Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removed gem breaks Rails ActiveStorage

github.com

Post reply on HN
Print view View original

91–100 of 189 posts

Re: Removed gem breaks Rails ActiveStorage

#91

Post by CodesInChaos »

ericb wrote: post #51
boleary-gl wrote: post #35

Earlier quoted context omitted.

Anytime you publish something, it is copyrighted. The data within may not be, but my presentation of it in a certain database certainly is.

When is my work protected? Your work is under copyright protection the moment it is created and fixed in a tangible form that it is perceptible either directly or with the aid of a machine or device. Source: https://www.copyright.gov/help/faq/faq-general.html

The relevant question is "What does copyright protect?"

> Copyright, a form of intellectual property law, protects original works of authorship including literary, dramatic, musical, and artistic works, such as poetry, novels, movies, songs, computer software, and architecture. Copyright does not protect facts, ideas, systems, or methods of operation, although it may protect the way these things are expressed. See Circular 1, Copyright Basics, section "What Works Are Protected."

You need to argue that such a database is an original work, and not merely an uncreative collections of facts. I would at least consider simple patterns uncreative facts, but complex patterns might be considered copyrightable original works.

Re: Removed gem breaks Rails ActiveStorage

#92

Post by JamesSwift »

freedomben wrote: post #13
TomOwens wrote: post #10

This just bit me. The first thing that I noticed was that some people are not understanding the GPL. It's far more impactful to Rails than the vast majority of web applications built using Rails. The use of GPL'd files means that the gem itself has to be released under the GPL. Since the gem is now under the GPL, dependencies are also under the GPL. That would include Rails. However, even if Rails was under the GPL,…

After the "left-pad" fiasco, and a similar event on the Ruby side, I started vendoring my dependencies as standard practice. I have not been sorry yet, in fact I feel vindicated in that approach.

Vendoring in ruby land is a double edged sword. It is much safer as you said. However if you _do_ vendor, be sure to be running containerized first. Otherwise you will be in a very frustrating spot of having to handle all sorts of native gem issues when trying to run on various computers during dev/test/prod.

Re: Removed gem breaks Rails ActiveStorage

#93

Post by Benjamin_Dobell »

judofyr wrote: post #38
spijdar wrote: post #14

This is the sort of thing that makes some people really wary of the GPL and other "viral" licenses, and I don't think you can blame them. The "blame" for this falls on someone for throwing in GPL'd code into an MIT project, but the headache drops onto a whole bunch more people down the line. It seems other commenters think this will probably be alright, but I bet this is a lot of corporate type's worst nightmare, tha…

> but I bet this is a lot of corporate type's worst nightmare, that some underling added some segment of GPL code to their product, and now the entire thing is "technically" GPL. IANAL, but I'm pretty sure this is _not_ how it works. Your code doesn't magically "become" licensed under GPL if you use GPL code. Your code is now in _violation_ of the GPL and one way of fixing it is to re-license your code. Another way i…

> Another way is to eliminate the dependency

That'll resolve the violation for future releases. However, all previous releases are still infringing.

For a violating company who really doesn't want to open source their project, their best bet would probably be to (remove the dependency and) pay damages for previous infringement.

You'd hope damages in a case like this would be small given it went unnoticed for so long. Considering the shared-mime-info project itself is not commercial software, there probably wasn't significant damage to the project or the authors.

Re: Removed gem breaks Rails ActiveStorage

#94

Post by cstrahan »

This was handled quite poorly -- a different course of action could have avoided all the chaos while also resolving the GPL violation.

As the GPL FAQ states:

> If a programming language interpreter has a license that is incompatible with the GPL, can I run GPL-covered programs on it? (#InterpreterIncompat)

> When the interpreter just interprets a language, the answer is yes. The interpreted program, to the interpreter, is just data; the GPL doesn't restrict what tools you process the program with.

In mimemagic's case, similar logic could apply:

* mimemagic could redistribute the GPL licensed freedesktop.org.xml file. This redistributed file would retain the original GPL license and its terms.

* mimemagic could then read the freedesktop.org.xml file at run time and generate whatever data structures it needs. mimemagic would continue to be MIT licensed without violating the GPL license.

The problem is that mimemagic includes Ruby code generated from the GPL licensed XML file, and it could be argued that this makes part of mimemagic a derivative of a GPL licensed work. They just needed to stop doing that.

Of course I can't point this out to the repository owner now that the repo has been archived and thus commenting is now disabled.

Re: Removed gem breaks Rails ActiveStorage

#95

Post by ro_ro »

byroot wrote: post #80
rubyist5eva wrote: post #12

vendor your dependencies people

Or you know... just cache them. If your CI or deploys broke because of this, it basically means you're constantly re-installing all your dependencies from scratch, which is totally silly. Configure your CI & other tools to cache the bundler directory between builds and not only you'll be protected from this, you'll also make your systems faster.

What's even more silly is implying that caching your dependencies is some kind of a fix here. So you'll be able to deploy for a few more days, then what?

Re: Removed gem breaks Rails ActiveStorage

#96

Post by [deleted] »

misnome wrote: post #40
joshuaissac wrote: post #24

Earlier quoted context omitted.

GPL licensing of derived works is not automatic. Instead, distributing under incompatible terms is copyright infringement. It may be possible to remedy this infringement by releasing the source code under the GPL, but it also may not (e.g. source code contains un-relicenceable code from a third-party), in which case the only remedy is to not distribute the program at all.

Ah, right, so it doesn't make it automatically GPL2 unless they want to continue to distribute it - and presumably only the original GPL2 licence-holder(s) are in the position to raise the issue of past infringement-via-distribution. And so presumably unless rails was actively distributing bundles with it they'd would not be counted as "distributing" this GPL dependency. It does sound like exactly the sort of hole th…

[deleted]

Re: Removed gem breaks Rails ActiveStorage

#97

Post by jahewson »

boleary-gl wrote: post #35
CodesInChaos wrote: post #21

1. Is a database like that even copyrightable, especially in the US? > United States: Uncreative collections of facts are outside of Congressional authority under the Copyright Clause (Article I, § 8, cl. 8) of the United States Constitution, therefore no database right exists in the United States. Originality is the sine qua non of copyright in the United States (see Feist Publications v. Rural Telephone Service). h…

Anytime you publish something, it is copyrighted. The data within may not be, but my presentation of it in a certain database certainly is.

Both of your claims are incorrect, at least in the US. A work must pass a certain level of creative expression to be eligible for copyright and collections of plain facts, e.g a phone book are famously not copyrightable.

Re: Removed gem breaks Rails ActiveStorage

#98

Post by byroot »

ro_ro wrote: post #95
byroot wrote: post #80

Earlier quoted context omitted.

Or you know... just cache them. If your CI or deploys broke because of this, it basically means you're constantly re-installing all your dependencies from scratch, which is totally silly. Configure your CI & other tools to cache the bundler directory between builds and not only you'll be protected from this, you'll also make your systems faster.

What's even more silly is implying that caching your dependencies is some kind of a fix here. So you'll be able to deploy for a few more days, then what?

Then the 0.3.6 version was released, and we could update because the license isn't much of a problem in this case.

Alternatively we could have continuee to deploy for a few more days until Rails core shipped a new version of Active Storage without that dependency.

It's effectively the same as vendoring, except we're not blowing up our repositories with 10 years of dependencies.

Re: Removed gem breaks Rails ActiveStorage

#99

Post by whimsicalism »

murderfs wrote: post #62
Denvercoder9 wrote: post #22

Earlier quoted context omitted.

> this lookup table of extensions to mimetypes doesn't feel like GPL "software". Copyright nor the GPL are limited to software, collections of data are copyrightable as well; and thus they can fall under the GPL as well. > To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list? Yes.

Data in and of itself cannot be copyrighted under U.S. copyright law: "creative arrangement" of it can be, but given that the data in question was generated from XML file, I don't think you could make a claim that the arrangement was copied.

? I don't follow - it seems pretty clear that this falls under the GPL from my reading of what is copyrightable, ie. they can't copy your compilation of the data.

Re: Removed gem breaks Rails ActiveStorage

#100

Post by vertis »

Denvercoder9 wrote: post #22
gedy wrote: post #9

Earlier quoted context omitted.

I guess this is subjective (though maybe not legally), but this lookup table of extensions to mimetypes doesn't feel like GPL "software". It's just a description of other software's conventions using the GPLed source as a reference: https://github.com/minad/mimemagic/blob/master/lib/mimemagic... To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list?

> this lookup table of extensions to mimetypes doesn't feel like GPL "software". Copyright nor the GPL are limited to software, collections of data are copyrightable as well; and thus they can fall under the GPL as well. > To create a non-GPL version, you would have to do what? Research extensions without letting your eyes see this GPLed list? Yes.

There are definitely jurisdictions where this has been found not to be the case. In Australia the protection of databases is incredibly murky[1].

Telstra, the privatized government telecom company, failed to protect the White Pages data from another company that, if I remember correctly, had put it on CD (ah those were the days).

[1]: https://www.mondaq.com/australia/copyright/290668/can-a-data...

Post reply on HN