Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

161–170 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#161

Post by xpe »

michaelt wrote: post #107
ivanbakel wrote: post #3

It's interesting how many commenters on the various issues around the license change seem to think that software licensing is an inconvenience, rather than a serious legal question.

Well, when viewed from the perspective of legal realism, a lot of software licensing is a joke. I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Arguing about the differences between GPL3 and WTFPL in a hypothetical court case is about as meaningful and productive as arguing about the differences between a chainsaw and a…

Saying "software licensing is a joke" and "hypothetical zombie apocalypse" may be provocative and/or funny, but it distracts attention from the underlying logic. In my view, when conversations start going down this path, they become less substantive and interesting, because the meaning becomes muddled.

I try to always remember:

* One person writes a comment one time. N people read it. N >> 1. Therefore strive to be clear.

* "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive." https://news.ycombinator.com/newsguidelines.html

Re: Removed gem breaks Rails ActiveStorage

#162

Post by quesera »

_ZeD_ wrote: post #87
rubyist5eva wrote: post #12

vendor your dependencies people

Please, no.

Vendoring gems solves lots of problems: GitHub/RubyGems outages, yanked gems, credentials sharing in CI/CD, and as a bonus, deployments are quicker.

Negative side effects: You need to update your vendor cache periodically, your repo increases in size, and native gems have problems if if you develop on a different platform than you deploy.

Re: Removed gem breaks Rails ActiveStorage

#163

Post by Toutouxc »

quesera wrote: post #154
lamontcg wrote: post #146

Earlier quoted context omitted.

I'm kind of surprised that nobody is talking more about this right now. Everyone with a Gemfile.lock that does a `bundle install` as part of autoscaling (without having vendored gems or a rubygems mirror which doesn't obey yanks) is now broken, potentially in production.

This is true, and important, but: You should never depend on GitHub or RubyGems for deployments. If your deployment failed today due to this gem yank, it has exposed a bug in your systems that you should fix. EDIT: I should not speak in such absolutes. "Never" is a big word and clearly this does not apply in all cases! Depending on third-parties for deployments is a risk -- but might be tolerable, if a multi-hour out…

What's the solution? Having a mirror/archive of some kind of the gems I use?

Re: Removed gem breaks Rails ActiveStorage

#164

Post by freedomben »

JamesSwift wrote: post #92
freedomben wrote: post #13

Earlier quoted context omitted.

After the "left-pad" fiasco, and a similar event on the Ruby side, I started vendoring my dependencies as standard practice. I have not been sorry yet, in fact I feel vindicated in that approach.

Vendoring in ruby land is a double edged sword. It is much safer as you said. However if you _do_ vendor, be sure to be running containerized first. Otherwise you will be in a very frustrating spot of having to handle all sorts of native gem issues when trying to run on various computers during dev/test/prod.

Yes this is a real problem. We primarily use docker which solves the issue, but there are people that hate docker and want to run native. For the mac users that doesn't go too well.

Re: Removed gem breaks Rails ActiveStorage

#165

Post by smarx007 »

btilly wrote: post #133
onli wrote: post #61

Earlier quoted context omitted.

> If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license. This depends. Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for t…

"You can in general never retroactively change a license, so their usage back then was certainly valid." No, it wasn't. It was reasonable, but not valid. They were using copyrighted code without permission from the copyright holder, relying on a false claim. The false claim gave them no right to use the copyrighted code, and will not protect them if the copyright holder sues them. However the fact that they were acti…

I think MIT license only claims the code I wrote is provided under MIT (that's why you also have to include a NOTICES file listing other library licenceses in addition to the LICENSE file). It's not like they put MIT header and their name on that XML file.

> then they would have the right to sue the author of the gem whose false claim got them in trouble

I think this is where a useless all-caps text comes handy:

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND [...] AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Noninfringement is mentioned right there. It literally says that I DO NOT promise you that my code that I license to you under MIT (in good faith, ofc) does not infringe anyone's rights.

Re: Removed gem breaks Rails ActiveStorage

#166

Post by dathinab »

xucheng wrote: post #77
dathinab wrote: post #73

Earlier quoted context omitted.

> rails is now considered as GPL no > mean that GitHub Enterprise is now GPL? even less so --- Rails was in a license violating situation, which doesn't make it GPL at all. Then the outcome of a legal case trying to sue someone who is knowingly using rails which unknowingly pulls in a GPL licensed dependency might be less clean cut as you might think. Lastly depending on the version of GPL and other factors like non-…

The reason I mentioned GitHub Enterprise instead of GitHub website is because the former one is not a service. It is a software distributed to the end user. Based on your comments, it seems that the existing releases of the GitHub Enterprise are in GPL violation states due to the transitive dependency.

I guess, yes.

But then an interesting question is how transitive copyright violations apply (because this is what a GPL violation legally is, you use the license to use it, nothing more and nothing less).

The reason I'm wondering about this is because the situation here is similar to a producer of e.g. cars buying a lets say seat to be put into the car and inside the seat they seat producer used some e.g. screws which violate copyright.

Would it be possible that the car manufacturer is hold responsible for the copyright violation enacted by the seat producer? Unlikely I guess?

Would it still have some consequences? Surely, but likely negligible:

Violating GPL doesn't make any code become GPL (a common misconception) and copyright infringement laws are often based on monetary damage done by the infringement. And lets be honest how much damage is done in case the product is not sold, only given away for free and has competition which is also given away for free with even less constraints?

Re: Removed gem breaks Rails ActiveStorage

#167

Post by Deradon »

Xylakant wrote: post #132
imhoguy wrote: post #17

Earlier quoted context omitted.

vs this https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/m...

In a twist of irony, the software for which the copyright claim breaking rails was made is hosted on the free edition of gitlab, which is based on rails.

And according to the twitter-bio of the individual, who brought this up, he's related to Red Hat, which are also affected [^1].

[^1]https://github.com/RedHatInsights/compliance-backend/pull/79...

Re: Removed gem breaks Rails ActiveStorage

#168

Post by quesera »

Toutouxc wrote: post #163
quesera wrote: post #154

Earlier quoted context omitted.

This is true, and important, but: You should never depend on GitHub or RubyGems for deployments. If your deployment failed today due to this gem yank, it has exposed a bug in your systems that you should fix. EDIT: I should not speak in such absolutes. "Never" is a big word and clearly this does not apply in all cases! Depending on third-parties for deployments is a risk -- but might be tolerable, if a multi-hour out…

What's the solution? Having a mirror/archive of some kind of the gems I use?

Something along those lines, yes. Mirror/archive/caching obviously requires setup and maintenance.

Vendoring gems works well if you (and coworkers) develop and deploy on the same platform.

A minimal approach might be to keep local copies/clones of all gems. If things blow up, you can always build and vendor any missing dependencies, and then redeploy. You'd need to keep a local environment available that matches your deployment env, for building native gems.

GitHub and RubyGems are very reliable, although of course not 100%. It's more common (but still rare!) that an individial gem owner will do something odd, or remove an artifact. Often, you can wait the issue out, or spend a few hours constructing a workaround.

But sometimes you cannot wait. And sometimes you don't get the chance to decide -- your deployed and running code will suddenly fail because an application in AWS or GCE needs to scale up with new instances, or your existing instances auto-update, or otherwise replace themselves.

If that would be a serious problem, it makes sense to invest time into reducing third-party deployment dependencies.

Re: Removed gem breaks Rails ActiveStorage

#169

Post by garblegarble »

protomyth wrote: post #147
devrand wrote: post #144

Earlier quoted context omitted.

The gem is basically a database of mime type, file extension, and magic bytes. The last two are not included in the linked iana database.

Where did freedesktop.org get the magic bytes? I assume (probably stupidly) that some of that has to be in a file command on some BSD.

Here's what the magic bytes look like in FreeBSD, as an example I've linked to the definition of PNG. You can see it's a fair bit more complicated but it does have mime and extension data.

https://github.com/freebsd/freebsd-src/blob/master/contrib/f...

Re: Removed gem breaks Rails ActiveStorage

#170

Post by theptip »

tylermenezes wrote: post #148
theptip wrote: post #127

Earlier quoted context omitted.

See the Olson Timezone database[1] as another example of "simple patterns" that are very much copyrightable. The act of curating a collection of what may be "simple facts" creates a copyrightable work. A farmer's almanac of seasons and weather patterns is copyrightable, even though the bare facts that it tabulates are not. [1]:( https://en.wikipedia.org/wiki/Tz_database#2011_lawsuit )

> Olson Timezone database That lawsuit was dismissed, in fact the article you linked says as much.

I stand corrected -- I was working from memory and didn't spot that development. Thanks!

I'll have to do a bit more digging to see if my original point still holds, even though the example I used to illustrate it doesn't.

E.g. see https://www.dmlp.org/legal-guide/works-not-covered-copyright -

> there may be situations in which a compilation of facts may be protected if the creator of the original publication selected, coordinated, or arranged the facts in an original way. For example, a sports almanac may arrange baseball scores in a creative way, a genealogy chart may arrange birth dates in an original way, or a cookbook may arrange ingredients in a creative and original way as part of its recipes. In each of those instances, the creator of the work would have a copyright in the creative arrangement of the facts, but not the facts themselves.

Though https://www.copyright.gov/circs/circ33.pdf says about recipes,

> the Office cannot register recipes consisting of a set of ingredients and a process for preparing a dish. In contrast, a recipe that creatively explains or depicts how or why to perform a particular activity may be copyrightable. A registration for a recipe may cover the written description or explanation of a process that appears in the work, as well as any photographs or illustrations that are owned by the applicant

So I'm not clear where the boundary actually is on this one.

Post reply on HN