Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

131–140 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#131

Post by Dangeranger »

nitrogen wrote: post #121
Dangeranger wrote: post #111

Earlier quoted context omitted.

Yes, this approach can work, unless the system which Rails/mimemagic is deployed to has restricted network settings. Under a restricted network setting, I believe the only solution which will work is to use a different package offering similar behavior, under a non-GPL license, or to re-implement the existing behavior using the freedesktop.org.xml as an input/output specification, rather than a source for derived cod…

Presumably one could download the xml as part of the gem installation process (e.g. using mkmf as if it were a C extension, but there are probably simpler ways), so doing a local install at container build time would store the data with the gems in the Docker image (or local bundle if not using Docker). But a mime database seems an awful lot like an uncopyrightable list of facts.

Downloading and using the XML file as the source for some transformation would produce what is considered a derivative work, which would thereby be covered under the GPL. By accessing the file contents through an "abstract interface" this limitation could be avoided.

As I understand it, because the XML file contains instructions with regard to how and where to read files for the purpose of discovering their MIME type, those instructions are copyrightable. I could be wrong, as I am not a lawyer.

Re: Removed gem breaks Rails ActiveStorage

#132

Post by Xylakant »

imhoguy wrote: post #17
gedy wrote: post #9

Earlier quoted context omitted.

I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

vs this https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/m...

In a twist of irony, the software for which the copyright claim breaking rails was made is hosted on the free edition of gitlab, which is based on rails.

Re: Removed gem breaks Rails ActiveStorage

#133

Post by btilly »

onli wrote: post #61
wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

> If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license. This depends. Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for t…

"You can in general never retroactively change a license, so their usage back then was certainly valid."

No, it wasn't. It was reasonable, but not valid.

They were using copyrighted code without permission from the copyright holder, relying on a false claim. The false claim gave them no right to use the copyrighted code, and will not protect them if the copyright holder sues them. However the fact that they were acting in good faith and had no idea is likely to help them when it comes to damages. And furthermore if they got sued, then they would have the right to sue the author of the gem whose false claim got them in trouble.

If the original author wanted to claim damages under GPL from Rails, he would have to do so via the gem's author. And even then: What damages?

I have no idea why you think that the copyright holder would have to go to the gem's author to sue about a copyright violation. Furthermore damages are not the only thing you can sue for. See https://www.lib.purdue.edu/uco/CopyrightBasics/penalties.htm... for a list. That statutory minimum of $200 per infringement can add up really fast when you're generating copies electronically.

Re: Removed gem breaks Rails ActiveStorage

#134

Post by onli »

tsbinz wrote: post #114
onli wrote: post #61

Earlier quoted context omitted.

> If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license. This depends. Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for t…

> Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then. > You can in general never retroactively change a license, so their usage back then was certainly valid. I would ask a lawyer about that. As it has been explai…

You are right, that's a shaky part and where insecurity is coming from - and sure, get a lawyer if you want more certainty. Depends where you are anyway. Better answers to that are already here. Just one thing:

> the original author didn't have the right to distribute it under the MIT license, so they (rails) never had a valid license.

Thing is, if it's really about a databasefile that was not copyrightable the gem author did have the right to distribute it. That's a happy circumstance of this specific case, making all of this less severe either way.

Re: Removed gem breaks Rails ActiveStorage

#135

Post by teddyh »

spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

> GPL and other "viral" licenses

“When others hurt me, I try to defend myself. But some tell me that this makes them sick. They tell me that I should permit people to rob me of my work. They tell me that I should never try to defend myself.

They tell me that I should stop using the GNU General Public License, a license that vaccinates me against hurt. Instead, I should adopt a license that permits other people to rob me with impunity. They want me to adopt a license that forbids me from fighting back. They want me to give up my right to benefit from a derivative of my own work, a right I possess under current copyright law.

Of course, the language is a little less feverish than this. Usually, I myself am not called “infectious”. Rather, the legal defense that I use is called “infectious”. The license I choose is called “viral”.

In every day language, words such as “infect” and “virus” describe disease. The rhetoric is metaphorical. A legal tool is not a disease organism; but it is popular to think of the law as an illness, so the metaphor has impact.

The people who want to rob me use language that says I make them sick when I stop them from robbing me. They do not want to draw attention to the so-called “disease” that makes them ill: my health and my rights, and the health and rights of other people. Instead, they choose metaphor to twist people's thinking. They do not want anyone to think that I am a good citizen for stopping crime. They want the metaphor to fool others into thinking that I am a disease agent.

The GNU General Public License protects me. The connotation of “virus” and “infect” is that my choice of defense gives an illness to those who want to rob me. I want freedom from their robbery; but they want the power to hurt me. They get sick when they cannot hurt me.

To use another health and illness-related metaphor, the GNU General Public License vaccinates me; it protects me from theft.

Note that the theft about which I am talking is entirely legal in some situations: if you license your work under a modified BSD license, or a similar license, then others may legally take your work, make fixes or improvements to it, and forbid you from using that code. I personally dislike this arrangement, but it exists.”

— Robert J. Chassell, Viral Code and Vaccination, https://www.gnu.org/philosophy/vaccination.html

Re: Removed gem breaks Rails ActiveStorage

#136

Post by ericbarrett »

smarx007 wrote: post #108
wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. The original request in https://github.com/minad/mimemagic/issues/97 that you linked to was very polite and professional. 1) A time extension to remove the GPLed code could be politely requested. I know that the copyright belongs to all contributors but getti…

> One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something.

Once you've been informed of a violation, you have a legal duty to act, no? Regardless of whether counter-action is immediately threatened. (Not a lawyer, not legal advice)

Re: Removed gem breaks Rails ActiveStorage

#137

Post by hartator »

wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

> You don’t magically get your MIT license back by forking before the license change was added, that’s not how it works.

And all RoR apps don't magically became open source because one of the depencies got contaminated by GPL. It's up to the courts to decide not parties who don't haven't standing.

Re: Removed gem breaks Rails ActiveStorage

#138

Post by CaliforniaKarl »

smarx007 wrote: post #108
wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. The original request in https://github.com/minad/mimemagic/issues/97 that you linked to was very polite and professional. 1) A time extension to remove the GPLed code could be politely requested. I know that the copyright belongs to all contributors but getti…

> One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first?

I think this can be answered by considering the following:

> At least that's how we'd (try to) handle it on our project under Eclipse Foundation…

Looking at https://github.com/minad/mimemagic, I did not get the impression that the software was backed by any organization, let alone one on the scale of the Eclipse Foundation. If indeed the software is essentially one person, imagine it from their perspective.

> Anyway, talking to people first before doing something quickly is often a good idea.

Assuming that this was not intentional (see Hanlon's razor), you could quickly have groups like the gpl-violations.org project taking notice, and things snowballing from there. I'm not calling out gpl-violations.org specifically here, instead I'm noting that there are other people who _would_ do something quickly.

Another thing to note is that u/minad is (per their GitHub profile) in Germany. That will also affect their opinion on things related to licensing.

Re: Removed gem breaks Rails ActiveStorage

#139

Post by mey »

sergiotapia wrote: post #68
spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

So what is a good license for "everybody can use this 100% free of charge but please don't change one line and call it yours"? What about a company like Amazon copying your codebase, throwing millions at it and then leaving you in the dust? MIT seems far too permissible now and I'm looking for a default license for my projects.

Different generations of the BSD and Apache licenses have had attribution clauses to various levels of strictness. (Older ones were more strict). Neither are copyleft (Like GPL/CDDL) forcing future improvements to be open sourced. CDDL may be interesting as a way to preventing improvements to a code base from going "dark" but still being non-copyleft compatible. (Hello Sun/Oracle). Another commenter mentioned MDL which CDDL was based on for Sun's needs, that is also worth looking at.
Post reply on HN