Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

81–90 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#81

Post by raesene9 »

5560675260 wrote: post #48
judofyr wrote: post #38

Earlier quoted context omitted.

> but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL. IANAL, but I'm pretty sure this is _not_ how it works. Your code doesn't magically "become" licensed under GPL if you use GPL code. Your code is now in _violation_ of the GPL and one way of fixing it is to re-license your code. Another way i…

> you may still have to pay damages This is probably a first time I've seen damages mentioned in relation to GPL violations. Did anyone try enforce this?

There's a site here https://gpl-violations.org/news/ which has some cases where there have been legal actions related to GPL violations.

Re: Removed gem breaks Rails ActiveStorage

#82

Post by dashwav »

sergiotapia wrote: post #68
spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

So what is a good license for "everybody can use this 100% free of charge but please don't change one line and call it yours"? What about a company like Amazon copying your codebase, throwing millions at it and then leaving you in the dust? MIT seems far too permissible now and I'm looking for a default license for my projects.

I have been a big fan of the Mozilla Public License 2.0 [1]. I find it is the best combination of "if you use this and improve or modify, those changes need to go to the original code" while not restricting overall usage.

IMO there really isn't anything you can do to prevent people from making a product out of your work if it is open source, but what you can do is make sure that if someone makes improvements to your work, those improvements need to be publicly available under the MPL2.0 license as well.

This has the effect that if someone wants to make a product by just 'adding one line' that line needs to be published and you could add it upstream, making it publicly available again(thus making it harder to make a product solely from your code).

[1] https://choosealicense.com/licenses/mpl-2.0/

Re: Removed gem breaks Rails ActiveStorage

#83

Post by k_sze »

derefr wrote: post #37
gedy wrote: post #18

Earlier quoted context omitted.

Since the xml file is not included in the source, and was just a reference for a rb source file's lookup table, it just feels weird that 3 fixes the violation.

I think the pedantic interpretation of the GPL “depends on” clause is that burning a content-hash of a GPLed release of a work into your work, such that your work retrieves and installs the GPLed work-release by its content-hash (or retrieves the work-release by name + version and then verifies it by content hash — as a Bundler Gemfile.lock does), is “depending on” the GPLed release of the upstream work. Due to the e…

Then you add a step for adding the content hash as an environment variable in the installation instructions, and include the actual content hash as an _example_ (wink wink) in the documentation.

Re: Removed gem breaks Rails ActiveStorage

#84

Post by Denvercoder9 »

crazypython wrote: post #58

Reminder that GPLv3 gives you 30 days to "cure the violation," while the GPLv2 Linus Torvalds prefers immediately creates a copyright violation.

Note that GPLv3 still immediately creates a copyright violation. It just states that if you cure the violation within 30 days, the license is reinstated. Under GPLv2 you forfeit your license immediately and in perpetuity if you infringe on it.

Re: Removed gem breaks Rails ActiveStorage

#85

Post by dathinab »

misnome wrote: post #40
joshuaissac wrote: post #24

Earlier quoted context omitted.

GPL licensing of derived works is not automatic. Instead, distributing under incompatible terms is copyright infringement. It may be possible to remedy this infringement by releasing the source code under the GPL, but it also may not (e.g. source code contains un-relicenceable code from a third-party), in which case the only remedy is to not distribute the program at all.

Ah, right, so it doesn't make it automatically GPL2 unless they want to continue to distribute it - and presumably only the original GPL2 licence-holder(s) are in the position to raise the issue of past infringement-via-distribution. And so presumably unless rails was actively distributing bundles with it they'd would not be counted as "distributing" this GPL dependency. It does sound like exactly the sort of hole th…

Somewhat, but the thing is even if they sue, as long as the offender (rails? rails user?) does stop distributing the software until they replaced the code in question the amount of damages you can sue for can be surprisingly little.

If it would be a "essential" component like e.g. Linux it's a bit of a different matter. But as long as it's a non essential easy to replace library the cost of suing might noticable outclass the any money you can get out of it.

This is not a given thing, but at least it's not unlikely as far as I can tell.

IMHO using GPL for anything but full blown Applications, System Components or very large/complex/tricky libraries is kinda pointless.

And for them GPL isn't good enough in the current ecosystem, so you might need to go with AGPL or SSPL. Both which are noticeable less liked then GPL by many.

Re: Removed gem breaks Rails ActiveStorage

#86

Post by Benjamin_Dobell »

crazypython wrote: post #76
Benjamin_Dobell wrote: post #69

Technically everyone using Rails right now may be in violation of the GPL. It doesn't matter that the version of the gem being used claims to be MIT, that's not how licensing/copyright works. Github Enterprise licensees could try hit-up GitHub for source code! EDIT: License in question is GPL, not Affero GPL. So github.com is not covered. However, Github Enterprise is. In all likelihood, Github wouldn't comply, as Gi…

> everyone using Rails right now is in violation of the GPL. Not if your use of Rails is limited to your own/your company's own servers, which I imagine most Rails users are. Please don't fall for the flamebait. If they were using GPLv3, they would have an entire month (30 days) to cure the violation. GitHub Enterprise is in violation as it is distributed to third-parties.

Thanks, edited for clarity. In this case it's GPLv2, so no "cure the violation" clause.

However, even if this were GPLv3, and you were to "cure the violation" that only reinstates your license i.e. the GPLv3 license. Replacing a dependency won't make previously infringing releases any less infringing.

Re: Removed gem breaks Rails ActiveStorage

#89

Post by packrat386 »

CodesInChaos wrote: post #59

How does yanking work for rubygems? In Rust a yanked version can still be downloaded when compiling (you have a lock-file referencing it), but isn't chosen when adding it as a new (transitive) dependency to your application. So yanking shouldn't break any existing applications. (Though since is about a copyright violation, a DMCA notice against the package registry could result in a hard removal, and not just a yanke…

A yanked gem won't be downloaded for a `bundle install` or anything of that sort. Aside from a record that it once existed it's basically gone.

Re: Removed gem breaks Rails ActiveStorage

#90

Post by judofyr »

CodesInChaos wrote: post #59

How does yanking work for rubygems? In Rust a yanked version can still be downloaded when compiling (you have a lock-file referencing it), but isn't chosen when adding it as a new (transitive) dependency to your application. So yanking shouldn't break any existing applications. (Though since is about a copyright violation, a DMCA notice against the package registry could result in a hard removal, and not just a yanke…

https://blog.rubygems.org/2015/04/13/permadelete-on-yank.htm...

Summary: Before 2015 then yanking didn't delete anything, but you could contact support to have it removed. They ended up getting tons of support requests and therefore changed it to be permadelete.

Post reply on HN