Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project includes a dependancy that has a license that forbids its use

github.com

Post reply on HN
Print view View original

11–20 of 249 posts

Re: Project includes a dependancy that has a license that forbids its use

#11

Post by oaiey »

gpm wrote: post #7

I am not a lawyer... There may be an argument here that 1. GitHub has a valid license to distribute it (as a result of their TOS) 2. Running the downloaded code is not copyright infringement (or not obviously so, and hasn't been established as so in any court that I am aware of) 3. Using the APIs is not copyright infringement (see Oracle v Google, if that was fair use this almost certainly is) Thus no copyright infri…

Regards (3): have not they have a dependency on the implementation? Oracle/Google was about the interface and the design of the API interface not the implementation.

Re: Project includes a dependancy that has a license that forbids its use

#12

Post by gpm »

HomeDeLaPot wrote: post #10
gpm wrote: post #7

I am not a lawyer... There may be an argument here that 1. GitHub has a valid license to distribute it (as a result of their TOS) 2. Running the downloaded code is not copyright infringement (or not obviously so, and hasn't been established as so in any court that I am aware of) 3. Using the APIs is not copyright infringement (see Oracle v Google, if that was fair use this almost certainly is) Thus no copyright infri…

I think GitHub gives you the right to download or fork the repo, but the license explicitly states that you can't use the code. That might mean running it on its own is technically illegal. The license literally says "you can't use this". How are so many people confused about the license in this thread?

> That might mean running it on its own is technically illegal.

Based on what law/authority?

Copyright law forbids making copies, derivative works, etc. Not using things. You're allowed to read a book without a license.

Moreover copyright law makes an explicit exception for the copies required to run a computer program on a machine that aren't used in other ways (i.e. copying it to ram/registers): https://www.law.cornell.edu/uscode/text/17/117

The author may say "you can't use this", but it is not clear to me that he has any legal authority to do so.

Re: Project includes a dependancy that has a license that forbids its use

#13

Post by gpas »

From the explaining blog post [0]

> If you’re not interested in how it works and you just want to do monkey patching, then you can find the library here.

Also

> Wrapping it up in a nice library

> I took the above code and put it in an easy to use library. It supports 32 bit, reversing patches, and patching instance methods. I wrote a couple of examples and put those in the README.

Then in the README[1]:

> Make sure you read the notes at the bottom of the README if you intend to use this library.

Either the author is confused or has decided that he doesn't want to maintain an hack. Anyway license is pretty clear.

There was an HN thread[2] when it was released.

[0] https://bou.ke/blog/monkey-patching-in-go/

[1] https://github.com/bouk/monkey

[2] https://news.ycombinator.com/item?id=9290917

Re: Project includes a dependancy that has a license that forbids its use

#14

Post by gpm »

oaiey wrote: post #11
gpm wrote: post #7

I am not a lawyer... There may be an argument here that 1. GitHub has a valid license to distribute it (as a result of their TOS) 2. Running the downloaded code is not copyright infringement (or not obviously so, and hasn't been established as so in any court that I am aware of) 3. Using the APIs is not copyright infringement (see Oracle v Google, if that was fair use this almost certainly is) Thus no copyright infri…

Regards (3): have not they have a dependency on the implementation? Oracle/Google was about the interface and the design of the API interface not the implementation.

They do, it's not an entirely identical situation, I believe it is analogous though.

The question I'm addressing in 3 is whether or not the source code becomes a derivative work of the dependency (meaning writing it in the first place would be illegal). The only portion of the dependency that the source code copied was the names of a few functions/modules (part of the API). Copying that part of the API into the work seems very analagous to the Oracle/Google case, except even less was copied and it is even less of a market place competitor (but again, I'm not a lawyer).

Re: Project includes a dependancy that has a license that forbids its use

#15

Post by balfirevic »

gpm wrote: post #7

I am not a lawyer... There may be an argument here that 1. GitHub has a valid license to distribute it (as a result of their TOS) 2. Running the downloaded code is not copyright infringement (or not obviously so, and hasn't been established as so in any court that I am aware of) 3. Using the APIs is not copyright infringement (see Oracle v Google, if that was fair use this almost certainly is) Thus no copyright infri…

> 1. GitHub has a valid license to distribute it (as a result of their TOS)

From the GitHub TOS someone posted:

"... license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking)"

I'm not sure if cloning from GitHub to your local computer falls under "reproduce Your Content solely on GitHub as permitted through GitHub's functionality" (due to "solely on GitHub" part).

Re: Project includes a dependancy that has a license that forbids its use

#16

Post by TheCoelacanth »

boomboomsubban wrote: post #5
Y_Y wrote: post #3

So there is no grant of copyright to distribute copies of the dependency, but what about useyright? The dependant project just uses the the dependency to run a test. Supposing it didn't distribute it as part of the release, is that still allowable?

The conflicting license states >I do not give anyone permissions to use this tool for any purpose. Don't use it. So no use rights either.

Copyright does not give authority over use, only over redistribution.

Re: Project includes a dependancy that has a license that forbids its use

#17

Post by wereHamster »

philipswood wrote: post #2

Quite an unusual, but effective, way to mark something as a proof of concept that's dangerous to use: From [1]: "This is as unsafe as it sounds and I don't recommend anyone do it outside of a testing environment." [1]: https://github.com/bouk/monkey#i-thought-that-monkeypatching...

> … I don't recommend anyone do it outside of a testing environment.

… which is exactly dow it is used in dapr

> This is only used in the test (and thus not.compiled and distributed in our binaries).

(source: https://github.com/dapr/dapr/issues/3563#issuecomment-901563...)

Re: Project includes a dependancy that has a license that forbids its use

#18

Post by Y_Y »

boomboomsubban wrote: post #5
Y_Y wrote: post #3

So there is no grant of copyright to distribute copies of the dependency, but what about useyright? The dependant project just uses the the dependency to run a test. Supposing it didn't distribute it as part of the release, is that still allowable?

The conflicting license states >I do not give anyone permissions to use this tool for any purpose. Don't use it. So no use rights either.

But the granting of rights to redistribute is governed by the applicable copyright law, as far as I know there is no equivalent body of law governing usage. You can't give someone information but attach conditions to its use, except in specific circumstances. You can certainly make someone sign a contract before agreeing to give them the information, but that's not what's occurring here.

Re: Project includes a dependancy that has a license that forbids its use

#19

Post by ErikCorry »

gpm wrote: post #7

I am not a lawyer... There may be an argument here that 1. GitHub has a valid license to distribute it (as a result of their TOS) 2. Running the downloaded code is not copyright infringement (or not obviously so, and hasn't been established as so in any court that I am aware of) 3. Using the APIs is not copyright infringement (see Oracle v Google, if that was fair use this almost certainly is) Thus no copyright infri…

Github has a valid license to distribute it but you are not Github so that doesn't give you a right to anything. In particular it doesn't give you a right to download it.

Re: Project includes a dependancy that has a license that forbids its use

#20

Post by gpm »

balfirevic wrote: post #15
gpm wrote: post #7

I am not a lawyer... There may be an argument here that 1. GitHub has a valid license to distribute it (as a result of their TOS) 2. Running the downloaded code is not copyright infringement (or not obviously so, and hasn't been established as so in any court that I am aware of) 3. Using the APIs is not copyright infringement (see Oracle v Google, if that was fair use this almost certainly is) Thus no copyright infri…

> 1. GitHub has a valid license to distribute it (as a result of their TOS) From the GitHub TOS someone posted: "... license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking)" I'm not sure if cloning from GitHub to your local computer falls under "reproduce Your Content solely o…

I'm not completely sure either, I don't think you would get a definitive answer short of litigating it (and let's be honest, no one is litigating over this).

(Again, not a lawyer, not super familiar with this part of copyright law, but...) I'd argue that the copy is made on githubs server and then sent to me, and I simply move the sole copy around (or to the extent that I make a new copy it is a lawful copy of the network traffic for archival purposes under 17 USC 117 (a) (2)). That "git clone" is clearly a integral part of githubs service so the license is clearly intended to cover it. That "git clone" is not meaningfully different from "wget" from "a web browser" - again the license is clearly intended to cover this. That any liability that does exist falls on GitHub as the party making the copy.

I'm not sure which if any of those arguments would convince a court though

Post reply on HN