Live data from Hacker News

Microsoft forked MIT licensed repo and changed the copyright [fixed]

github.com

571–580 of 626 posts

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#571

I lead the Microsoft Open Source Programs Office team. I'm sorry this happened. We have merged a pull request that restored the correct LICENSE file and copyright, and are in touch with the upstream author Leśny Rumcajs who emailed us this morning. We'll look to revert the entire commit that our bot made, too, since it updated the README with a boilerplate getting started guide. The bug was caused by a bot that was d…

A lot of commenters are sharpening their pitchforks, but this comment, in my opinion, makes it very likely that it was an honest mistake. Amazing what taking personal responsibility and earnestly apologizing can do to restore trust and credibility!

Honestly, doing this all on Christmas nonetheless. This sort of thing is why I never want to be in leadership roles.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#572
post #495

Earlier quoted context omitted.

So your simple solution is to not have the bug. Wish I’d thought of this for all the bugs I’ve ever shipped. Disclosure: Microsoft employee who sometimes writes bugs.

The world is full of important people performing vital tasks either without fail or wherein failures can be caught by other individuals and processes that serve as guard rails. The solution isn't merely to be perfect it is to have a process that is tolerant of the level of imperfection that one would expect. For example it is perfectly reasonable that a someone could have foreseen it not clobbering a license file wit…

> The world is full of important people performing vital tasks either without fail or wherein failures can be caught by other individuals and processes that serve as guard rails.

Sometimes planes literally fall out of the sky. NASA caused a space shuttle to explode killing the entire crew. It is fundamentally untrue that anywhere in the world we have perfect people or processes.

> The solution isn't merely to be perfect it is to have a process that is tolerant of the level of imperfection that one would expect.

I expect that occasionally sometimes people will ship bugs and neither they nor the processes in place will catch them. This is a very minor bug. This is not the sort of bug that keeps engineering leaders up at night.

> For example it is perfectly reasonable that a someone could have foreseen it not clobbering a license file without prompting the user this could have brought the matter to immediate attention, its reasonable to suppose that if the first person didn't foresee it someone reviewing their choices might have thought of it, its reasonable that someone might have viewed the commit logs and noticed what was going on.

It’s really easy to point at others’ errors with the clarity of hindsight. But everything you said here boils down to just predicting the specific broken case, which is useless advice. Even your suggestion to check commit logs is useless unless you know the bug you’re looking for. It’s not as if Git spews errors when a license file is changed and it shouldn’t be. And if they knew what to look for in the logs, they wouldn’t have checked in the bug in the first place.

This team has doubtless shipped thousands of features. It’s unsurprising that they’ve shipped some bugs.

> None of this is an acceptable level of failure from people that drawing a 6 figure salary for a position of expertise or leadership.

You’re talking about a bug that caused a license file to be incorrectly changed and the fix is a revert. There is an audit trail of what happened and what repos were affected. It literally had no meaningful negative effect except to Microsoft’s image with the severest of critics, and to Jeff Wilcox’s holiday break. This is not a Therac-25 level incident.

I find it very interesting that none of the hyper-critical people in the comments here have discussed catching any broader class of issues. There are many comments criticizing the author for failing to check for an existing license file. (e.g.” How can someone be so bad at their job that they realize that a bot that writes to the license file needs to avoid overwriting an existing file?”) None of those comments that I’ve seen addresses the fact that adding a license file during a fork at all is probably an error. No, just criticism about this one case because someone told them about the exact observed bug so now it’s obvious.

The ability to criticize an error someone else already found is not valuable or constructive. And if this is the best you can bring, your judgement is certainly no better than the engineer who created the bug in the first place.

Disclosure: I’m a Microsoft employee.

Further disclosure: If someone showed up to a postmortem for my team with this level of condescension and no useful advice, I’d tell them to be quiet or leave.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#573
post #495

Earlier quoted context omitted.

So your simple solution is to not have the bug. Wish I’d thought of this for all the bugs I’ve ever shipped. Disclosure: Microsoft employee who sometimes writes bugs.

The world is full of important people performing vital tasks either without fail or wherein failures can be caught by other individuals and processes that serve as guard rails. The solution isn't merely to be perfect it is to have a process that is tolerant of the level of imperfection that one would expect. For example it is perfectly reasonable that a someone could have foreseen it not clobbering a license file wit…

I am not a MS employee but I do work as a software engineer at a small company and make six figures a year. Mistakes like this happen. In fact they happen all the time. There are a lot of people out there writing code on any given day. Some of them may have been staring at the screen for 12 straights hours trying to make a release date. Sure its a lot more visible when someone like MS makes one, but think about the actual issue here. They did not create a feature with the intent to overwrite existing licenses files, they made a feature to ensure the correct licenses were added to new repos. Now they forgot one edge case (out of how many thousands or millions?), took ownership of the mistake, and are taking actions to correct it. Overall to me that seems like a very small bug that they took/are taking steps to fix on Christmas no less.

>>None of this is an acceptable level of failure from people that drawing a 6 figure salary for a position of expertise or leadership.

If the rest of the world thought like you we would not have any people left in high paying jobs. Everyone is bound to make mistakes. Owning up and setting things right is what is important in my eyes.

edit: missed a couple words

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#574
post #178

The attitude in these threads always boggles my mind. When YOU, your teammates or someone else you know makes a mistake, then it’s just a mistake. But when someone at Microsoft makes a mistake it’s because Microsoft is evil and by extension so is the person who offended. “It’s a big company”, you say. They should have a process! And I’m sad to say, they do/will have a process exactly because of this attitude. Then, e…

A third way: individual people can make an honest mistake and Microsoft is still evil.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#575

Earlier quoted context omitted.

What happened here was obviously a mistake. The thread is full of lurid accusations, because those are fun to write and talk about, but it shouldn't take even a minute's thought to see how dumb a heist this would have been. The thread would have been a lot more fun if we could have spent it talking about what prompted your team to build this thingy, and bounce other people's approaches to the same problem off, and ma…

It doesn't matter how "dumb a heist this would have been". This is Microsoft and their track record with respect to illicit and/or illegitimate behavior needs to be continually scrutinized. They put themselves in this position. They have made plenty of intentionally dishonest "mistakes" over the years. Track records matter and Microsoft doesn't have a clean one. Scrutiny of companies of their size should be the norm.…

"Scrutiny" doesn't mean making up nonsense issues, which is what this is. There's no amount of weasel words you're going to apply that's going to make changing an MIT license in a public git repository part of a terrifying conspiracy --- or a conspiracy of any sort.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#576
post #178

The attitude in these threads always boggles my mind. When YOU, your teammates or someone else you know makes a mistake, then it’s just a mistake. But when someone at Microsoft makes a mistake it’s because Microsoft is evil and by extension so is the person who offended. “It’s a big company”, you say. They should have a process! And I’m sad to say, they do/will have a process exactly because of this attitude. Then, e…

You can't ascribe one attitude to a thread of hundreds of commenters and then shame us for ascribing an attitude to a company.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#577
post #543

Earlier quoted context omitted.

I don’t think accidentally removing credits from a software license is exactly on the level of burning someone’s house down. In general, I wouldn’t say that causing someone harm should be dismissible with an apology, but in a situation where the harm seems pretty limited, easily reversible, and unintentional—and the apology seems genuine and even informative—I don’t see a particular benefit to causing hardship to som…

The harm is depriving the author of their moral rights, and the name recognition from their work. Depending on how popular the library becomes this could deprive the author of substantial business opportunities.

And if this was a deliberate decision that Microsoft refused to undo, I’d be as outraged as everyone else here would be.

But it wasn’t, and they did undo it, and I found their response impressively civilized and professional. So I’m not really understanding why everyone seems to want to hold this guy accountable for all the shitty stuff Microsoft could have done, didn’t do, and apparently did in the past.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#578

Earlier quoted context omitted.

Quoted post unavailable.

An engineer who can write straightforwardly is worth 100 PR people in situations like this. They're not paid like that, but they are worth that.

Fully agreed. And yeah, when it comes to my expectations as far as how large companies respond to embarrassments, the bar is about as low as it gets. A tone-deaf non-apology that sounds like a robot wrote it is what I expect to hear, and I’m almost invariably right.

And that offends me. The idea that someone thinks I’d be convinced by such a response—that I’d find it persuasive and acceptable—is fucking insulting.

So when the guy who’s actually responsible for the mistake—and not some polished corporate drone—actually shows up in the comments section, explains what happened, and talks to me the way one of my colleagues would: yeah, that is above and beyond by most standards, certainly the ones I have for evil empires like FAAN(M)G companies, and I give major credit for that.

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#579

Earlier quoted context omitted.

A lot of commenters are sharpening their pitchforks, but this comment, in my opinion, makes it very likely that it was an honest mistake. Amazing what taking personal responsibility and earnestly apologizing can do to restore trust and credibility!

> makes it very likely that it was an honest mistake. I don’t have any doubt that it was an honest mistake. They also took accountability for the mistake, shared their steps to prevent it from happening again, and they’re in contact with the original repo author directly. At this point, anyone digging for excuses to further demonize Microsoft isn’t interested in honest discussion about this issue. This is a textbook…

Here in "honest mistake" they try to patent somebody's method: https://www.theregister.com/2021/03/13/microsoft_ans_patent/

Re: Microsoft forked MIT licensed repo and changed the copyright [fixed]

#580
post #572

Earlier quoted context omitted.

The world is full of important people performing vital tasks either without fail or wherein failures can be caught by other individuals and processes that serve as guard rails. The solution isn't merely to be perfect it is to have a process that is tolerant of the level of imperfection that one would expect. For example it is perfectly reasonable that a someone could have foreseen it not clobbering a license file wit…

> The world is full of important people performing vital tasks either without fail or wherein failures can be caught by other individuals and processes that serve as guard rails. Sometimes planes literally fall out of the sky. NASA caused a space shuttle to explode killing the entire crew. It is fundamentally untrue that anywhere in the world we have perfect people or processes. > The solution isn't merely to be perf…

> Further disclosure: If someone showed up to a postmortem for my team with this level of condescension and no useful advice, I’d tell them to be quiet or leave.

If I worked with you it would be my responsibility to support my coworker and help them improve. As it is neither of us has much of an obligation to the other we are uninvolved third parties giving our unsolicited opinions to one another. It is a privilege as an uninvolved observer to another to analyze it frankly without worrying about hurting someone's ego. It is OK I think to look at some mess or other and the inevitable conciliatory excuses and or hostile push back against criticism and call bullshit.

> None of those comments that I’ve seen addresses the fact that adding a license file during a fork at all is probably an error. No, just criticism about this one case because someone told them about the exact observed bug so now it’s obvious.

This is an excellent point insofar as explaining why the bug might have happened. I disagree however that it is sufficient explanation. Such code should still check for the presence of an existing license file for another license and raise an error that requires human intervention to override. That is constructive and actionable.

Post reply on HN