Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

111–120 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#111

Post by Dangeranger »

thedanbob wrote: post #102
cstrahan wrote: post #94

This was handled quite poorly -- a different course of action could have avoided all the chaos while also resolving the GPL violation. As the GPL FAQ states: > If a programming language interpreter has a license that is incompatible with the GPL, can I run GPL-covered programs on it? (#InterpreterIncompat) > When the interpreter just interprets a language, the answer is yes. The interpreted program, to the interprete…

That approach is roughly being taken in this fork: https://github.com/jellybob/mimemagic/issues/1 With the difference that the gem will by default download the XML file at runtime, with the option of using a local copy specified by an environment variable. I guess they are operating under the belief that including any GPL file taints the library, or perhaps they're just playing it safe.

Yes, this approach can work, unless the system which Rails/mimemagic is deployed to has restricted network settings. Under a restricted network setting, I believe the only solution which will work is to use a different package offering similar behavior, under a non-GPL license, or to re-implement the existing behavior using the freedesktop.org.xml as an input/output specification, rather than a source for derived code.

Re: Removed gem breaks Rails ActiveStorage

#112

Post by Wowfunhappy »

spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

I don’t think this situation is inherently different from buying a proprietary library, and discovering that the vendor stole code from the Windows kernel. Or a musician buying a sample, and discovering it was copied from a Disney movie.

You’re responsible for the stuff you use. You should audit it as well as you can—but realize that crap always happens.

Re: Removed gem breaks Rails ActiveStorage

#113

Post by Dangeranger »

crazypython wrote: post #19

Note that using a GPL dependency on servers is always allowed: "except executing it on a computer or modifying a private copy." Most Ruby on Rails projects are executed only on own servers. Smells like flamebait.

There are projects that redistribute the source code, such as Gitlab, and for those projects this is a significant problem.

Re: Removed gem breaks Rails ActiveStorage

#114

Post by tsbinz »

onli wrote: post #61
wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

> If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license. This depends. Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for t…

> Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then.

> You can in general never retroactively change a license, so their usage back then was certainly valid.

I would ask a lawyer about that. As it has been explained to me, the original author didn't have the right to distribute it under the MIT license, so they (rails) never had a valid license. It's similar with images, even when you grab it off flickr or another page and it specifies a license you like, that does not mean that whoever posted it there actually had the right to do that, and if they didn't, you can get sued.

Re: Removed gem breaks Rails ActiveStorage

#115

Post by protomyth »

sergiotapia wrote: post #68
spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

So what is a good license for "everybody can use this 100% free of charge but please don't change one line and call it yours"? What about a company like Amazon copying your codebase, throwing millions at it and then leaving you in the dust? MIT seems far too permissible now and I'm looking for a default license for my projects.

What about a company like Amazon copying your codebase, throwing millions at it and then leaving you in the dust?

Well, they can do that with the GPL thus spawned the AGPL which didn't fix the problem either thus MongoDB and companies licenses.

"everybody can use this 100% free of charge but please don't change one line and call it yours"

Well, the BSD licenses require redistribution and use in source and binary forms are permitted provided that the above copyright notice and this paragraph are duplicated in all such forms

I know some GPL advocates tend to feel they can remove the copyright statement, but BSD code is BSD code and requires your copyright statement to be preserved.

Re: Removed gem breaks Rails ActiveStorage

#116

Post by ivanbakel »

michaelt wrote: post #107
ivanbakel wrote: post #3

It's interesting how many commenters on the various issues around the license change seem to think that software licensing is an inconvenience, rather than a serious legal question.

Well, when viewed from the perspective of legal realism, a lot of software licensing is a joke. I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Arguing about the differences between GPL3 and WTFPL in a hypothetical court case is about as meaningful and productive as arguing about the differences between a chainsaw and a…

>I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court.

Why do you use a license with those terms, then?

Court cases over license violations are not hypothetical. Perhaps your stance is that licenses are frivolous, but there are plenty of people in software who don't share it. And those people, given "indisputable proof" of a significant license violation, would happily take you to court (with FSF support) to force compliance, if necessary.

Re: Removed gem breaks Rails ActiveStorage

#117

Post by heax »

forgingahead wrote: post #43

Outrageous move to just yank the gem and break builds everywhere.

It is not nice, but aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc.

It's similar to backups, if you don't have one your data must be worthless.

Re: Removed gem breaks Rails ActiveStorage

#118

Post by JMTQp8lwXL »

tsbinz wrote: post #114
onli wrote: post #61

Earlier quoted context omitted.

> If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license. This depends. Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for t…

> Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then. > You can in general never retroactively change a license, so their usage back then was certainly valid. I would ask a lawyer about that. As it has been explai…

How is one supposed to reasonably know, when downloading a package from a public repository, that the included license is authoritative? Are we supposed to research every package we use, and scour all software in existence to maybe trace back true ownership to someplace else? Seems like an auditing nightmare.

Re: Removed gem breaks Rails ActiveStorage

#119

Post by jakelazaroff »

wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

IANAL but I don't think it works like that. Using GPL code in non-GPL project doesn't mean your code is automatically licensed under the GPL, it just means you're violating the license of the original code. How that shakes out — whether you have to re-license your project or just remove the offending code — ultimately depends on the two parties and the court system.

Re: Removed gem breaks Rails ActiveStorage

#120

Post by sosodev »

toomanybeersies wrote: post #71

It's like left-pad all over again. I wonder how much software will be unbuildable in 10 years time, due to dependencies that can no longer be downloaded. Is there an archive.org for packages?

I really do wonder about the long term sustainability of package systems. The oldest business software, think COBOL, still works because it can still run the way it did when it was created. Will I be able to say the same about my software in 50+ years?
Post reply on HN