Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

181–189 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#181

Post by JamesSwift »

freedomben wrote: post #164
JamesSwift wrote: post #92

Earlier quoted context omitted.

Vendoring in ruby land is a double edged sword. It is much safer as you said. However if you _do_ vendor, be sure to be running containerized first. Otherwise you will be in a very frustrating spot of having to handle all sorts of native gem issues when trying to run on various computers during dev/test/prod.

Yes this is a real problem. We primarily use docker which solves the issue, but there are people that hate docker and want to run native. For the mac users that doesn't go too well.

Ive lost countless work days to figuring out gem build issues on mac when everyone else on the team was running on linux/vagrant.

Re: Removed gem breaks Rails ActiveStorage

#182

Post by Jiro »

Wowfunhappy wrote: post #179
Jiro wrote: post #178

Earlier quoted context omitted.

It's a lot less likely that Windows kernel code or Disney music is going to be included by mistake, so your potential exposure is much less. In the case of the Windows kernel, it's a lot less likely that anyone is even going to have it because even the leaks of Windows code are distributed to orders of magnitude fewer people than GPL code.

The Windows kernel was a random example and probably nit the best one. I don’t think it’s so crazy to think an employee at a vendor would copy paste some code they wrote for a previous vendor.

My point generalizes, though.

As a rule, proprietary code isn't distributed widely, so there are few opportunities to include it, and as a rule, the harsher restrictions on distributing it make people less likely to not notice that they're not supposed to distribute it. It's much more likely that incompatibly licensed GPL code would be widely distributed and that it would be included by mistake.

Sure, you described a scenario where this can happen to proprietary code. It's not impossible, just less likely.

Re: Removed gem breaks Rails ActiveStorage

#183

Post by Wowfunhappy »

Jiro wrote: post #182
Wowfunhappy wrote: post #179

Earlier quoted context omitted.

The Windows kernel was a random example and probably nit the best one. I don’t think it’s so crazy to think an employee at a vendor would copy paste some code they wrote for a previous vendor.

My point generalizes, though. As a rule, proprietary code isn't distributed widely, so there are few opportunities to include it, and as a rule, the harsher restrictions on distributing it make people less likely to not notice that they're not supposed to distribute it. It's much more likely that incompatibly licensed GPL code would be widely distributed and that it would be included by mistake. Sure, you described a…

That’s fair. I guess I just don’t see this is a failing of the GPL. If I want to share some code so others can read it (for education/interest/research/whatever) I should be able to do so—while reserving all rights to reuse the code if I so choose.

Re: Removed gem breaks Rails ActiveStorage

#184

Post by rocqua »

wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

This is what I personally dislike about GPL it is a viral license, without any 'cure'. Especially the more aggressive licenses feel like a ransom. Either accept gpl, or spend the rest of time trying to quarantine gpl from your projects.

This is a huge unilateral attempt to make FOSS a certain way. And I don't think this kind of unilateral action does anything but set bad blood.

Re: Removed gem breaks Rails ActiveStorage

#185

Post by rocqua »

qotgalaxy wrote: post #109
misnome wrote: post #23

Earlier quoted context omitted.

> makes some people really wary of the GPL and other "viral" licenses It's worse than that surely - as in this case avoiding GPL doesn't prevent the problem. This sounds like for a medium-paranoid-legal perspective, that it would "prove" that even non-GPL code isn't safe, thus discouraging from usage of any open source software [edit: dependencies] > One can only imagine if it was AGPL instead of GPL Right, that seem…

Why would closed source software be safe? Say I copy shared-mime-info completely, compile it, sell it to you as MimeWizardPRO2000, you include it as part of your closed source web framework and sell that. You're still distributing GPL code without making your source available.

I think it's different if you are re-using source (with GPL notices) or binaries (which don't have them)

Re: Removed gem breaks Rails ActiveStorage

#186

Post by rocqua »

theptip wrote: post #170
tylermenezes wrote: post #148

Earlier quoted context omitted.

> Olson Timezone database That lawsuit was dismissed, in fact the article you linked says as much.

I stand corrected -- I was working from memory and didn't spot that development. Thanks! I'll have to do a bit more digging to see if my original point still holds, even though the example I used to illustrate it doesn't. E.g. see https://www.dmlp.org/legal-guide/works-not-covered-copyright - > there may be situations in which a compilation of facts may be protected if the creator of the original publication selected…

Is that bit about recipes why so many recipes online come with a story?

Re: Removed gem breaks Rails ActiveStorage

#187

Post by hakre »

Trasmatta wrote: post #29
mooreds wrote: post #20

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it…

That's a good idea generally, but it wouldn't have saved you from this issue. The gem had an MIT license, and the offending file was copied in, not sourced through a dependency.

Depends on the process. If assigning a license means that there is a review of the dependency before use, this is normally seen.

Re: Removed gem breaks Rails ActiveStorage

#188

Post by pjmlp »

toomanybeersies wrote: post #71

It's like left-pad all over again. I wonder how much software will be unbuildable in 10 years time, due to dependencies that can no longer be downloaded. Is there an archive.org for packages?

Always vendor software instead of relying on public repositories.

Re: Removed gem breaks Rails ActiveStorage

#189

Post by iso1631 »

michaelt wrote: post #107
ivanbakel wrote: post #3

It's interesting how many commenters on the various issues around the license change seem to think that software licensing is an inconvenience, rather than a serious legal question.

Well, when viewed from the perspective of legal realism, a lot of software licensing is a joke. I'm an open source developer - but even if Oracle had violated my license terms and I had indisputable proof of it, I wouldn't take them to court. Arguing about the differences between GPL3 and WTFPL in a hypothetical court case is about as meaningful and productive as arguing about the differences between a chainsaw and a…

So you're saying the legal system is stacked in favor of the large, so we shouldn't bother with laws at all?

If you broke Oracle's license terms they'll be suing you.

Post reply on HN