Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

141–150 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#141

Post by onli »

btilly wrote: post #133
onli wrote: post #61

Earlier quoted context omitted.

> If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license. This depends. Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for t…

"You can in general never retroactively change a license, so their usage back then was certainly valid." No, it wasn't. It was reasonable, but not valid. They were using copyrighted code without permission from the copyright holder, relying on a false claim. The false claim gave them no right to use the copyrighted code, and will not protect them if the copyright holder sues them. However the fact that they were acti…

> They were using copyrighted code without permission from the copyright holder, relying on a false claim.

Again, that does not seem to have been the case here.

> I have no idea why you think that the copyright holder would have to go to the gem's author to sue about a copyright violation.

1. It depends where you are, which jurisdiction gets applied. Might explain the different expectation. 2. It'd be the gem author that created an unlicensed derivative work, not anyone else directly. Have fun claiming damages, copyright infringement or anything for indirect usage in such a good faith situation. I really think that wouldn't fly, but again, might depend where you are.

Re: Removed gem breaks Rails ActiveStorage

#142

Post by hu3 »

toomanybeersies wrote: post #71

It's like left-pad all over again. I wonder how much software will be unbuildable in 10 years time, due to dependencies that can no longer be downloaded. Is there an archive.org for packages?

This is why I commit vendor directories.

I don't mind if CI ignores it but it's nice to have a fallback that ensures the project is buildable at all times.

Re: Removed gem breaks Rails ActiveStorage

#143

Post by CodesInChaos »

CodesInChaos wrote: post #67
theta_d wrote: post #50

Earlier quoted context omitted.

> 1. Is a database like that even copyrightable, especially in the US? Yes, collections of data are very much copyrightable, especially in the US. This is not just a list of mime-types. It is a list of mime-types and instructions on how to detect those mime-types.

I would have interpreted simple patterns (e.g. value x at offset y) as non copyrightable facts about the file format. Complex patterns could be problematic though, since you could argue they are original programs.

I took a closer look at this database and library.

The actual patterns are very simple and standardized:

* The base-case is checking if a certain byte-string can be found within a given offset range * patterns form a tree where at all patterns from the root to one leaf need to match, which amounts to a restricted form of expressing "AND" and "OR" expressions

So it looks like there is very little space for originality in expressing these patterns.

* It doesn't appear to be a curated database, but rather aims for completeness (i.e. the selection or arrangement shouldn't be covered by copyright) * Mime types and extensions are also very simple facts which can't be expressed in an original way * The human friendly format allows a bit more freedom, but is still quite limited

IANAL, but I'd guess this database is not copyrightable in the US, but protected in the EU since it recognizes database rights.

https://en.wikipedia.org/wiki/Database_right

Re: Removed gem breaks Rails ActiveStorage

#144

Post by devrand »

protomyth wrote: post #140

So, this gem uses the mime database provided by freedesktop.org when the gem could have got the database from http://www.iana.org/assignments/media-types/media-types.xhtm... which wouldn't be GPL? What manipulation is done by freedesktop.org?

The gem is basically a database of mime type, file extension, and magic bytes. The last two are not included in the linked iana database.

Re: Removed gem breaks Rails ActiveStorage

#145

Post by cwyers »

ericbarrett wrote: post #136
smarx007 wrote: post #108

Earlier quoted context omitted.

One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. The original request in https://github.com/minad/mimemagic/issues/97 that you linked to was very polite and professional. 1) A time extension to remove the GPLed code could be politely requested. I know that the copyright belongs to all contributors but getti…

> One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. Once you've been informed of a violation, you have a legal duty to act, no? Regardless of whether counter-action is immediately threatened. (Not a lawyer, not legal advice)

The question is, what act do you take? It's possible to negotiate and get a grace period to get into compliance, for instance.

Re: Removed gem breaks Rails ActiveStorage

#146

Post by lamontcg »

packrat386 wrote: post #89
CodesInChaos wrote: post #59

How does yanking work for rubygems? In Rust a yanked version can still be downloaded when compiling (you have a lock-file referencing it), but isn't chosen when adding it as a new (transitive) dependency to your application. So yanking shouldn't break any existing applications. (Though since is about a copyright violation, a DMCA notice against the package registry could result in a hard removal, and not just a yanke…

A yanked gem won't be downloaded for a `bundle install` or anything of that sort. Aside from a record that it once existed it's basically gone.

I'm kind of surprised that nobody is talking more about this right now.

Everyone with a Gemfile.lock that does a `bundle install` as part of autoscaling (without having vendored gems or a rubygems mirror which doesn't obey yanks) is now broken, potentially in production.

Re: Removed gem breaks Rails ActiveStorage

#147

Post by protomyth »

devrand wrote: post #144
protomyth wrote: post #140

So, this gem uses the mime database provided by freedesktop.org when the gem could have got the database from http://www.iana.org/assignments/media-types/media-types.xhtm... which wouldn't be GPL? What manipulation is done by freedesktop.org?

The gem is basically a database of mime type, file extension, and magic bytes. The last two are not included in the linked iana database.

Where did freedesktop.org get the magic bytes? I assume (probably stupidly) that some of that has to be in a file command on some BSD.

Re: Removed gem breaks Rails ActiveStorage

#148

Post by tylermenezes »

theptip wrote: post #127
CodesInChaos wrote: post #67

Earlier quoted context omitted.

I would have interpreted simple patterns (e.g. value x at offset y) as non copyrightable facts about the file format. Complex patterns could be problematic though, since you could argue they are original programs.

See the Olson Timezone database[1] as another example of "simple patterns" that are very much copyrightable. The act of curating a collection of what may be "simple facts" creates a copyrightable work. A farmer's almanac of seasons and weather patterns is copyrightable, even though the bare facts that it tabulates are not. [1]:( https://en.wikipedia.org/wiki/Tz_database#2011_lawsuit )

> Olson Timezone database

That lawsuit was dismissed, in fact the article you linked says as much.

Re: Removed gem breaks Rails ActiveStorage

#149

Post by derefr »

k_sze wrote: post #83
derefr wrote: post #37

Earlier quoted context omitted.

I think the pedantic interpretation of the GPL “depends on” clause is that burning a content-hash of a GPLed release of a work into your work, such that your work retrieves and installs the GPLed work-release by its content-hash (or retrieves the work-release by name + version and then verifies it by content hash — as a Bundler Gemfile.lock does), is “depending on” the GPLed release of the upstream work. Due to the e…

Then you add a step for adding the content hash as an environment variable in the installation instructions, and include the actual content hash as an _example_ ( wink wink ) in the documentation.

I don't think Bundler/Bundler-like project lockfiles work that way; lockfiles generally need to be static artifacts checked into source control, so that their transitive dependencies can be resolved and the whole tree of dependencies can be inter-constrained. Swapping the dep out for a different one would require you to re-lock everything.

And, even taking one step back and not having a lockfile, and instead using the dependency version-constraints spec file (the Gemfile) — constraint specs are still generally not really dynamic formats. "Runtime", for them, is compile-time; and usually you can't execute code in them, because the runtime needs to load and resolve them before any of your library's code gets to run. If your app depends on the Rails gem, Rails doesn't get any opportunity during dependency-resolution to run code that decides what its transitive dependencies will be.

(One exception to this general rule in package ecosystems, is Python, due to the existence of setup.py files. This exception is why `pipenv install` in a large Python project takes upwards of 15 minutes: nothing can be parallelized — or ever truly locked down to a specific version — because each dependency gets to run arbitrary, not-guaranteed-deterministic code during installation to decide what its own transitive dependencies will be.)

You could probably create some sort of shim library that dynamically downloads your actual library at runtime — first rewriting its transitive deps, and then loading it as a dep through low-level use of the runtime packaging machinery... but at that point it's a lot easier to just actually load the database itself by dynamic reference.

Re: Removed gem breaks Rails ActiveStorage

#150

Post by JMTQp8lwXL »

johannes1234321 wrote: post #124
JMTQp8lwXL wrote: post #118

Earlier quoted context omitted.

How is one supposed to reasonably know, when downloading a package from a public repository, that the included license is authoritative? Are we supposed to research every package we use, and scour all software in existence to maybe trace back true ownership to someplace else? Seems like an auditing nightmare.

> Seems like an auditing nightmare. Yes and that's why large companies are often extremely reluctant to take in 3rd party code without auditing and estimating the risk.

This has not been my experience. Getting the work done fast is prioritized more highly than the (small) compliance risk. Unless the company wants to pay you to invent a bespoke in-house version of React.
Post reply on HN