Slashdot Mirror
How to Deal With Stolen Code?
greenrom writes "I work for a small company as a software developer. While investigating a bug in one of our products, I found source code on a website that was nearly identical to code used in our product. Even the comments were the same. It's obvious that a developer at our company found some useful code on the web and copied it. The original author didn't attach any particular license to the code. It's just 200 lines of code the author posted in a forum. Is it legitimate to use source code that's publicly available but doesn't fall under any particular license? If not, what's the best way to deal with this kind of situation? Since I'm now the only person working on this code, there's no practical way to report the situation confidentially. I'm new to the company, and the developer who copied the code is the project lead. Reporting him to management doesn't seem like a good career move. I could rewrite the copied code without reporting him, but since the product is very close to release it would be difficult to make a significant change without providing some justification."
> Is it legitimate to use source code that's publicly available but doesn't fall under any particular license?
Of course it is. This kind of thing happens all the time.
Frankly, I'm glad you don't work for us. The fact that you would consider "rewriting" code that works well just because it was written by someone external to your company doesn't speak well for your sense of business priorities or usage of time.
> The original author didn't attach any particular license to the code.
I think that says it all.
n/t.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
When I was in grad school for programming my instructor taught us how to search for the code we needed on the web.
Moreover in my professional career as a programmer I ran into several stumbling blocks where I couldn't figure something out. I'd google for code, or use helper sites like Tek-Tips where people could either correct my code or provide me new code.
I'm paid for results, not for originality. If people provide code on the web as tutorial purposes or just as a friendly piece of help then I would be going against my job to not use it.
Moreover, I ask: If you bought a book on, say, ASP and it had sample code that did exactly what you wanted, would you then rewrite that code so it was not what was in the book? Of course you wouldn't!
If the author doesn't attach any license and it's "just" some code from a forum posting I don't see a problem with it. I have several times posted code samples in forums to help people, I would not mind that they where used in someones commercial program, if I minded I would have attached some for of license. If its posted on a forum to help somebody, the poster must know that it will be used.
Visit http://www.crunzh.com/ for free software. Mac/Lin/Win
Generally whenever I post code on an open forum in response to an answer, I assume the code will be used by other people and so I generally treat my own code as if I just put it into the public domain unless I've explicitly said otherwise.
However, that's not the law. I believe that the code an author publishes on an open forum is copyrighted by the author by default.
Me; I'd probably drop the guy a brief informal note asking permission to reuse the code and see what he does. More often than not if he's like me he'll probably say "sure, I don't mind."
How do you actually know that this happened? From what you posted it seems just as likely that the author of the code worked for your company and saw some question in a web forum, took some code that was the companies' property (developed on their time and their equipment) and posted it to the web forum to answer someone's question. Do you have any way to be sure that that isn't your own companies' code out there?
Don't sweat it. When I post code in a forum, I generally do so with the hope that other folks will find it useful, and the expectation that, if they do find it useful, they'll go ahead and copy it. If I want to make something available with a license and everything, I'll either put it on Sourceforge, or post a license in the comments. It's a safe bet the original author feels the same way.
Legally, it's not necessarily safe to copy long snippets from forums, but from practical and social points of view, I think this is much ado about nothing.
If there is no copyright claim by the original author then I don't see what the problem is. AFAIK that means it's in the public domain (I'd check the website's disclaimer or terms of use though)
You'd better take a refresher course in copyright law. The lack of a copyright notice means little; your creations are implicitly copyrighted.
I may agree with you elsewhere, but you are flat out wrong on that point.
I do this all the time. My feeling is that code snippets posted in a public forum are meant to be be used by others unless it says not to. Yes, I recognize that this is at least theoretically contrary to US copyright laws. But if you don't want someone to use it, why post it? To show your brilliant code?
Since this specific case apparently bothers you, I think you should try to contact the author through some back-channel and get an explicit okay to use it. But I bet more than likely your request will be ignored or you'll get a "why the fsck are you asking such a dumb thing?" That's generally how I reply when someone asks me about code I've posted.
Usually if it's a complicated section of code I'll include the URL in a comment above. If it's just a line or two I won't. Often times if it's from a forum I stay with that forum for a few weeks and try to contribute back in some way.
If the code explicitly has a license attached to it I follow that of course. But I've not had to do that yet. I don't pull code from other project bases unless it's a library or such (in which case I follow the license). Only code that is meant to be viewed and used (such as forums/tutorials).
I like the idea of commenting the code and moving on.
Note, though, that posting code on a forum with no copyright notice does not put it in the public domain. IIRC, the lack of copyright notice means that the first move of the copyright owner can not be to sue you, they must first notify you of the violation and give you a chance to fix it. In other words, the law takes into consideration that without a copyright notice you might accidentally copy something you shouldn't and allows for the violator to fix the problem once notified.
So the worst case is that the copyright owner makes your company change the code at some point in the future. If you put the recommended comment in, your company will know (i) its not your fault and (ii) you were heads-up enough to look into the issue a little further when you noticed it.
Technically it is a copywrite violation but so is most anything now adays.
If the person posted code on a forum then normally they do so expecting people to use it. Hense Posting it on a forum. Most forums go like this.
First Post
How do I do this?
There is a reply
Try this code.
They usually replay with two options
Sorry it didn't work or It worked thanks.
You are probably just out of college were even looking at someone elses code is considered a great moral sin against humanity, where just the though of this could bar you away from higher education forcing you to live your life without being able to obtain a higher degree. In business if it works they use it even if it is a copy and paist. If it was something more problematic like say Using the source from an other companies code who had a strong license on it... Or using GPL code for non GPL reasons then there would be some consern. But for posting giving help to some one who wants to know how to do something it is basicly a non-issue.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Gee, it's a dilemma: You could (1) talk to the guy about it, or (2) wave it over the global press under a pseudonym pretending that no one will guess who you are.
Let me think about this for a minute...
-I like my women like I like my tea: green-
Just for me personally, if I put some code I wrote out in a forum, I expect someone to use it other than myself. Someone asks a question, I throw out a chunk of code, we're done. I don't care where it ends up. Likewise if I find an example that someone has put on the web when I was searching for something to do that exact thing, I'll grab it and adapt it to my use on the principle that that's what it's there for.
Forums can be kind of a greyer area. I once had a guy who was maintaining a system I wrote put a decent chunk of my code in a forum; source code, mind you, not just a script. It was a whole program, and while I never sold that particular piece to do anything by itself, it was a part of a product I did make a decent bit of money on, and a pretty clear-cut breach of my IP for some joker to just post it (they'd signed a contract dealing with redistribution, so it was in writing).
I called them, they apologized, disciplined the guy, and hired me to do the change he'd been trying to do (he'd posted the code trying to get someone to tell him what it did), and paid me at a higher rate. I let it slide because it wasn't a big deal (non-critical code), and they dealt with it to my satisfaction.
If, at some later date, I'd found that code verbatim in someone else's system, I might have mentioned it to them, as an aside, but I wouldn't have tried to claim damages or make them remove it. At that point it is WAY too difficult to trace provenance, and hard to prove any sort of knowing violation. It had been released, I'd taken it up from the people who released it, it was done.
In short: If someone releases code with no license attached and you use it and it turns out later it was licensed you're going to have to deal with the consequences of that. If it turns out it wasn't licensed (or was BSD licensed) you're in the clear, even if it was a case like mine where the code was released by a party that wasn't authorized to release it.
The internet is a nice tool to keep from re-inventing the wheel, but if you take anything more than a little subroutine, you better know what rights you have with regards to it because it can seriously bite you in the ass.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Not specific to this situation, but there almost certainly has to be a practical limit to how much code you need before something is under copyright. For example, the single line
(+ 1 1)
could not be reasonably subject to copyright (IMHO, IANAL, etc.) IIRC there is some rule about originality that this would not satisfy. OK, what about:
;Code to print out "hello world"
(defun hello-world () (format t "hello world"))
Exceedingly simple, entirely trivial, and arguably not creative or original, but more gray than the first example.
What about:
;Code to add two numbers and multiply by a third number
(defun calc-with-three-numbers (a b c) (* (+ a b) c))
Still trivial, but you get the idea - at what point do we cross the line into copyrightable material?
Also, let's assume (for the sake of argument) the last example above is copyrightable. If someone else independently working on the same problem does:
;(x+y)*z
(defun f1 (x y z) (* (+ x y) z))
Would that constitute a copyright violation of the above formula? They do precisely the same thing using exactly the same algorithm, but look very different. Is the second in violation of copyright of the first?
In practice, some problems have an "optimal" solution that most skilled programmers will eventually converge on (if they are good at their jobs). To my mind this might end with comments being (sometimes) copyrightable and code being defined as a mathematical algorithm, which (IMHO) is much closer to the true situation. But I don't know what the legal definitions are for this issue - anybody know if Groklaw has dug up any related material?
"I object to doing things that computers can do." -- Olin Shivers, lispers.org
I'm new to the company, and the developer who copied the code is the project lead.
You married? Got any kids? A mortgage?
If the answer to any of the above is yes, then shut the hell up about it and get on with your day.
If the answer to all of the above is no and you're in the mood for an ethics experiment - mention it to someone. Have your resume ready first. You're about to learn what the business world is really like.
Weaselmancer
rediculous.
I guess it all depends on what the code does - if it's a collection of utility functions (like string manipulation) which anyone could write during a coffee break, then I guess you can forget about it and move on with your life.
If, on the other hand, the code is a complex algorithm which took months of research to develop AND is the main feature of your app - then I guess you should spend some time and try to figure out the license thing.
I guess one should be 'politically correct' up to a certain point - when the subject can, in theory, harm others. Beyond that it doesn't make sense and one should focus on more important aspects of reality, rather then examine everything under the microscope, even though there's very little to see there.
Normally, it's best to err on the side of caution write original code. In this case the code was 200 lines long. Now, I know length shouldn't be an issue, but how many different ways can/will you write your for-loops or AJAX code. The OP mentioned that the code was 200 lines long, which isn't very much. Even if the OP's group were to rewrite the code, it might not look very different from the original code (not counting stupid things like variable or function name changes). It's at these gray areas, that I, personally, tend to not care as much. Now, if it were an entire library of code, that would be different.
Don't worry about the fact that the forum post was 4 months before you guys even started work on your project. In your haste to protect your companies IP you didn't realize you were the ones doing the copying.
/.)
/. you don't feel compelled to become a whistleblower and sacrifice your career, but if you report up the chain a couple of levels and they do nothing you have to decide if it's worth doing just that. You have to pick your battles and live with the consequences of what decisions you make.
Then you take a hit for looking incompetent. No one in their right mind wants to trust mission critical stuff to a guy that's proven they're sloppy. Playing "stupid" as you put it makes you look stupid. Plus it's gutless. Think about this: Who wants to promote someone that's gutless and stupid? No. With this kind of thing you either decide to front up with what you've found (and be discrete about it) or discuss it with no one (much less post on
Also if you approach the company don't jump to any conclusions. Just present the facts. For all you know someone at your company asked permission from the author (and though unlikely since there was no attribution, you shouldn't presume the coder's guilt). If you're using a code repository correctly it shouldn't be hard to track down the developer that wrote the code and enquire about it. Make sure you report the problem to the correct person if your company has formal reporting guidelines, but do so informally if possible at first. How things proceed from there is up to your company as laid out by their policies.
I'm guessing that if you're asking on
If the code's easy to replace (and most 200 line snippets posted on a forum are), there shouldn't be an issue getting someone to write the replacement without seeing the original, the work to do so is not a huge liability to the company. However if your company has publicly released the code in one of their products it could be a much bigger issue because it potentially exposes the company to liability.
These posts express my own personal views, not those of my employer
God I'm glad I don't work with you. Here is a novel idea. Why not discuss it with the guy who your trying to screw? Voice your concerns and maybe, just maybe, he will contact the original author and get permission. He might even be the original author. That way you don't have to worry the guy finds out who stabbed him and come to your house and get revenge. At least be man enough to let your boss know what kind of person you really are.
Hopefully you're working for a decent guy, and you can just say "Hey, dude, I was researching this bug, and in the process, found this code on this forum. You think we should be worried about copyright issues?"
He may, like several slashdotters in this thread, be completely unaware of the fact that code is automatically copyrighted in the US.
He may have been aware, but just lazy, and say "Yeah, we should do something about that".
He may say "Who cares? No one will ever find out!". In that case, *then* you may consider going over his head and raising the issue with his superiors.
If he's a decent guy at all, he'll appreciate your coming to him politely with your concerns. But even if he's the type of vindictive halfwit likely to take offense at your discovery, he'd probably be hard pressed to come up with an excuse for taking action against you. And really, if you're working for someone like that, you should strongly consider looking for a new position elsewhere.
......Unless you are fortunate enough to get a fast "sure, go ahead and use it" you will miss your deadline..........
Unless you are fortunate enough to figure out who REALLY wrote that code in the first place...... You might have 10,000th copy of it and no idea whom to ask for permission.
All theory is gray
So let's be honest, this is a pretty common occurrence. Often times when people post code online in a forum, it's expected by the author that people will lift the code... in fact, that's why it's being posted to the forum! I understand that without an explicit license or authorization from the original author that this is not legal... good, fine, whatever - not trying to debate the legalities of it.
What bothers me here is that the original poster seems to be implying some act of malice on the part of his co-worker. Now, I don't know the full details of the situation, maybe there are valid reasons why he would feel that way. But he didn't even hint at that in his question to Slashdot but does mention his inclination to report him to managment. Really?? I mean... REALLY??? Could this not be an honest mistake stemming from a misunderstanding of the law? Perhaps the co-worker had private exchanges with the code author regarding using the code. Should portraying your co-worker as a criminal to management really even be considered as your first course of action?
I'll let others give their suggestions on how to deal with the situation, but the way the co-worker was portrayed here just rubbed me wrong. I've seen this same thing plenty of times, and it's never been anything but an innocent mistake... both on the part of the person copying and the person posting the code, because in my personal experiences the poster's intent was to make the code freely available but lacking knowledge of copyright law prevented them from expressly stating so in the forum. I'm guessing there's a good chance it can be resolved fairly easily without pissing anyone off or getting anyone fired.
Then I'm glad I don't work for you
So am I. Almost every line of your post is an assumption based on -- well, nothing.
as is mentioned upthread, published works are owned by their authors by copyright in the USA
And where does it say for sure that 1) this company is in the US or that the forum is based in the US? And, again, as I pointed out, how does the OP know that even if it's not in the comments, that permission wasn't obtained elsewhere, in email, for example?
I'd prefer an ethical behavior on the part of all of my employees; some do better jobs than others-- but ethics comes first. Our code is clean, was clean, will be clean, and adheres to the licensing and copyright strictures.
I never said I didn't but you seem to assume so. I set the ethics for my company. There are MANY times when two or more people can have differing views on what is right. I built my company from the ground up, from when I couldn't even afford to buy the tech books I needed without asking relatives and friends for a loan. It's my business which means when views conflict, my ethics prevail. It's my decision that counts.
Dry-ripping/cutting&pasting code from any old website is beyond stupid, it's lax, possibly criminal, and well, you haven't vetted the code against standards and practices-- what if it blows up or creates a nice nugget of crap in otherwise vetted code.
Interesting assumption -- that you haven't vetted it against standards and practices. Depending on the language, a couple hundred lines of code by a third party can be just as easily debugged as if one wrote it himself. That the code comes from outside does not make it better or worse than if it was written by someone inside the company. Yet you assume it is bad and hasn't been debugged or vetted.
And what if this new programmer, the OP, writes replacement code that "blows up or creates a nice nugget of crap?"
I disagree with your practices.
An interesting judgement you make considering, from that first post of mine, the only practice I stated was that I'd rather have someone who works than looks for moral crusades. I've had potential programmers, for example, that felt I was immoral because the program we give our clients to run on their computers to connect to ours is closed source. I'm not going to hire someone who is going to make it a point of continually butting heads with me, thinking that his ethics should or have to rule over mine.
If you re-read my post, I didn't tell the guy what to do. I didn't tell him to shut up, I didn't tell him to go to management. I just brought up one point that was quite relevant. I didn't say what to do or not do.
They put output over ethics, suggest unscrupulous use of code, violate standards practices, and create possible conflicts with other code.
Again, quite an assumption. I am quite strict in how certain situations should be handled and could have "made it" much faster if I didn't make a point of working within ethical boundaries. I have competitors that I could have wiped out if I wanted to, but I haven't due to ethics. You make quite a strong judgement and make some strong statements about me with very little information.
And, again, all the issues you say are possible with someone else's code are just as possible with code written in house.
Thank you, though, for providing a good example of what I'm talking about: Someone who is so eager to find a chance to stand up for what he thinks is right (and a chance to go on an ethical crusade so he can take someone else down) that they're willing to jump in without thinking or examining the situation and start calling people immoral or unjust.
There is a question of provenance of the code. Just because you found it on some web site doesn't mean THEY didn't copy it from somewhere else and remove the copyright notices - it happens. It's also possible that both got if from a public domain source (there isn't that much code in the public domain, but there is some). However, I strongly suggest you report it to your superiors within the company. If they decide not to do anything about it then don't worry.
Copyright infringement is one of those things where ignorance is not bliss. The longer it goes on, the higher your company's potential liability.
Reading the comments for this story it's almost hilarious how many people see no problem whatsoever with ripping off code and passing it off as your own. Ripping it off is wrong legally, but more important passing it off as your own is wrong ethically.
The vast misunderstanding of basic copyright law here reminds me of this exchange (used without permission and don't think the irony is lost on me)
Then again, MOST ask slashdot discussions remind me of that exchange.Jherico
What can the average user can do to ensure his security? "Nothing, you're screwed"
You would be hard pressed to be more wrong. All creative works are copyrighted and unless licensed are not free for anyone to use except under very specific conditions.
>Ever find a quarter on the ground? Somebody ever give you one? Did you require a deed to prove you had the right to the quarter?
That's an asinine comparison. A quarter isn't a creative work. Quarters are not covered under intellectual property law. The comparison you're looking for is finding a novel manuscript on the ground, picking it up, putting your name on it and selling it to a publisher.
Jherico
What can the average user can do to ensure his security? "Nothing, you're screwed"
If code is posted on a forum, whether or not it has a license attached to it may not matter. Many forums used by programmers require that posters give the right to use the example code posted, etc. Please check with forums FAQ before panicking.
You should probably just mention it to him and offer to rewrite it. It would be wise to not act in an accusatory manner when bringing it up. Remember that there are a lot of sources out there that are meant to be used as example code, and that if permission to copy is given it isn't "cheating" to do so.
>Personally, my favored way of avoiding this problem is to use GPL software...
This *causes* legal problems, it doesn't solve them and is bad advice. How you can use GPL code in conjunction with your proprietary software is highly legally constrained. If you use GPL libraries, the GPL license then applies to your code. Supposedly LGPL gets around this, but not really due to ambiguities in the license (the license uses the ambiguous term "derives from" which has a different meaning when used with object oriented software). Note that glibc has a special exception, and that it is generally ok to use.
>We weren't told what license the issued product would be under, and it might BE under GPL.
It doesn't matter whether the software he is releasing is under GPL. You can't just apply the GPL to someone else's non GPL code without their permission. You'd not only be opening up your company to lawsuit, but probably everyone who uses your code.
The GPL is not a magic license that you can invoke and use other people's software however you want. It is a useful license in many situations, but it clearly does nothing to help the OP.
The problem with copyright law is that if you don't explicitly allow use of your content then no use is allowed (except "fair" use that is not well defined).
So if you want the content you post to be freely and legally usable by everyone you have to license it. You don't have to bother with all kinds of FOSS licenses as you can just declare that it is in the public domain, which means that you are still the copyright holder but you license your work to everyone to do whatever they want with it.
So the OP raises a valid point: that code represents a risk to the organization he works for. Perhaps a small risk, but if later it is discovered it might cost money to the organization. If this was code used in a FOSS project and someone posted a comment about it I believe the issue would be immediately addressed by either locating the source and verifying that it is reusable (and documenting the fact in the source0 or replacing it. A closed source project might react differently (such as by making sure the code is not exposed to the outside world so that infringement can not be detected) but it still would want to reduce the risks involved in using unlicensed content.
This aspect of copyright law was perhaps good at the time when the mere fact that a work is published indicated that someone made an effort and investment in publishing it. It is very inappropriate today because no real effort and practically no investment is needed to publish content, and people do post lots of content with the intention that everybody could use it freely. This should be changed and this change would be good for everybody, and especially for those who don't want their works freely distributed, because one of the arguments available now is that there is no way to tell content that is freely distributable from content that is not, and most of the unmarked content out there was meant to be freely distributable by the autheor, despite the author's failure to explicitly attach a license (including a license that puts the content in the public domain).
IANAL-However, Code that is not created by someone who has signed a work for hire agreement could create a title defect. My IP lawyer (who probably reads this site) says they're like cockroaches, and give investors nightmares, because it can create SERIOUS issues. Well, I mean, only serious issues if you like owning your company, being able to raise capital, not getting your pants sued off (sin pantolones es no beuno!)
Again- IANAL
Would it pass for college work?
Yeah, but there is a big difference between the college code and business code. What's written for review from a prof. and what's written for your customers to get their application on spec, on time, and under budget.
Ask not what you can do for your country. Ask what your country did to you
10 print "hello world"
20 goto 10
Who owns this code? I just wrote it out of my head because I am sure I read it in a book somewhere. I couldn't tell you which one it was so long ago. Some logic is just obvious. I could complicate the above code in order to "re-write" it but it, would still be the same thing. It seems to me that as long as you don't take something that you have found in its entirety and use as your own and distribute it there is some fair use there. Where that line is, is blurry. Is every sampled sound in some "popular" music that is used without explicit permission a violation of copyright? Then if i sample the sample of the sampled sound from that music and use a bit of that then, who's copyright did I violate? This whole discussion is terribly confusing...
- He is automatically assuming the original coder, who's now the lead he's meant to report to, acted with malice.
- He has absolutely no proof that the guy deliberately did anything wrong.
- He has absolutely no proof that they guy wasn't simply given the code by another coder on the project and has no idea it comes with a license.
- He has absolutely no proof that the guy hasn't already attained a license and it's in his desk drawer.
- He has absolutely no way of knowing if the original coder actually worked at that company and the code on the web is the derivative.
If he goes with his suggested options of an unapproved recode or reporting the issue to more senior management, without going to the lead first:- He automatically demonstrates he's assumed the worst of his lead without even talking to him.
- He has no respect for the reporting structure of the organization.
- He's willing to waste senior management's time with things a more junior manager should have looked at first.
- He's willing to waste company time doing a recode that may prove to be totally unnecessary and he certainly hasn't checked the facts to find out either way.
The only real option in this situation is to send a brief, tactful email to the lead along the lines of, "Hey, I noted [this code] is similar to [this code]. Just confirming you're aware and have made whatever decision you feel appropriate in terms of licensing?" Then keep the email.The lead may have a good reason, may not have had a good reason but takes an appropriate response (securing the license, recoding), or may choose to bury it.
ONLY when there's proof the lead's actions are deliberately sketchy does it become appropriate to consider jumping him in the chain and reporting, to ensure more senior management know they're being exposed to a liability.
Pretty much every other option demonstrates the new coder has serious issues with respecting the people he works with. He may or may not be right. If he isn't, he's pretty much destroyed himself in the organization. If he is, he still has to prove malice on the lead's part or he risks the lead saying, "Wow, I never knew. I wish he'd come to me instead of thinking he was above playing with the team."