Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project includes a dependancy that has a license that forbids its use

github.com

Post reply on HN
Print view View original

241–249 of 249 posts

Re: Project includes a dependancy that has a license that forbids its use

#241

Post by iamevn »

hansvm wrote: post #237
chrisoverzero wrote: post #182

Earlier quoted context omitted.

I told the judge that I didn’t kill anyone, the hitman I hired did! For some reason, he didn’t see it as you do.

Performing those actions on GitHub isn't important because it allows you to technically bypass a restriction by having a third party do it (which I agree is a poor defense) but because the author explicitly relinquished some rights by putting the project on GitHub.

the author does not relinquish rights to run the code. running it on a third party service does not magically launder the license.

Re: Project includes a dependancy that has a license that forbids its use

#242

Post by patrickdevivo »

This post inspired me to try writing some SQL that downloads all the LICENSE files of declared go mod dependencies: https://askgit.substack.com/p/query-for-go-dependency-licens... using a project I maintain.

Some flaws, but was able to download a bunch of licenses :)

Re: Project includes a dependancy that has a license that forbids its use

#243

Post by DangitBobby »

hnarn wrote: post #240
DangitBobby wrote: post #239

Earlier quoted context omitted.

I just don't think "here's a neat thing... tee-hee you can't use it!" Is funny. I don't know if "neener neener" was ever funny to me, even as a child. I understand that it's important to you to bandy about "subtle" accusations by using words like "entitle" so you can feel like you have a point, but there's nothing more there. If I felt entitled I would just ignore the license and use the code anyway.

I have no idea what you’re talking about.

I have a hard time believing that the word "entitle" was accompanied by no judgement, but if not, then I apologize for making assumptions. I find feelings of entitlement to be largely the result of selfishness or delusion, and so when I hear it applied to me, that's what I think is being said.

Re: Project includes a dependancy that has a license that forbids its use

#244

Post by hansvm »

iamevn wrote: post #241
hansvm wrote: post #237

Earlier quoted context omitted.

Performing those actions on GitHub isn't important because it allows you to technically bypass a restriction by having a third party do it (which I agree is a poor defense) but because the author explicitly relinquished some rights by putting the project on GitHub.

the author does not relinquish rights to run the code. running it on a third party service does not magically launder the license.

> does not relinquish the rights to run the code

I don't think anyone who's posted so far is a lawyer, but the claim is precisely that GitHub's ToS do relinquish the rights to run the code, so long as you only do so on GitHub and through their published interface.

GitHub ToS> If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking).

> running it on a third party service does not magically launder the license

Totally agreed. By uploading to GitHub publicly you've granted an _additional_ license and asserted that you had the legal right to do so. It's kind of like when open source projects will also sell a proprietary license on request -- companies aren't magically beholden to the GPL'd version just because it exists somewhere; they get to choose which of their available licenses they'd prefer to use.

Re: Project includes a dependancy that has a license that forbids its use

#245

Post by still_grokking »

Macha wrote: post #232
still_grokking wrote: post #135

I'm completely baffled how people work. Something like that can't actually happen. At least if you assume people working on software can read. But it seems not even this can be safely assumed nowadays. How can someone include some dependency without checking the license? That's actually the very first thing to do, before you can even consider using something! Not doing this is extremely unprofessional. Additionally i…

I highly doubt most devs check the license of every dependency 3 layers deep from their UI framework. create-react-app, vue-cli sets up several hundred dependencies. If you tell me >50% of devs investigate each dependency manually, or run a license checker on that, I don't believe you. Where I work for we have automated license scanners for this reason. They would flag such a use. But this open source project, and ap…

Automation is of course very helpful.

But my point wasn't about transitive deps (directly). The point is about pulling something new into your project.

At the point you include something that something needs to tell you the license for itself and for all its dependencies. If it doesn't that's already fishy in its own rights (and you should turn back or start investigating for real). You need to look at the provided license lists of course.

Yes, I see more and more projects that don't list licenses for their deps. But that's usually already a license volition on its own! You can't use something like that, it's obviously problematic.

Having some tools that download random stuff form the internet may be OK when you're doing something for yourself. But at the moment you want to publish that something you're obligated to check the licenses. That's a know thing. If you don't that's very shoddy work, and actually you could get sued for all resulting damages.

So no matter what it's actually impossible to include code with a problematic license, given no botchers were involved anywhere deeper in the chain.

And here we're at the core of what I've said:

It's completely baffling to me how something like that could possibly happen. At least as long as I try to believe that no complete idiots work in the industry, people who aren't even capable of reading, and don't know even the most basic things about the job they try to do. People that therefore shouldn't be allowed to touch anything as they could create great danger for their surroundings and for themself!

But OK, maybe I just have to accept that the software industry is not different to this here:

https://www.youtube.com/watch?v=FfyPLTIn2D8

Re: Project includes a dependancy that has a license that forbids its use

#246

Post by ryan_lane »

thatguy0900 wrote: post #234
ryan_lane wrote: post #213

Earlier quoted context omitted.

The issue here is that you're a well-poisoner, putting out code that can't be used, as a joke, while also making a popular blog post and making the software easy to use as a library. Now that it's being used, it's also hard for folks to remove your library and implement something similar without it being considered a derivative. Sure, it's funny, but it's a joke at the expense of everyone else. This is like going to…

One important difference is he didn't walk up to anybody, they walked up to him. He owes nothing to anybody, it's not like he ran a media campaign.

He wrote a blog post that was quite popular at the time. He's in this thread explicitly saying he did it for the lulz. The repo doesn't clearly say not to use it, only the license does.

People shouldn't use software without checking the license, but if you're making a joke, for a pattern that's actually something used in the industry, because you believe that pattern is bad, yeah, you should label it a joke.

Re: Project includes a dependancy that has a license that forbids its use

#247

Post by shkkmo »

CyberRabbi wrote: post #225
shkkmo wrote: post #214

Earlier quoted context omitted.

> If language standards indeed cause discrimination, please demonstrate how. Otherwise this is a baseless claim. That wasn't my claim. My claim was that prescriptive approaches to language facilitate and magnify discrimination and have historically frequently been used to justify and enforce discrimination. You can look at how regional UK dialects affect employability and education outcomes. You can look at the way s…

> You can look at how regional UK dialects affect employability and education outcomes. If you apply for a job in China and you only speak broken Chinese, resembling a pidgin language, it’s not “discrimination” if you are not hired. Similarly, if you apply to a position where you are expected to speak standard English and you only speak a lesser known dialect, that is not discrimination either. It’s not meeting job r…

> just as it’s unfortunate non-Chinese speakers cannot obtain jobs in Chinese-speaking areas

Except the dialects are often local to the places where the opportunities are being sought and can exist due to a long history of racism driven segregation...so you analogy is completely erroneous.

> In other words, the pre-existing discriminatory attitude causes the exclusionary behavior in language not vice versa.

I'm glad to hear you admit alteast part of this. If you grant that discrimination leads to some language prescriptions, is it that hard to see how those prescriptions, when used normatively by people with no intention of racism, can end up perpetuating the exact racist attitudes that lead to the creation of those language prescriptions?

This is precisely my point: this history and the current reality means that we should be care about how and when it is worth spreading prescriptive approaches to language, ideally limiting it to times when ambiguity is created or meaning is lost.

Re: Project includes a dependancy that has a license that forbids its use

#248

Post by CyberRabbi »

shkkmo wrote: post #247
CyberRabbi wrote: post #225

Earlier quoted context omitted.

> You can look at how regional UK dialects affect employability and education outcomes. If you apply for a job in China and you only speak broken Chinese, resembling a pidgin language, it’s not “discrimination” if you are not hired. Similarly, if you apply to a position where you are expected to speak standard English and you only speak a lesser known dialect, that is not discrimination either. It’s not meeting job r…

> just as it’s unfortunate non-Chinese speakers cannot obtain jobs in Chinese-speaking areas Except the dialects are often local to the places where the opportunities are being sought and can exist due to a long history of racism driven segregation...so you analogy is completely erroneous. > In other words, the pre-existing discriminatory attitude causes the exclusionary behavior in language not vice versa. I'm glad…

> Except the dialects are often local to the places where the opportunities are being sought and can exist due to a long history of racism driven segregation...so you analogy is completely erroneous.

“Local” is totally subjective. The core point is that requiring that a job application speaks in a certain manner is not necessarily unjust and likely in the vast majority of cases is a pragmatic matter. Language / dialect is not an intrinsic property of someone’s identity. People are able to learn new accents, dialects, and languages. Accents being the easiest to learn. It’s not a protected class. The existence of a standard makes it easier for newcomers to learn the language.

> If you grant that discrimination leads to some language prescriptions, is it that hard to see how those prescriptions, when used normatively by people with no intention of racism, can end up perpetuating the exact racist attitudes that lead to the creation of those language prescriptions?

No, that’s nonsense. If someone’s feelings are unintentionally hurt because they are made aware that their English is not correct, that is not racism.

Re: Project includes a dependancy that has a license that forbids its use

#249

Post by hack-news »

concordDance wrote: post #128
bouk wrote: post #41

Earlier quoted context omitted.

Pretty funny right?

Yes, I had a chortle, particularly at the reactions in this thread. :D Though I'm an anarchist who thinks people give the law as written far too much weight. (As opposed to what the population as a whole thinks is good or bad)

No one gives a fuck what you think, dimwit.
Post reply on HN