Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

61–70 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#61

Post by onli »

wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

> If the previous version contains GPL code, it’s GPL. It doesn’t matter if you slap an MIT license file on it, or used it in “good faith” presuming it was MIT license.

This depends.

Rails used a gem by a different developer, a gem that had its own MIT license. The Rails project and all others using Rails can not be expected that they ought to have known the license is invalid, so usually the GPL does not count for their usage back then.

You can in general never retroactively change a license, so their usage back then was certainly valid. You can [be forced to] stop using a license and re-license future versions of an artefact, and also possibly have to stop distributing the old versions. But that's on the gem's author, not Rails, and would likely not even impact future usage of the old, already obtained versions.

If the original author wanted to claim damages under GPL from Rails, he would have to do so via the gem's author. And even then: What damages? And would the projects have had to know? None and no is the likely answer, safe juridical incompetence/corruption like in the Oracle-API case.

It would be further be complicated by the file in question being a database file. You typically can not license databases in a meaningful way under GPL. Even if you could, reading a GPL'd database has no chance of carrying GPL code obligations over to the consuming program.

As always with those questions, this might depend on your specific jurisdiction. Also, it means in no way that it is not the ethically right thing to swap the dependency to one that does not have this issue.

PS: Also consider that in most uses of Rails, GPL or MIT does not change much, as accessing a server running GPL software does not trigger GPL's distribution clause (you want the AGPL for that). This already limits the impact here. The Github thread has comments in the direction of all Rails projects having to be open source now if the license changed to GPL. Not only can the license of old versions not change, this is also not the effect GPL would have.

Re: Removed gem breaks Rails ActiveStorage

#62

Post by murderfs »

Denvercoder9 wrote: post #22
gedy wrote: post #9

Earlier quoted context omitted.

I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

> this lookup table of extensions to mimetypes doesn't feel like GPL "software". Copyright nor the GPL are limited to software, collections of data are copyrightable as well; and thus they can fall under the GPL as well. > To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list? Yes.

Data in and of itself cannot be copyrighted under U.S. copyright law: "creative arrangement" of it can be, but given that the data in question was generated from XML file, I don't think you could make a claim that the arrangement was copied.

Re: Removed gem breaks Rails ActiveStorage

#63

Post by jahewson »

gedy wrote: post #9
wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

I agree. Lists of facts are not eligible for copyright in the US, most famously phone books. It’s debatable as to whether or not this file is pure facts but I’m having a hard time seeing it as a “creative expression”.

Re: Removed gem breaks Rails ActiveStorage

#64

Post by toast0 »

5560675260 wrote: post #48
judofyr wrote: post #38

Earlier quoted context omitted.

> but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL. IANAL, but I'm pretty sure this is _not_ how it works. Your code doesn't magically "become" licensed under GPL if you use GPL code. Your code is now in _violation_ of the GPL and one way of fixing it is to re-license your code. Another way i…

> you may still have to pay damages This is probably a first time I've seen damages mentioned in relation to GPL violations. Did anyone try enforce this?

It's pretty clear that distributing without a license (or in violation of one) is copyright infringement, and that's subject to damages.

However, most non egrigious copyright infringement cases are more about stopping future infringement than damages. So I'd be surprised to see much GPL enforcement with damages.

Re: Removed gem breaks Rails ActiveStorage

#65

Post by majewsky »

mooreds wrote: post #41
majewsky wrote: post #32

Earlier quoted context omitted.

You're correctly getting downvoted for your thinly-veiled advertisement because it's besides the point. The gem was labeled as "license: MIT" all the time, but that label was just factually wrong. Garbage in, garbage out.

People can of course downvote me for whatever reason they want. I do object to you calling this an advertisement. Sure, it links to my employer's website, but it is an OSS build library that addresses licensing issues. Yes, GIGO applies, but what about the underlying Gem? Was the XML file relicensed? (Haven't dug into that issue 97 referenced in the GH thread.) Edit: from sibling comments, looks like this build syste…

The product in question being open-source or not has nothing to do with whether it's advertising. I would have been okay with it if your product genuinely did something to solve the issue at hand, but as you admit, it does not, so all that's left is "this is a good time to mention my product".

Re: Removed gem breaks Rails ActiveStorage

#66

Post by terramex »

alberth wrote: post #52
wokwokwok wrote: post #7

The reason this is happening is not obvious without reading https://github.com/minad/mimemagic/issues/97 > I've historically been the maintainer of shared-mime-info for around 15 years, and script/freedesktop.org.xml looks like it's a copy of the database shipped with shared-mime-info, which is released under the GPL, with shared-mime-info's translators work merged in, and the GPL header removed. > The license that y…

> "You don’t magically get your MIT license back by forking before the license change" Am I understanding this correctly. If for example, 15 years you have an MIT code base with only MIT code. Then yesterday, you add a few lines of GPL code. Then today, you remove 100% of the GPL code you just previously added in order to revert back your codebase to be only MIT code ... it's no longer "MIT"? The GPL has now tainted…

No, in this hypothetical case you would be fine. Mimemagic case is more like 15 years ago you had a MIT codebase that contained hidden GPL-derived code. One day you are notified about that violation and relicense whole codebase to GPL, but the code that was already in the repository before has never been truly MIT - it was always violating GPL. To fix this you can either relicense whole codebase to GPL (what mimemagic chose) or remove GPL code from codebase, stop distribution of older versions and continue your project as MIT.

Going back to older version of code does not change anything as now everybody is aware of violation so you don't even have plausible deniability. You would need to fork from commit before adding GPL code, but this is impossible for mimemagic as it contained this code since day one.

Re: Removed gem breaks Rails ActiveStorage

#67

Post by CodesInChaos »

theta_d wrote: post #50
CodesInChaos wrote: post #21

1. Is a database like that even copyrightable, especially in the US? > United States: Uncreative collections of facts are outside of Congressional authority under the Copyright Clause (Article I, § 8, cl. 8) of the United States Constitution, therefore no database right exists in the United States. Originality is the sine qua non of copyright in the United States (see Feist Publications v. Rural Telephone Service). h…

> 1. Is a database like that even copyrightable, especially in the US? Yes, collections of data are very much copyrightable, especially in the US. This is not just a list of mime-types. It is a list of mime-types and instructions on how to detect those mime-types.

I would have interpreted simple patterns (e.g. value x at offset y) as non copyrightable facts about the file format.

Complex patterns could be problematic though, since you could argue they are original programs.

Re: Removed gem breaks Rails ActiveStorage

#68

Post by sergiotapia »

spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

So what is a good license for "everybody can use this 100% free of charge but please don't change one line and call it yours"? What about a company like Amazon copying your codebase, throwing millions at it and then leaving you in the dust?

MIT seems far too permissible now and I'm looking for a default license for my projects.

Re: Removed gem breaks Rails ActiveStorage

#69

Post by Benjamin_Dobell »

Technically everyone using Rails right now may be in violation of the GPL. It doesn't matter that the version of the gem being used claims to be MIT, that's not how licensing/copyright works.

Github Enterprise licensees could try hit-up GitHub for source code!

EDIT: License in question is GPL, not Affero GPL. So github.com is not covered. However, Github Enterprise is.

In all likelihood, Github wouldn't comply, as Github Enterprise licensees have no such license/clause in effect with Github. It'd then be down to the shared-mime-info's copyright holders to take the matter to court.

Would be an interesting court case.

Some people in the Github issue commented that the XML "database" in question could be used under fair use. That'd be the logical defense. There's been many court cases where the "copyrighted material" is a representation of facts, as opposed to a "creative work", and thus has not been eligible for copyright protection.

It's probably also worth noting that "ignorance" is rarely an accepted defense in court.

Re: Removed gem breaks Rails ActiveStorage

#70

Post by crazypython »

eek04_ wrote: post #54
crazypython wrote: post #26

Earlier quoted context omitted.

> The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. No, that's not true. You can dual-license dependent software under GPL and MIT. The GPL merely requires a license at least as permissive as it.

You can dual-license if you own the full copyright ownership but if you include GPLed stuff (and don't have the full copyright ownership) you'll have to GPL the result. As for "at least as permissive" - it requires no further restrictions, but it adds a bunch of restrictions itself. And there's no other license that doesn't add restrictions - MIT adds restrictions to reproduce the MIT license, which is an extra restr…

I am fairly sure MIT's license is considered an "appropriate legal notice."
Post reply on HN