Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft forked MIT licensed repo and changed the copyright [fixed]

github.com

Post reply on HN
Print view View original

491–500 of 626 posts

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#491

Post by laumars »

res0nat0r wrote: post #273
laumars wrote: post #216

Earlier quoted context omitted.

This isn’t just one person making a silly mistake. This is a catalogue of failings. Where’s the peer review? Are you suggesting that anything published in the main branch on Microsoft’s GH org gets commit without any branch protection? And as pointed out by others, this isn’t even an isolated case. A healthy org doesn’t blame individuals, it blames failures in process. Thus Microsoft should own this mistake. Stating…

It's an automated bot, and it's an edge case that wasn't considered and is going to get fixed soon.

I’m satisfied that the situation has been, or at least will be, resolved.m however there is still the unanswered question of who audits the changes the bot makes.

There is a definitely lesson to be learnt here that bots aren’t infallible themselves and thus need reviewing too. Automation undoubtedly enhances our developer experience but we do need to ensure that automation doesn’t make unchecked changes. This is something a great many engineers can learn from too.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#492

Post by jeffwilcox »

yawaramin wrote: post #454
jeffwilcox wrote: post #436

Earlier quoted context omitted.

Git for Windows comes to mind. Teams can absolutely get approval for any open source license; however, for a GPL project, we'd have their open source legal team work with them to brief them on the license obligations and requirements, such as publishing code to https://3rdpartysource.microsoft.com/ .

Interesting, so that's specifically for GPL-licensed projects? Or am I misunderstanding and you would have dev teams work with Legal for any open source licensed project?

Copyleft has more process, since we absolutely need our engineers to understand the obligations we have, and for some of us, it may be the first time we're being introduced to open source communities and licensing, so we have to do more education in the GPL case.

Our process revolves more about _using_ open source than forking specifically.

Whenever a build runs at the company, we have a detection task that identifies the open source that is used, storing an inventory. We evaluate the open source licenses for that inventory, and have automation depending on the license that will help inform a team that has taken a new dependency with specific legal obligations - could be to get business and legal approval for something, to take training and learn about copyleft software and licensing, or that they need to post third-party buildable source. We're also able to use that inventory to help with incident response and blast radius analysis.

To scale, we need to make sure that our guidance and policies are in front of people, but we know that engineers want to get work done (or will find a way around what we have in place), and so need to be efficient and straightforward.

Not all situations will require a business or legal approval. Our motto has been "eliminate, automate, delegate" - eliminate onerous bureaucracy and policies - automate licensing compliance and inventory and approvals - and delegate to business leaders and others when there's a need for humans to be involved.

Sorry for the long answer.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#493

Post by [deleted] »

37ef_ced3 wrote: post #248
phendrenad2 wrote: post #89

Earlier quoted context omitted.

That "issue" is unrelated. You've just hijacked the thread to talk about it. Also the point you're making is controversial, and definitely isn't widely agreed on. As a human, I can read public code on Github, and use my internal neural network (brain) to regurgitate sections of code, and don't need to attribute anyone (who can say which codebase I'm recalling code from? I certainly can't). So a neural network doing t…

"Unrelated"? Microsoft's automated violation of "no use without attribution" licenses? You can't see the connection? Please. Surely it's obvious to everyone but you.

[deleted]

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#494

Post by oblio »

sarahnovotny wrote: post #350
jeffwilcox wrote: post #321

I lead the Microsoft Open Source Programs Office team. I'm sorry this happened. We have merged a pull request that restored the correct LICENSE file and copyright, and are in touch with the upstream author Leśny Rumcajs who emailed us this morning. We'll look to revert the entire commit that our bot made, too, since it updated the README with a boilerplate getting started guide. The bug was caused by a bot that was d…

This is my favorite part of the culture change which is happening at Microsoft. We are still working on it. And, it will take time. Jeff's team, my team, the java team whose forked repo this unintentionally highlighted are working with dozens of other teams every week. Satya says we're all in on open source. Hold Jeff and Me and all the leaders of Microsoft to that vision. Keep us accountable. And, know this takes ti…

> Satya says we're all in on open source.

You're not, just as your competitors aren't.

None of the secret sauces are Open Source: Windows, Office, Visual Studio, SQL Server, the Azure control stuff, and I don't expect them to be.

You're half in, at best, only Red Hat was all in. And they were bought out by IBM, so here we are.

Edit: I guess the truth hurts :-)

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#495

Post by dpark »

wise_young_man wrote: post #480
mlyle wrote: post #324

Earlier quoted context omitted.

If you think of the use case of forks, sure. If you think of employees creating new repos in the org--- smash the correct LICENSE in there ASAP. The problem is that forking a different repo into the org triggers the logic of a "new repository".

A simple solution prior to writing to a file in this case is to check if it already exists. It shouldn’t matter what triggers this bot if it’s programmed safe and idempotent.

So your simple solution is to not have the bug. Wish I’d thought of this for all the bugs I’ve ever shipped.

Disclosure: Microsoft employee who sometimes writes bugs.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#496

Post by citygm »

jeffwilcox wrote: post #321

I lead the Microsoft Open Source Programs Office team. I'm sorry this happened. We have merged a pull request that restored the correct LICENSE file and copyright, and are in touch with the upstream author Leśny Rumcajs who emailed us this morning. We'll look to revert the entire commit that our bot made, too, since it updated the README with a boilerplate getting started guide. The bug was caused by a bot that was d…

No post body was provided.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#497

Post by oblio »

jeffwilcox wrote: post #443
dapids wrote: post #401

Earlier quoted context omitted.

Do you mind addressing the reason why an employee did exactly what you are claiming the bot did in error? https://github.com/microsoft/cups/commit/8100595a3a3a6d5c7d0... Again, this is a person, not a robot. How does this play into a "software bug"?

Honestly, I'm not sure what happened here. My guess is that they were going through a checklist of what to do when releasing open source changes, and didn't understand what they were doing. A lot of why we've had to put some guardrails in our system has been to point people to guidance and training on open source. I've sent the team that works on this repository an e-mail, but I don't expect to get a response on the…

Just don't shoot down the poor schmuck, mistakes happen.

The pitchforks will come down, anyway :-)

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#498

Post by zekrioca »

jsnell wrote: post #489
zekrioca wrote: post #483

Earlier quoted context omitted.

Although Google was the one which prepared it for production before its releasing, k8s originated from academia (more precisely, University of Massachusetts Amherst). Ps.: check follow up comments. My comment in here is wrong.

Do you have a source for that claim?

My mistake. One of its founders has a PhD from there (thus my mistake), but k8s was actually created while he was working at Google, after his PhD (which has nothing to do with k8s..).

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#499

Post by yawaramin »

jeffwilcox wrote: post #492
yawaramin wrote: post #454

Earlier quoted context omitted.

Interesting, so that's specifically for GPL-licensed projects? Or am I misunderstanding and you would have dev teams work with Legal for any open source licensed project?

Copyleft has more process, since we absolutely need our engineers to understand the obligations we have, and for some of us, it may be the first time we're being introduced to open source communities and licensing, so we have to do more education in the GPL case. Our process revolves more about _using_ open source than forking specifically. Whenever a build runs at the company, we have a detection task that identifie…

Thank you–very informative answer.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#500

Post by dpark »

michaelmrose wrote: post #310
Tyriar wrote: post #203

Earlier quoted context omitted.

MS dev here. Thanks for calling this out. I contacted the GH@MS admins to look into this and to consider adding some safeguards to the tooling so this doesn't happen in the future.

How is it remotely possible to not understand you cannot automatically overwrite a license file with your own. If you yourself were creating such automation wouldn't that be one of the first and most obvious things you would think of?

Do you never write code with bugs or do your employers just judge you much less harshly than you judge others?

> If you yourself were creating such automation wouldn't that be one of the first and most obvious things you would think of?

Probably not, because it sounds like this was not intended to ever run on forked repos at all.

Post reply on HN