Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

171–180 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#171

Post by ericbarrett »

ysavir wrote: post #156
ericbarrett wrote: post #136

Earlier quoted context omitted.

> One thing I am not sure is why such a radical action was taken so quickly without thinking carefully first? It's not like a lawsuit was threatened or something. Once you've been informed of a violation, you have a legal duty to act, no? Regardless of whether counter-action is immediately threatened. (Not a lawyer, not legal advice)

At the end of the day, it's people involved, and people have the capacity for understanding and empathy. A safe course of action would be for the maintainer to respond with a message like "thank you for bringing this to my attention. Many products and services depend on this package and would be disrupted by any immediate action. I will bring this to their attention and work with them to remove the dependency as swif…

I completely agree with you in principle. However, if there are potential damages involved, it's hard to argue that you're not increasing your exposure by delaying or deferring the correction. (Again IANAL and this ain't legal advice.) Lawsuits aren't to be taken on a whim. Even if you ultimately prevail, the affair can change your life, and not for the better. So I can't blame anybody who wants to skip the lawyer and minimize their exposure, even if doing so angers a large number of developers—to whom they have no formal obligation.

Re: Removed gem breaks Rails ActiveStorage

#172

Post by pskinner »

samb1729 wrote: post #158
heax wrote: post #117

Earlier quoted context omitted.

It is not nice, but aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc. It's similar to backups, if you don't have one your data must be worthless.

> aside from hobbyists everyone who seriously develops software caches all dependencies in a own repository like nexus etc. This is a bold claim to make, and one that isn’t supported by my personal observations. Many ‘serious’ software developers have no such intermediate repository for their dependencies.

We did and so this didn't cause us a major issue today.

At my lost job we had the same.

And the one before that.

This mitigation of a risk that affects business continuity is something that all senior level people need to take seriously at any company, small or large.

Re: Removed gem breaks Rails ActiveStorage

#173

Post by rushb »

Can someone please explain how it is possible to license a database of such sort in the first place? Pretty much all file types have some documentation on how to identify them by reading specific bytes, it's not like the folks from freedesktop invented those methods. On top of that, having the DB licensed under GPL would mean that every line of it is also under GPL, thus forcing the same GPL to all libraries out there that do even a simple PNG check using a magical byte check?

I'm really curious to understand how it this licensing works.

Re: Removed gem breaks Rails ActiveStorage

#174

Post by btilly »

onli wrote: post #157
btilly wrote: post #151

Earlier quoted context omitted.

Again, that does not seem to have been the case here. Again? Not sure where you said it. But the copyright holders in question are the authors of shared-mime-info, and they certainly never gave permission for their work to be used by Rails in the way that it was. It depends where you are, which jurisdiction gets applied. Might explain the different expectation. I'm in the USA. But I'm pretty sure that what I said is…

> Again? Not sure where you said it Here, it was in the comment (and not an edit :) ): > It would be further be complicated by the file in question being a database file. You typically can not license databases in a meaningful way under GPL. Even if you could, reading a GPL'd database has no chance of carrying GPL code obligations over to the consuming program. But I actually just wrote again because I made that poin…

Not so fast in that claim.

First of all the infringing file is https://github.com/minad/mimemagic/blob/master/script/freede.... Sure, it is in XML. But it contains a tremendous amount of free-form text, specific sets of pattern matching rules for the data types, and so on. It is a compilation of sometimes original research on the best ways to detect file types. Ruby has other mime libraries. The reason why this one was chosen is that its detection algorithms make better choices. And the reason that they make better choices is that they copied the decision rules from a GPLed project.

But even if it were a simple compilation, it still is not guaranteed that there is no copyright. See https://en.wikipedia.org/wiki/Copyright_in_compilation for an introductory article on what can and can't be copyrighted about a compilation. And one of the elements that matters is creativity in the selection of the material. A set of rules with a lot of "look for this" while leaving out various reasonable thats that don't work so well shows considerable creativity.

That said, a judge may decide otherwise. You never know until a judge decides. But I would not presume that there is no copyright interest to be had here.

Re: Removed gem breaks Rails ActiveStorage

#175

Post by btilly »

smarx007 wrote: post #165
btilly wrote: post #133

Earlier quoted context omitted.

"You can in general never retroactively change a license, so their usage back then was certainly valid." No, it wasn't. It was reasonable, but not valid. They were using copyrighted code without permission from the copyright holder, relying on a false claim. The false claim gave them no right to use the copyrighted code, and will not protect them if the copyright holder sues them. However the fact that they were acti…

I think MIT license only claims the code I wrote is provided under MIT (that's why you also have to include a NOTICES file listing other library licenceses in addition to the LICENSE file). It's not like they put MIT header and their name on that XML file. > then they would have the right to sue the author of the gem whose false claim got them in trouble I think this is where a useless all-caps text comes handy: THE…

You have a point, but it is not as absolute as the license suggests.

The problem is that a license is overridden by local law if there is a conflict. For example suppose that there is a law saying there is an implied warranty that goods sold are yours to sell, and you sold a stolen good "as is". In that case the law wins and the buyer can still sue you for having sold tem stolen goods.

And as https://www.klemchuk.com/legal-insights/warranty-against-inf... explains, a common local law is an implied warranty against infringement on others' intellectual property. Which a copyright violation would qualify as.

As always, I am not a lawyer, and this is not legal advice. If something like this arises in practice, you should consult a lawyer familiar with the laws of the venue that the case will be decided in to find out whether any laws apply, and to what extent the generic liability disclaimer won't actually provide protection.

Re: Removed gem breaks Rails ActiveStorage

#176

Post by lamontcg »

quesera wrote: post #154
lamontcg wrote: post #146

Earlier quoted context omitted.

I'm kind of surprised that nobody is talking more about this right now. Everyone with a Gemfile.lock that does a `bundle install` as part of autoscaling (without having vendored gems or a rubygems mirror which doesn't obey yanks) is now broken, potentially in production.

This is true, and important, but: You should never depend on GitHub or RubyGems for deployments. If your deployment failed today due to this gem yank, it has exposed a bug in your systems that you should fix. EDIT: I should not speak in such absolutes. "Never" is a big word and clearly this does not apply in all cases! Depending on third-parties for deployments is a risk -- but might be tolerable, if a multi-hour out…

I addressed that VERY specifically in my comment:

> (without having vendored gems or a rubygems mirror which doesn't obey yanks)

The problem is that the author of the gem just forced a firedrill down everyone's throats today. Doesn't matter if they wanted to or not.

And in prior incidents admins who have taken the precaution of setting up rubygems mirroring and thought they were being responsible were embarrassed to discover that the gem yank was propagated to their own mirror.

Which is a lack of testing, but again, those deficiencies happen, and this is really forcing a firedrill on everyone, without any notification. And the author who did the yank was likely completely unaware of the blast radius of what that action would entail.

Re: Removed gem breaks Rails ActiveStorage

#177

Post by SilverRed »

dashwav wrote: post #82
sergiotapia wrote: post #68

Earlier quoted context omitted.

So what is a good license for "everybody can use this 100% free of charge but please don't change one line and call it yours"? What about a company like Amazon copying your codebase, throwing millions at it and then leaving you in the dust? MIT seems far too permissible now and I'm looking for a default license for my projects.

I have been a big fan of the Mozilla Public License 2.0 [1]. I find it is the best combination of "if you use this and improve or modify, those changes need to go to the original code" while not restricting overall usage. IMO there really isn't anything you can do to prevent people from making a product out of your work if it is open source, but what you can do is make sure that if someone makes improvements to your…

Isn't that the same as lgpl?

Re: Removed gem breaks Rails ActiveStorage

#178

Post by Jiro »

Wowfunhappy wrote: post #112
spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

I don’t think this situation is inherently different from buying a proprietary library, and discovering that the vendor stole code from the Windows kernel. Or a musician buying a sample, and discovering it was copied from a Disney movie. You’re responsible for the stuff you use. You should audit it as well as you can—but realize that crap always happens.

It's a lot less likely that Windows kernel code or Disney music is going to be included by mistake, so your potential exposure is much less. In the case of the Windows kernel, it's a lot less likely that anyone is even going to have it because even the leaks of Windows code are distributed to orders of magnitude fewer people than GPL code.

Re: Removed gem breaks Rails ActiveStorage

#179

Post by Wowfunhappy »

Jiro wrote: post #178
Wowfunhappy wrote: post #112

Earlier quoted context omitted.

I don’t think this situation is inherently different from buying a proprietary library, and discovering that the vendor stole code from the Windows kernel. Or a musician buying a sample, and discovering it was copied from a Disney movie. You’re responsible for the stuff you use. You should audit it as well as you can—but realize that crap always happens.

It's a lot less likely that Windows kernel code or Disney music is going to be included by mistake, so your potential exposure is much less. In the case of the Windows kernel, it's a lot less likely that anyone is even going to have it because even the leaks of Windows code are distributed to orders of magnitude fewer people than GPL code.

The Windows kernel was a random example and probably nit the best one. I don’t think it’s so crazy to think an employee at a vendor would copy paste some code they wrote for a previous vendor.

Re: Removed gem breaks Rails ActiveStorage

#180

Post by riffraff »

michaelt wrote: post #107
ivanbakel wrote: post #3

It's interesting how many commenters on the various issues around the license change seem to think that software licensing is an inconvenience, rather than a serious legal question.

Well, when viewed from the perspective of legal realism, a lot of software licensing is a joke. I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Arguing about the differences between GPL3 and WTFPL in a hypothetical court case is about as meaningful and productive as arguing about the differences between a chainsaw and a…

> I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court.

that's one of the good reasons to assign copyright to a larger entity (Apache foundation, FSF, or whatever): they'll fight to defend the license when it is violated with means you do not have.

Post reply on HN