Microsoft forked MIT licensed repo and changed the copyright [fixed] • Hacker News Board

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#321

Post by jeffwilcox » Sat, Dec 25, 2021, 6:29 PM UTC

I lead the Microsoft Open Source Programs Office team. I'm sorry this happened.

We have merged a pull request that restored the correct LICENSE file and copyright, and are in touch with the upstream author Leśny Rumcajs who emailed us this morning. We'll look to revert the entire commit that our bot made, too, since it updated the README with a boilerplate getting started guide.

The bug was caused by a bot that was designed to commit template files in new repositories. It's code that I wrote to try to prevent other problems we have had with releasing projects in the past. It's not supposed to run on forks.

I'm going to make sure that we sit down and audit all of our forked repositories and revert similar changes to any other projects.

We have a lot of process around forking, and have had to put controls in place to make sure that people are aware of that guidance. Starting a few years ago, we even "lock" forks to enforce our process. We prefer that people fork projects into their individual GitHub accounts, instead of our organization, to encourage that they participate with the upstream project. In this situation, a team got approval to fork the repository, but hasn't yet gotten started.

To be as open as I can, I'd like to point to the bug:

- The templates we apply on new repositories live at https://github.com/microsoft/repo-templates

- The bug seems to be at this line of the new repository workflow: https://github.com/microsoft/opensource-management-portal/bl...

- The system we have in place even tries to educate our engineers with this log message (https://github.com/microsoft/opensource-management-portal/bl...): "this.log.push({ message: `Repository ${subMessage}, template files will not be committed. Please check the LICENSE and other files to understand existing obligations.` });"

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#322

Post by michaelmrose » Sat, Dec 25, 2021, 6:30 PM UTC

dpweb wrote: post #232

osolo wrote: post #178

The attitude in these threads always boggles my mind. When YOU, your teammates or someone else you know makes a mistake, then it’s just a mistake. But when someone at Microsoft makes a mistake it’s because Microsoft is evil and by extension so is the person who offended. “It’s a big company”, you say. They should have a process! And I’m sad to say, they do/will have a process exactly because of this attitude. Then, e…

You have to take "companies doing good" always with a grain of salt. They're profit seeking companies, who act aggressively in their own interests. It doesn't have to be a debate on "good vs evil" I've always hated those terms applied in these contexts, it's childish and for the naive. Fix the problem and move on.

A company is merely a useful legal and organizational fiction. It's all people all the way down and those people don't act in a different moral context when they act on behalf of a company.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#323

Post by MrStonedOne » Sat, Dec 25, 2021, 6:32 PM UTC

osolo wrote: post #178

The attitude in these threads always boggles my mind. When YOU, your teammates or someone else you know makes a mistake, then it’s just a mistake. But when someone at Microsoft makes a mistake it’s because Microsoft is evil and by extension so is the person who offended. “It’s a big company”, you say. They should have a process! And I’m sad to say, they do/will have a process exactly because of this attitude. Then, e…

No post body was provided.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#324

Post by mlyle » Sat, Dec 25, 2021, 6:32 PM UTC

michaelmrose wrote: post #310

Tyriar wrote: post #203

Earlier quoted context omitted.

MS dev here. Thanks for calling this out. I contacted the GH@MS admins to look into this and to consider adding some safeguards to the tooling so this doesn't happen in the future.

How is it remotely possible to not understand you cannot automatically overwrite a license file with your own. If you yourself were creating such automation wouldn't that be one of the first and most obvious things you would think of?

If you think of the use case of forks, sure.

If you think of employees creating new repos in the org--- smash the correct LICENSE in there ASAP.

The problem is that forking a different repo into the org triggers the logic of a "new repository".

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#325

Post by skywhopper » Sat, Dec 25, 2021, 6:32 PM UTC

osolo wrote: post #178

The attitude in these threads always boggles my mind. When YOU, your teammates or someone else you know makes a mistake, then it’s just a mistake. But when someone at Microsoft makes a mistake it’s because Microsoft is evil and by extension so is the person who offended. “It’s a big company”, you say. They should have a process! And I’m sad to say, they do/will have a process exactly because of this attitude. Then, e…

Folks who work at mega corporations with outrageous amounts of power have a correspondingly large responsibility to the communities they interact with. Their mistakes have a much larger impact. Honest mistakes by hugely powerful entities are not mere trivia. They have an effect on the rest of the world commensurate with their power. Thus they should be held to a much higher standard than everyone else.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#326

Post by mlyle » Sat, Dec 25, 2021, 6:34 PM UTC

chris_wot wrote: post #282

tptacek wrote: post #251

Earlier quoted context omitted.

The MIT license puts essentially no restrictions on them that they would need to relicense out from under. They can't un-MIT it. So I'm still not clear on how you propose for them to make money by doing this. Do you have an answer to my question?

If they can change the copyright ownership from an individual to themselves, then they could (however unlikely) change the license on subsequent revisions to no longer provide the software free of charge, and could prevent anyone from using the software and associated documentation files in an unrestricted form.

> then they could (however unlikely) change the license on subsequent revisions to no longer provide the software free of charge,

You don't need to change the "ownership" to do this. MIT licensed software can be put under more restrictive licenses for subsequent revisions by anyone.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#327

Post by akkartik » Sat, Dec 25, 2021, 6:34 PM UTC

m3047 wrote: post #307

akkartik wrote: post #286

Earlier quoted context omitted.

It's a bug, but it's also an example of what I think of as differential accountability : * Bugs in the bot inevitably assign ownership to the writer rather than from the writer. * Bugs in the billing system invariably overcharge customers * Bugs in the image recognition system invariably select white people. Well-meaning people still follow their incentives. Corners have to get cut somewhere. I totally agree this isn…

I believe "moral hazard" is the term of art for what you describe.

Approximately. Moral hazard typically refers to sins of commission. Deliberately taking on more risk because you're insured. Here I'm thinking more of sins of omission. You just forgot to do something. You didn't have enough attention to devote to the task, so you rationally apportioned the attention budget to the areas most likely to be checked by others.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#328

Post by [deleted] » Sat, Dec 25, 2021, 6:35 PM UTC

throwaway984393 wrote: post #211

It seems people are outraged because they don't like it, but they don't seem to be talking about whether it's actually legal. IANAL, but the MIT license specifically does not say you have to redistribute with the same copyright owner notice. It says the copyright notice and terms must remain, and that you can sublicense it. It doesn't say you can't change the copyright notice.

[deleted]

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#329

Post by [deleted] » Sat, Dec 25, 2021, 6:35 PM UTC

jeffwilcox wrote: post #321

I lead the Microsoft Open Source Programs Office team. I'm sorry this happened. We have merged a pull request that restored the correct LICENSE file and copyright, and are in touch with the upstream author Leśny Rumcajs who emailed us this morning. We'll look to revert the entire commit that our bot made, too, since it updated the README with a boilerplate getting started guide. The bug was caused by a bot that was d…

[deleted]

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#330

Post by csunbird » Sat, Dec 25, 2021, 6:35 PM UTC

michaelmrose wrote: post #303

throwaway277432 wrote: post #247

Earlier quoted context omitted.

Thank you. So these are in fact all mistakes. I looked at some of the other forked repos (95 out of 4.5K repos) and all the human commits from MS I saw seem to care about getting the licenses right. So it really is just a broken bot. I hope the bot can be fixed soon and I'm going to put my figurative pitchfork down now.

How can someone be so bad at their job that they realize that a bot that writes to the license file needs to avoid overwriting an existing file? A certain degree of malfeasance cannot possibly be explained as incompetence.

or maybe they do not know/they missed that creating a fork from an existing project actually triggers “new repo created” event in the github organization, which has an unintended effect.