Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

121–130 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#121

Post by nitrogen »

Dangeranger wrote: post #111
thedanbob wrote: post #102

Earlier quoted context omitted.

That approach is roughly being taken in this fork: https://github.com/jellybob/mimemagic/issues/1 With the difference that the gem will by default download the XML file at runtime, with the option of using a local copy specified by an environment variable. I guess they are operating under the belief that including any GPL file taints the library, or perhaps they're just playing it safe.

Yes, this approach can work, unless the system which Rails/mimemagic is deployed to has restricted network settings. Under a restricted network setting, I believe the only solution which will work is to use a different package offering similar behavior, under a non-GPL license, or to re-implement the existing behavior using the freedesktop.org.xml as an input/output specification, rather than a source for derived cod…

Presumably one could download the xml as part of the gem installation process (e.g. using mkmf as if it were a C extension, but there are probably simpler ways), so doing a local install at container build time would store the data with the gems in the Docker image (or local bundle if not using Docker).

But a mime database seems an awful lot like an uncopyrightable list of facts.

Re: Removed gem breaks Rails ActiveStorage

#122

Post by lamontcg »

JMTQp8lwXL wrote: post #118
tsbinz wrote: post #114

Earlier quoted context omitted.

> Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then. > You can in general never retroactively change a license, so their usage back then was certainly valid. I would ask a lawyer about that. As it has been explai…

How is one supposed to reasonably know, when downloading a package from a public repository, that the included license is authoritative? Are we supposed to research every package we use, and scour all software in existence to maybe trace back true ownership to someplace else? Seems like an auditing nightmare.

You can't. If you're notified then you need to promptly fix the issue with the complainant. When it comes to being sued for damages you can point at the the fact that there was no reasonable way for you to know that the license you trusted was invalid and at the author who was presumably negligent. If you've cooperated fully and mitigated it quickly that should protect you. Ignorance in this case is an excuse when it is reasonable and defensible ignorance, and not negligence on your part.

Re: Removed gem breaks Rails ActiveStorage

#123

Post by heax »

ro_ro wrote: post #95
byroot wrote: post #80

Earlier quoted context omitted.

Or you know... just cache them. If your CI or deploys broke because of this, it basically means you're constantly re-installing all your dependencies from scratch, which is totally silly. Configure your CI & other tools to cache the bundler directory between builds and not only you'll be protected from this, you'll also make your systems faster.

What's even more silly is implying that caching your dependencies is some kind of a fix here. So you'll be able to deploy for a few more days, then what?

It allows you to deploy for a few more days. That fixes the "i can not deploy problem" if my customer needs a urgent fix.

Sure you will be as much in violation of GPL as without that (even if you don't deploy you will violate the GPL), but that is another problem which needs to be addressed.

Re: Removed gem breaks Rails ActiveStorage

#124

Post by johannes1234321 »

JMTQp8lwXL wrote: post #118
tsbinz wrote: post #114

Earlier quoted context omitted.

> Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then. > You can in general never retroactively change a license, so their usage back then was certainly valid. I would ask a lawyer about that. As it has been explai…

How is one supposed to reasonably know, when downloading a package from a public repository, that the included license is authoritative? Are we supposed to research every package we use, and scour all software in existence to maybe trace back true ownership to someplace else? Seems like an auditing nightmare.

> Seems like an auditing nightmare.

Yes and that's why large companies are often extremely reluctant to take in 3rd party code without auditing and estimating the risk.

Re: Removed gem breaks Rails ActiveStorage

#125

Post by bobbylarrybobby »

spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

> the GPL and other "viral" licenses

I really hope someone writes an article with the title "what color is your license?"

Re: Removed gem breaks Rails ActiveStorage

#127

Post by theptip »

CodesInChaos wrote: post #67
theta_d wrote: post #50

Earlier quoted context omitted.

> 1. Is a database like that even copyrightable, especially in the US? Yes, collections of data are very much copyrightable, especially in the US. This is not just a list of mime-types. It is a list of mime-types and instructions on how to detect those mime-types.

I would have interpreted simple patterns (e.g. value x at offset y) as non copyrightable facts about the file format. Complex patterns could be problematic though, since you could argue they are original programs.

See the Olson Timezone database[1] as another example of "simple patterns" that are very much copyrightable.

The act of curating a collection of what may be "simple facts" creates a copyrightable work.

A farmer's almanac of seasons and weather patterns is copyrightable, even though the bare facts that it tabulates are not.

[1]:(https://en.wikipedia.org/wiki/Tz_database#2011_lawsuit)

Re: Removed gem breaks Rails ActiveStorage

#128

Post by yebyen »

johannes1234321 wrote: post #124
JMTQp8lwXL wrote: post #118

Earlier quoted context omitted.

How is one supposed to reasonably know, when downloading a package from a public repository, that the included license is authoritative? Are we supposed to research every package we use, and scour all software in existence to maybe trace back true ownership to someplace else? Seems like an auditing nightmare.

> Seems like an auditing nightmare. Yes and that's why large companies are often extremely reluctant to take in 3rd party code without auditing and estimating the risk.

In fact they even sell insurance for this, and companies that want you to use their software can offer indemnity protection with the same effect.

"What if somebody sues me because my use of your software constitutes a violation of their intellectual property rights?" – "Don't worry, we will protect you. Since you pay so much money and are a valued customer of XYZcorp, we don't want you to worry about such things. You'll be covered by our umbrella policy."

This conversation certainly happens, (although it almost certainly wouldn't have happened between any of "Rails" customers and the Rails core team.)

Re: Removed gem breaks Rails ActiveStorage

#129

Post by michaelt »

ivanbakel wrote: post #116
michaelt wrote: post #107

Earlier quoted context omitted.

Well, when viewed from the perspective of legal realism, a lot of software licensing is a joke. I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Arguing about the differences between GPL3 and WTFPL in a hypothetical court case is about as meaningful and productive as arguing about the differences between a chainsaw and a…

>I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Why do you use a license with those terms, then? Court cases over license violations are not hypothetical. Perhaps your stance is that licenses are frivolous, but there are plenty of people in software who don't share it. And those people, given "indisputable proof" of a…

No, but situations where it would make sense for me to pursue a court case over a license violation are hypothetical.

Look at Oracle vs Google - Multibillion dollar companies, getting advice from the absolute top legal experts, yet they still can't agree on what is and isn't allowed by law. And getting an answer for that has taken over a decade and an eyewatering amount of money.

Now imagine I'm a Finnish developer living in South Korea who released code under an American-written license, and a Russian company infringed on it.

It's inconceivable that I'd choose to take huge personal risk and expense, sacrificing years of my free time, pursuing litigation over something I was trying to give away for free anyway.

That's not to say people can't do this stuff if they enjoy it - by all means, collect some katanas if that's your idea of fun!

Re: Removed gem breaks Rails ActiveStorage

#130

Post by commandlinefan »

toomanybeersies wrote: post #71

It's like left-pad all over again. I wonder how much software will be unbuildable in 10 years time, due to dependencies that can no longer be downloaded. Is there an archive.org for packages?

At least this dependency makes sense: mime type parsing is nontrivial and something you'd logically want to leverage a library for. I can't comprehend how somebody could ever have said "I need left padding. I wonder if there's a library for that somewhere?"
Post reply on HN