Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

41–50 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#41

Post by mooreds »

majewsky wrote: post #32
mooreds wrote: post #20

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it…

You're correctly getting downvoted for your thinly-veiled advertisement because it's besides the point. The gem was labeled as "license: MIT" all the time, but that label was just factually wrong. Garbage in, garbage out.

People can of course downvote me for whatever reason they want. I do object to you calling this an advertisement. Sure, it links to my employer's website, but it is an OSS build library that addresses licensing issues.

Yes, GIGO applies, but what about the underlying Gem? Was the XML file relicensed? (Haven't dug into that issue 97 referenced in the GH thread.)

Edit: from sibling comments, looks like this build system wouldn't have caught the underlying issue, which was a GPL licensed, unmarked file copied in.

Re: Removed gem breaks Rails ActiveStorage

#42

Post by mooreds »

sc00ty wrote: post #27
mooreds wrote: post #20

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it…

How do you handle transitive dependencies?

When you are importing a jar file (this is a java build tool) you have to specify the provenance of every dependency, and any dependency of those dependencies.

It's a real pain, but the pain is all upfront.

Re: Removed gem breaks Rails ActiveStorage

#44

Post by mooreds »

Denvercoder9 wrote: post #28
mooreds wrote: post #20

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it…

> You can't import any dependency (no matter how buried) without assigning a license to it. That wouldn't help here. Mimemagic declared itself to be MIT, and only turned out to be GPL because it embedded a file derived from GPL sources. That file didn't even have a license header specifying it as GPL. Anyone importing it would mark it as MIT. EDIT: Mimemagic didn't even turn out to be GPL, it turned out to be infring…

Fair point. I guess software couldn't have helped this issue.

Re: Removed gem breaks Rails ActiveStorage

#45

Post by Denvercoder9 »

crazypython wrote: post #26
TomOwens wrote: post #10

This just bit me. The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL,…

> The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. No, that's not true. You can dual-license dependent software under GPL and MIT. The GPL merely requires a license at least as permissive as it.

> The GPL merely requires a license at least as permissive as it.

No, it requires a license that's at least as permissive as it AND that imposes the same obligations (i.e. source distribution, etc.) on the licensee.

Dual-licensing dependent software under the GPL and MIT only ensures that you can rip out the GPL dependency, and then use the (formerly) dependent software under MIT. The whole package is still GPL and imposes the same obligations on derivatives of the package.

Re: Removed gem breaks Rails ActiveStorage

#46

Post by mooreds »

Trasmatta wrote: post #29
mooreds wrote: post #20

I give my boss a hard time about our dependency management system because it is relatively unknown[0], but licensing is built into it from the ground up. You can't import any dependency (no matter how buried) without assigning a license to it. This lets us confidently know, via software, the open and closed source licenses in our code base. Licensing is one of those out of band concerns that doesn't burn you until it…

That's a good idea generally, but it wouldn't have saved you from this issue. The gem had an MIT license, and the offending file was copied in, not sourced through a dependency.

Gotcha, fair point. I should have read deeper; I only read the Rails issue, but should have dove into the mimemagic one. My bad.

Re: Removed gem breaks Rails ActiveStorage

#47

Post by crazypython »

Denvercoder9 wrote: post #45
crazypython wrote: post #26

Earlier quoted context omitted.

> The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. No, that's not true. You can dual-license dependent software under GPL and MIT. The GPL merely requires a license at least as permissive as it.

> The GPL merely requires a license at least as permissive as it. No, it requires a license that's at least as permissive as it AND that imposes the same obligations (i.e. source distribution, etc.) on the licensee. Dual-licensing dependent software under the GPL and MIT only ensures that you can rip out the GPL dependency, and then use the (formerly) dependent software under MIT. The whole package is still GPL and i…

Yes, that's what I'm saying.

Re: Removed gem breaks Rails ActiveStorage

#48

Post by 5560675260 »

judofyr wrote: post #38
spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

> but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL. IANAL, but I'm pretty sure this is _not_ how it works. Your code doesn't magically "become" licensed under GPL if you use GPL code. Your code is now in _violation_ of the GPL and one way of fixing it is to re-license your code. Another way i…

> you may still have to pay damages

This is probably a first time I've seen damages mentioned in relation to GPL violations. Did anyone try enforce this?

Re: Removed gem breaks Rails ActiveStorage

#50

Post by theta_d »

CodesInChaos wrote: post #21

1. Is a database like that even copyrightable, especially in the US? > United States: Uncreative collections of facts are outside of Congressional authority under the Copyright Clause (Article I, § 8, cl. 8) of the United States Constitution, therefore no database right exists in the United States. Originality is the sine qua non of copyright in the United States (see Feist Publications v. Rural Telephone Service). h…

> 1. Is a database like that even copyrightable, especially in the US?

Yes, collections of data are very much copyrightable, especially in the US.

This is not just a list of mime-types. It is a list of mime-types and instructions on how to detect those mime-types.

Post reply on HN