building and applying patches to binary files) and still don't really have a sense for what the purpose of this tool is. What are some real life use cases for it? When does a developer need such a tool?

Implementing software updates where you don't want to ship entire binaries again (and only the diff) would be one. In some video games the assets are also packed into massive binaries, so you don't want to ship gigabytes of data because you replaced one icon. Sadly many games do this anyway nowadays.

Ahh, thank you for the explanation. That's an awesome tool!

I actually could really see using it, now that I understand what it does.

I've worked on some firmware projects where we did OTA updates and were guilty of shipping the entire binary. Luckily, even the entire binary was rather small, but still it would have been very cool to be able to create a diff and ship only the diff!

Re: An Unbelievable Demo

#435

Post by brendangregg »

toyg wrote: post #124
neilv wrote: post #86

There's a long industry history of stealing code, but I'm surprised to hear this story of Sun allegedly doing it. My impression is that reason for the stealing usually makes sense. For example, a key library that's hard to write that's just copied into the source tree, ignoring licensing. Or an appliance developer didn't want to deal with licensing for Linux or BusyBox. Or an individual developer in over their head q…

You are very compassionate towards people just literally stealing code. My experience is that a lot of folks just don't care about licenses: they steal and rebrand by any mean necessary, I guess to accumulate reputation. I wrote a few silly scripts in my lifetime, all small-time stuff (so trivial it never got me hired as a Dev anywhere). No matter whether I marked things as GPL or BSS, I often found them copied on Gi…

I've seen blatant cases as well. There was a github repo where someone was sharing their notes on performance engineering, and there were tickets from people thanking them for their amazing work. Except these notes were literally copy-n-pasted pages from my systems performance book. It's weird to find all these messages from people thanking someone else for the work I did.

When I contacted them to ask how they thought it was ok to republish my work like this (I was giving them a chance to explain), they just took it all down.

Re: An Unbelievable Demo

#436

Post by deathanatos »

jffry wrote: post #252
vanderZwan wrote: post #80

Earlier quoted context omitted.

While I'm not the author of anything, I did on one occasion share Russ Cox' articles on regexes with a fellow developer, only for that developer to reply "that guy is making a mountain out of a molehill, just use re2" .

For anybody who's lost: Russ Cox is the original author of re2, a fast C++ library implementing regular expressions that are guaranteed to run in linear-time. There's a collection of articles they wrote talking about regexes and various pitfalls: https://swtch.com/~rsc/regexp/

This is still relevant today, too. The last several JavaScript vulns. that people at my company have had to upgrade around were because of accidentally quadratic regex in JavaScript. One poor library[1] was attempting to match a header whose grammar was a whoppingly complex,

  1#token
(this is in the HTTP spec's notation: it means 1 or more `token`s, comma separated with optional whitespace around the comma) and hit this, by trying to split the incoming values with,

  / *, */
I was shocked that this wasn't compiled to a DFA. (I checked, too: my JS exhibited the behavior in the bug report.)

This is, I also think, another reason why "simple" text protocols are not really so simple. The grammar above is "trivial", and yet, this is the end result. I don't feel like the library is particularly at fault: I doubt I would have caught this in code review.

[1]: https://www.npmjs.com/advisories/1748

Re: An Unbelievable Demo

#438

Post by kortilla »

TeMPOraL wrote: post #90
kortilla wrote: post #52

Earlier quoted context omitted.

Where does this expectation come from that a rich organization or person using open source software should be paying for it? That’s against the entire spirit of the open source license in the first place.

From the same place taxes come, or more generally, quite a lot of social obligations. It's the expectation that, if you're benefiting from commons, you should also contribute something back to the commons. A company using open source software to make money is making money off commons. Makes sense they should feel obliged to contribute something back, and since they have the surplus of the best form of contribution -…

Open source isn’t a commons. That’s your major mistake. Using it does not deprive others or wear down something.

> it's reasonable to expect them to donate some of it.

No, that’s actually quite ridiculous. “Reasonable” implies some level of reasoning behind it. There is no “reasonable” proposal of how much money should be given when it’s against the very spirit of the license to expect payment based on usage.

What is the percentage amount of profit an individual or corporation should contribute? Give me a concrete calculation of software usage and how much should go back to the project. Is it measured in percentage of clock cycles spent executing that code across all of an entity’s compute?

Presumably the IRS should also give a cut of all tax revenue collected by the US to the open source projects it uses too, right? If not, your beef seems to be purely with private enterprise being successful more than any fairness based billing.

Re: An Unbelievable Demo

#440

Post by OldTimeCoffee »

derefr wrote: post #307
OldTimeCoffee wrote: post #255

Earlier quoted context omitted.

There are other solutions to this problem that the game industry uses. Binary diff patching is slow, incremental, involves large diffs and has the possibility of corruption. It was used back in the mid 90's (RTPatch was the big name), but really isn't used anymore because of the drawbacks. Games frequently use an override directory or file. The patch contains only the files that have changed and is loaded after the m…

Different things. Games are directories/packfiles containing many individual files, mostly binary art assets, plus one executable that takes up a negligible proportion of the total size. When binary art assets in the directory/packfile are updated between versions, they don't really "change" in the sense that a source-code file might be changed a git commit; instead, they get replaced. (I.e. every file change is esse…

bsdiff is pretty similar to RTPatch, which is what the game industry used in the past. I'm unaware of what you're describing ever being used in practice, especially among large game houses.

That said, patches aren't really downloaded as standalone patches anymore because of Steam distribution. The way Steam handles it is documented, and if you're interested, it's available here: https://partner.steamgames.com/doc/sdk/uploading#Building_Ef...

But as an overview, Steam splits files into 1MB chunks and only downloads the 1MB chunks that have changed. The 1MB chunks are compressed in transit. Steam also dedups the 1MB chunks. I would assume that this works fine to manage the tradeoffs between size and efficiency.

Post reply on HN