Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

151–160 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#151

Post by btilly »

onli wrote: post #141
btilly wrote: post #133

Earlier quoted context omitted.

"You can in general never retroactively change a license, so their usage back then was certainly valid." No, it wasn't. It was reasonable, but not valid. They were using copyrighted code without permission from the copyright holder, relying on a false claim. The false claim gave them no right to use the copyrighted code, and will not protect them if the copyright holder sues them. However the fact that they were acti…

> They were using copyrighted code without permission from the copyright holder, relying on a false claim. Again, that does not seem to have been the case here. > I have no idea why you think that the copyright holder would have to go to the gem's author to sue about a copyright violation. 1. It depends where you are, which jurisdiction gets applied. Might explain the different expectation. 2. It'd be the gem author…

Again, that does not seem to have been the case here.

Again? Not sure where you said it. But the copyright holders in question are the authors of shared-mime-info, and they certainly never gave permission for their work to be used by Rails in the way that it was.

It depends where you are, which jurisdiction gets applied. Might explain the different expectation.

I'm in the USA. But I'm pretty sure that what I said is generically true.

It'd be the gem author that created an unlicensed derivative work, not anyone else directly.

Copyright is triggered by downloading unlicensed copies. And lots of people other than the gem author did that.

An unlicensed derivative was created by anyone who used Rails and wrote code that did mime detection - for example they were handling uploaded files.

It is an open question whether these cases are worth litigating, and what would be decided in court. They might well decide that there isn't enough creative work in the compilation for the file in question to have copyright protection at all. But in the meantime it would be a generally good idea to treat the issue seriously, and to accept that lots of people are potentially liable here. (Even if, in all probability, none will suffer more than a temporary inconvenience as the dependency is removed.)

Re: Removed gem breaks Rails ActiveStorage

#152

Post by johannes1234321 »

JMTQp8lwXL wrote: post #150
johannes1234321 wrote: post #124

Earlier quoted context omitted.

> Seems like an auditing nightmare. Yes and that's why large companies are often extremely reluctant to take in 3rd party code without auditing and estimating the risk.

This has not been my experience. Getting the work done fast is prioritized more highly than the (small) compliance risk. Unless the company wants to pay you to invent a bespoke in-house version of React.

For using open source stuff while working on your machine there are often pre approved licenses. But for production use and even more for software being distributed any serious place I have seen, there is paperwork. (Sometimes of better quality, sometimes more of a rubber stamp process)

Re: Removed gem breaks Rails ActiveStorage

#153

Post by skulbuny »

michaelt wrote: post #129
ivanbakel wrote: post #116

Earlier quoted context omitted.

>I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Why do you use a license with those terms, then? Court cases over license violations are not hypothetical. Perhaps your stance is that licenses are frivolous, but there are plenty of people in software who don't share it. And those people, given "indisputable proof" of a…

No, but situations where it would make sense for me to pursue a court case over a license violation are hypothetical. Look at Oracle vs Google - Multibillion dollar companies, getting advice from the absolute top legal experts, yet they still can't agree on what is and isn't allowed by law. And getting an answer for that has taken over a decade and an eyewatering amount of money. Now imagine I'm a Finnish developer l…

Why not just use a license that explicitly says you won't use legal recourse, like the Unlicense or 0BSD, ie. release it to the public domain?

If you use MIT even you are saying "I will litigate you if you do not comply with my demand that you include this license when you use this software."

Re: Removed gem breaks Rails ActiveStorage

#154

Post by quesera »

lamontcg wrote: post #146
packrat386 wrote: post #89

Earlier quoted context omitted.

A yanked gem won't be downloaded for a `bundle install` or anything of that sort. Aside from a record that it once existed it's basically gone.

I'm kind of surprised that nobody is talking more about this right now. Everyone with a Gemfile.lock that does a `bundle install` as part of autoscaling (without having vendored gems or a rubygems mirror which doesn't obey yanks) is now broken, potentially in production.

This is true, and important, but:

You should never depend on GitHub or RubyGems for deployments.

If your deployment failed today due to this gem yank, it has exposed a bug in your systems that you should fix.

EDIT: I should not speak in such absolutes. "Never" is a big word and clearly this does not apply in all cases! Depending on third-parties for deployments is a risk -- but might be tolerable, if a multi-hour outage would not be devastating.

Re: Removed gem breaks Rails ActiveStorage

#155

Post by xpe »

michaelt wrote: post #107
ivanbakel wrote: post #3

It's interesting how many commenters on the various issues around the license change seem to think that software licensing is an inconvenience, rather than a serious legal question.

Well, when viewed from the perspective of legal realism, a lot of software licensing is a joke. I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Arguing about the differences between GPL3 and WTFPL in a hypothetical court case is about as meaningful and productive as arguing about the differences between a chainsaw and a…

Large organizations often are risk averse with regards to legal matters. They don't want to be sued for misusing a license. The threat of litigation has a real effect, even if one particular individual is unlikely to bring a case.

Re: Removed gem breaks Rails ActiveStorage

#156

Post by ysavir »

ericbarrett wrote: post #136
smarx007 wrote: post #108

Earlier quoted context omitted.

One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. The original request in https://github.com/minad/mimemagic/issues/97 that you linked to was very polite and professional. 1) A time extension to remove the GPLed code could be politely requested. I know that the copyright belongs to all contributors but getti…

> One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. Once you've been informed of a violation, you have a legal duty to act, no? Regardless of whether counter-action is immediately threatened. (Not a lawyer, not legal advice)

At the end of the day, it's people involved, and people have the capacity for understanding and empathy.

A safe course of action would be for the maintainer to respond with a message like "thank you for bringing this to my attention. Many products and services depend on this package and would be disrupted by any immediate action. I will bring this to their attention and work with them to remove the dependency as swiftly as possible and then remove all available versions of this package from where they are hosted."

If someone brings lawyers to the table due to lack of immediate action, maybe then we can proceed to a more immediate, if disruptive, course. But no need to rush there if there's no external pressure to act that fast.

Re: Removed gem breaks Rails ActiveStorage

#157

Post by onli »

btilly wrote: post #151
onli wrote: post #141

Earlier quoted context omitted.

> They were using copyrighted code without permission from the copyright holder, relying on a false claim. Again, that does not seem to have been the case here. > I have no idea why you think that the copyright holder would have to go to the gem's author to sue about a copyright violation. 1. It depends where you are, which jurisdiction gets applied. Might explain the different expectation. 2. It'd be the gem author…

Again, that does not seem to have been the case here. Again? Not sure where you said it. But the copyright holders in question are the authors of shared-mime-info, and they certainly never gave permission for their work to be used by Rails in the way that it was. It depends where you are, which jurisdiction gets applied. Might explain the different expectation. I'm in the USA. But I'm pretty sure that what I said is…

> Again? Not sure where you said it

Here, it was in the comment (and not an edit :) ):

> It would be further be complicated by the file in question being a database file. You typically can not license databases in a meaningful way under GPL. Even if you could, reading a GPL'd database has no chance of carrying GPL code obligations over to the consuming program.

But I actually just wrote again because I made that point in another subthread, no criticism implied.

Re: Removed gem breaks Rails ActiveStorage

#158

Post by samb1729 »

heax wrote: post #117
forgingahead wrote: post #43

Outrageous move to just yank the gem and break builds everywhere.

It is not nice, but aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc. It's similar to backups, if you don't have one your data must be worthless.

> aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc.

This is a bold claim to make, and one that isn’t supported by my personal observations. Many ‘serious’ software developers have no such intermediate repository for their dependencies.

Re: Removed gem breaks Rails ActiveStorage

#159

Post by rst »

byroot wrote: post #80
rubyist5eva wrote: post #12

vendor your dependencies people

Or you know... just cache them. If your CI or deploys broke because of this, it basically means you're constantly re-installing all your dependencies from scratch, which is totally silly. Configure your CI & other tools to cache the bundler directory between builds and not only you'll be protected from this, you'll also make your systems faster.

There can be other wrinkles. Builds of $dayjob's Rails app failed even though we had the gem itself cached locally all over, because entries for the BSD gem versions had vanished from the rubygems.org metadata, and we weren't caching that. There are multiple workarounds, but we may not be done debating them before rails-core decides on a replacement.

Re: Removed gem breaks Rails ActiveStorage

#160

Post by quesera »

heax wrote: post #123
ro_ro wrote: post #95

Earlier quoted context omitted.

What's even more silly is implying that caching your dependencies is some kind of a fix here. So you'll be able to deploy for a few more days, then what?

It allows you to deploy for a few more days. That fixes the "i can not deploy problem" if my customer needs a urgent fix. Sure you will be as much in violation of GPL as without that (even if you don't deploy you will violate the GPL), but that is another problem which needs to be addressed.

> That fixes the "i can not deploy problem" if my customer needs a urgent fix.

Only if the issue is fixed upstream before your cache expires. Obviously, breaking Rails gets things fixed quickly, but what if it was a less-actively-maintained gem?

Post reply on HN