Slashdot Mirror
Half of GitHub Code Unsafe To Use (If You Want Open Source)
WebMink writes "GitHub is a great open source hosting site, right? Wrong. There's no requirement that projects on GitHub provide any copyright license, let alone an open source one, so roughly half the projects on GitHub are "all rights reserved" — meaning you could well be violating copyright if you make any use of the code in them. And GitHub management seem just fine with this state of affairs, saying picking a license is too hard for ordinary developers. But if you're not going to give anyone permission to use your code, why post it on GitHub in the first place?"
Because it's a free place to store a git repo as a backup.
Your hair look like poop, Bob! - Wanker.
Is only a problem in places where computer algorithms can be patented. and beside, anyone just grabbing code and pasting direct onto a product without audit or modification is asking for a nice backdoor.
This certainly isn't a new problem. If you work for a corporation, you aren't going to use code without a clear license. At least, I hope you aren't. If you need clarification about a license, you can often just contact the author. Just because the website is called "Github" doesn't mean you should treat the code any differently than code you find laying around anywhere else.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Code having a license term, you use it under that license. Whats the problem. So you can't cut an paste it. Good. But as a example of an implementation its still very useful/educational.
The license chosen isup to the author, get over it. This militant 'I want it all for free and without me having to do anything' is your problem, not the authors.
You're as bad as the MAFIAA conflating piracy and theft.
As is Bitbucket (bitbucket.org), with the added bonus that the private repos that you create there are free too.
The man who dies rich dies disgraced. -- Andrew Carnegie
"All rights reserved" doesn't mean that you aren't going to give permission to use your code. It just means that you haven't done so yet, or you haven't made up your mind.
It is silly to use such code, even if accompanied by a license, because the right to use it can be revoked if it is reserved.
I've found modules I wanted to use on github and gone through the exercise of tracking down the authors and talking them into putting their code under some sort of license (hopefully one that's compatible with what I need, but of course it's up to them). It's surprising how many people don't understand of copyright law and licensing.
Apparently checking the license on code before you copy and paste it into your own project is also too difficult.
To "old" hands like me, GitHub is one of the last places reminiscent of the great liberties we had up to the end of the '90s. So what do we care ? Take code from GitHub, copy/paste, re-implement ideas you find there, possibly implemented badly.... C'mon, who gives a damn about copyright on GitHub ????
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
Lets say I stumble across a fantastic utility, and the source is open for me to view. I'll dive through the code and make sure I'm comfortable with its functionality (i.e. it's not doing anything I don't want it to do) before grabbing the tool.
I'm not using the code for my own projects. I'm just vetting the code. Plenty of developers throw code for small utilities up for exactly this reason, and the vast majority of the world is totally cool with it.
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
C'mon, it ain't that hard.
1. Post it on Github
2. Make everyone think it's free to use.
3. Sue everyone you can get your hands on who do.
4. Profit
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Doesn't the user(consuming developer) of the code bare responsibility for proper use and honoring of the license? I know it's mildly inconvenient to you, but researching ownership and licensing is one of the costs of using "free" code. If that cost is too high for you, don't use that code.
I really fail to see how this is a problem of any kind with GitHub. It's not even a problem for the poster of the code. It is up to the user of the code to verify license compliance.
Daily reminder that "open source" doesn't necessarily automatically equal "free" (beer or freedom).
I'm OK with this.
The author seems to confuse open source with copyleft. Open source is not a legal thing. And a ban on redistribution of derivative works doesn't mean that it's useless. Knowing the source code of a piece of software is important if you want to use it for any security-sensitive work or if you want to implement some modifications of your own (which you don't intend to distribute). It's not unheard of even that a developer company only gives the source code to their paying costumers.
Whether you are working on proprietary code or open source code, you can't just paste code from the net into your project without a license, regardless of whether it's GPL, BSD, or some royalty-free use grant. Unless the code has an explicit license, or states explicitly that it is in the public domain, you simply cannot use it without express permission from the copyright holder, because no law grants you that right. Plain and simple. So if code in a git repo is "all rights reserved," the you can look, and even download it, but you cannot put it into your own code. So I don't see what the problem is here. License always matters, whether you're a FLOSS person or developing commercial software.
So of course half of all git repos are unsafe to use. Why does this warrant some big sensationalist article? Kind of along the lines of articles claiming the GPL is a threat to proprietary software companies because it will "infect" them somehow magically. Folks, a little bit of understanding of copyright law will go a long ways I think. Open source, even copyleft, depends on copyright to keep it as such. We should all have a basic understanding of it.
Gitorious is both free software (AGPL) and a hosted git service. Creating a project, you get to pick between 22 licences, proprietary or none. I haven't checked their stats to see what percentage of projects it hosts are open source or not.
Is finding your stuff on github when you didn't put it there yourself.
Github is a great place to store your repository. It is ALSO a great place to share code with people you want to work with who may or may not be really conversant with git.
Github doesn't claim to provide a repository for open source software...just a place to store repositories which you (as an author) may or may not choose to attach a license to. But that doesn't remove the responsibility of the copier to determine what the license on that software may be. If I copy anything, I need to know if I have the right (copy right) to do that. The onus is and always has been on the copier. That said, the copyright owner is the one who will follow up with violations.
Just because I choose to use github to store my repositories (and, in my case, I use and pay for private repositories for those things that I don't want to share) does not mean that I want everyone in the world to download and use my stuff. I'm an idiot if I am surprised when people DO use my stuff that I make publicly available, but without an explicit license allowing use of my code, it is protected in the US by copyright laws as soon as I write it...and IANAL.
Github is just a great service for those of us who don't want to set up our own repository. They are not a guarantor of free software, nor a nanny to protect me.
My brain is overly lubricated
your chosen licence"
He's not saying that the lack of licence information is GitHub's problem, nor that it's unique to GitHub. Rather, he's saying that there is a problem — code without clearly attributed licence information — and, whilst each would-be user could contact each developer and find out the licensing conditions, GitHub could make a simple tweak to their platform to encourage developers to select a licence.
I would not favour pre-selecting a default licence, but rather having a developer presented with a set out option, perhaps with a tool to help aid selection based on requirements. No requirement, no default licence, but just a helpful reminder — if someone wants their code to be reused, but didn't know to think through the legal aspects, this would help them out, without harm to anyone who would rather not specify a licence for whatever reason.
Sounds sensible to me.
Github is the photobucket of source code. Licensing code would be another step that people generally don't want to bother with. If someone cares enough about licensing for some particular code, they can contact the author(s) easily enough. Frankly, worrying about licensing every piece of code you write is just a time-suck. It's necessary in some situations, but not
roughly half the projects on GitHub
GitHub allows creators to determine what license to publish under. The license is disclosed to downloaders. Some of it is under an open license. Some of it isn't.
"Is this code using a license compatible to my project?" is a pretty normal thing to ask before dropping something into your work.
Personally, I like having access to look at source on closed projects - projects I wouldn't otherwise have access to. You can learn stuff even if you don't copy/paste working code.
Half of Coffee Shop Unsafe to Drink (If You Want Decaf)
Open "SORES" people are since they're obviously reaming the code of others. That's not programming. It's the province of noobs, nothing more. Makes sense since most of what I've encountered here has been young wannabes calling themselves programmers here but in reality are nothing more than cut and paste users of the code others wrote, and what I call "web-wallys" (HTML work is text formatting plus placing pictures - not coding. Javascript, Python, CSS, and the like? Wuss tools that do hand-holding for the noobs that use them, and especially when the code it stolen from others!).
We claim no intellectual property rights over the material you provide to the Service. Your profile and materials uploaded remain yours. However, by setting your pages to be viewed publicly, you agree to allow others to view your Content. By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories.
If you use source code found on github, it's going to be hard for the author to win a copyright lawsuit. This is a non-issue. They've basically allowed you to fork the code (with the implication that you're going to modify it). I don't see them in any way being able to recover punitive or even statutory damages.
The real danger with github, as with all open source, is ensuring that the project's owner hasn't stolen proprietary code from somewhere else. Imagine if Linus had grabbed some files from Unix, then IBM would have been in a lot more difficulty during the SCO case. Fortunately the only things Linus copied were semicolons and braces.
But if you use someone's code through an open source project, you can be liable, even if you got the code under the GPL or BSD license, because the project's owner didn't have the right to give you that code.
"First they came for the slanderers and i said nothing."
I think so!
The public repository option for uploading makes no mention that you need to supply the code with a copyleft/copyright free license, just that the code is publicly listed and browsable. Why are people assuming that everyone is supposed to?
Are people confusing open source (publicly browsable source) from Open Source (the movement)?
Lots of so called open source projects either don't provide a license or provide conflicting license information. For example, we recently looked at a project where the web site says it's MIT, but the code says it's public domain.
Every question, answer, and comment on the StackExchange websites (StackOverflow, ServerFault, et. al.) is automatically licensed on something very akin to the GPL (the Creative Commons Share Alike License); if you use code from those sites, your entire application's source will legally have to be released.
Just because no one is talking about that doesn't mean it isn't legit. Check it out: http://meta.stackoverflow.com/questions/25956/what-is-up-with-the-source-code-license-on-stack-overflow
Slashdot Valentines Beta Massacre: iT WORKED! The boycotts killed Beta!!
We claim no intellectual property rights over the material you provide to the Service. Your profile and materials uploaded remain yours. However, by setting your pages to be viewed publicly, you agree to allow others to view your Content. By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories.
If you use source code found on github, it's going to be hard for the author to win a copyright lawsuit. This is a non-issue. They've basically allowed you to fork the code (with the implication that you're going to modify it). I don't see them in any way being able to recover punitive or even statutory damages.
Forking doesn't remove copyright. All that seems to have been accomplished by forking is adding someone else's possibly copyrighted work to the original author's copyrighted work.
...and they are all GLP2. Thieves are gonna steal, no matter what, so my code out there is free for the taking. I use GPL, only because a couple of other FOSS repositories require it. I'd much rather use the "Take Me, You Gypsy Stallion" license, in which the code is 100% open and free for all. I don't like GPL, because it's a coercive license; every bit as shackled and enslaved as the code the FOSS folks like to dis. However, it doesn't hurt to use it, in my context.
If I don't want people to have my code, then I have a Perforce server that I run in my local network. I have a lot of stuff there, as well.
"For every complex problem there is an answer that is clear, simple, and wrong."
-H. L. Mencken
You won't be able to use this competitive advantage if your company has lawyers on staff. A small startup will use the advantage because they don't have a lawyer who can forget to explain estoppel to them.
"promiscuous sharing w/out a license leads to software transmitted diseases".
...
Well, before you use the software, checkout the license
AccountKiller
Just so you know, in the terms-and-services you clicked on when you signed up for github, you actually gave permission to everyone in the world to download, view, and fork your stuff.
True. However the original copyright remains intact. Maybe you could add your copyright to code that you add. The original author doesn't seem to lose anything by forking. Well other than individuals may download and privately use, but not redistribute, the forked version rather than the original version.
Since the original author is essentially publishing the code it would seem that an individual downloader would have the right to use the code on a personal basis. This individual would merely not be allowed to redistribute or otherwise share the code.
Of course if the individual wants to share the work with someone else they merely have to refer that person to the original author's github repository.
So if someone creates a useful a utility program, decides to license it in a non-FOSS manner, the author can still share it with any interested parties. If so that seems a pretty legit role for github.
For one, [the German counterpart to copyright is] an author's right. Not a publisher's right. The fundamental difference in philosophy that that entails, should be obvious.
The U.S. Constitution in theory espouses the same philosophy, as exclusive rights are secured "to authors and inventors".
And you can never ever sell your rights away. Ever.
How does Germany handle works made in the scope of employment?
You can act as if, but you can always go "Fuck you, cooww and shee-keeenn! Now you can't use it anymore!" if they are stupid enough to fall for it.
If an author signs a contract with another party granting an exclusive license to publish a given work, is that unenforceable?
And so you do not need to write *anything* below your works.
The U.S. hasn't required a notice since 1989 when the U.S implemented the Berne Convention, but it provides evidence that strengthens a copyright owner's case in court.
A lot of stuff on github is experimental, "quick and dirty" code. The amount of effort to, say, put GPL boilerplate in every file isn't large, but it isn't zero, either. So, *ask*. You send mail to me, volunteer to do this small job, I'll probably give you commit access to the repo.
Honestly Copyright is so broken it's disgusting, so screw everyone, I'm using it all and passing it off as my own. Good luck decompiling my stuff and finding your code in there.
Copyright when it comes to code is complete BS. I dont recognize any of it, but I give credit when you offer it up for free, I'll violently steal it when you act like a jerk and say "all rights reserved"
Lets take a look at some projects I'd actually use:
https://github.com/visionmedia/express [MIT]
https://github.com/jashkenas/coffee-script/blob/master/LICENSE [MIT]
https://github.com/LearnBoost/mongoose [MIT]
https://github.com/bnoguchi/mongoose-auth [MIT]
I didn't cherry pick these. I just went through every project that came to mind.
Think github code is safe to use? Yes. If it's a module and it's authors have bothered to package it for gem, npm, pip, whatever they've probably chosen a liberal license (MIT, LGPL, BSD) license because the god damn point is to share the code and include it in projects.
Three quarters of the code on github are probably random local repositories for code that was never meant to be shared. Just folks that needed a remote hosting solution. Confounding that class of code with the plugins, modules, frameworks that people actually use and by their very nature, demand liberal licensing - most developers are familiar with the licensing issue and won't use your module otherwise - is downright naive and/or misleading.
You cannot patent an invention if someone else published it first
I have a bunch of projects on github and I'm too lazy to license many of them. If anyone ever emailed me wanting to use them I'd throw up a BSD3 license. I bet a lot of projects on github are lazy or simply don't know how to license a project, but would be happy to give permission to use the code.
No, using GitHub is not dangerous. But reusing code from the Internet without investigating its licensing status is. Then again, the same goes for anything that you find online, and they teach kids at school these days what you can and can't re-use. Your ignorance will not protect you.
Let's see... I've got bitbucket and github accounts. They're a bit intentionally split depending on who I work for, and the bulk with the current job is on github, without license. Given at the current one there is boss who does not understand copyright at all -- and hopefully some day she's going to get annihilated for it, having issued instructions to violate it over email on more than one occassion. Not explicitly of course -- just issuing her opinion that copyright doesn't apply to this task. Or to use continue using GPL for new commercial purposes because purchasing libraries is not in the budget. Sucks to be me. Will suck to be her even more some day. Thank you emails exported on a thumb drive and taken home immediately.
In the meantime, she thinks that anything I publish at the site she knows about is all stuff she's signed on and no work happens by contract for anyone else. Anything published on that site is definitely signed on. And is definitely not listed with a license. And is definitely linked against or using GPL libraries so there's a nice very public record.
Clearly she owns me on all related works and projects, including personal work I've been courteous enough to import into their system under my BSD clause.
Oh wait... their entire source tree is contaminated and has been for the past four years. Well, I had my advice -- and I still need to get paid.
On these sites I have....
* "All rights reserved" -- explicitly.
* 3 clause BSD -- most of my "own"
* GPL -- some web modules done while paid by others.
* Unlicensed whatsoever (All right reserved implicitly) -- presentations written for others, delivered as part of a job. Which basically was may way of making sure if someone wanted to use it, they had to contact me -- so I'd know who they were, that it was credible, and find other people doing similar things.
There's also SVN repositories at two other places, one of which probably should be migrated to git for convenience.
lets sue those people!
"We claim no intellectual property rights over the material you provide to the Service. Your profile and materials uploaded remain yours. However, by setting your pages to be viewed publicly, you agree to allow others to view your Content. By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories."
Looked at sourceforge, freshmeat/freecode and github...
and github was the easiest for hosting my LPC http://lpc.opengameart.org/ entry.
Know of a better one that will also allow you to host your HTML5/javascript webpage for free?
A private repo costs money. Hosting elsewhere costs more.
Maybe saving on hosting outweighs the downside of their code being public.
EPIC. FAIL.
If you don't know how it works you REALLY should refrain from commenting. Seriously. (But then, you're what I've actually, sadly, come to expect from /.)
All Rights Reserved means you claim ALL of the Copyright Rights on a given work. This means publication, derivative works, etc.
The only way to use that code is to use it by License. And...you clearly don't grok contracts, etc.- a license CAN'T be revoked just by what you claim. "All Rights Reserved" is staking a claim on the Copyright on a protected work. A License, depending on it's verbiage can be revokable or not depending on numerous differing things.
For example:
If you don't give the source code out to recipients of a derivative work from a GPL-ed protected work, your'e in violation of the License and are guilty of an act of Infringement. Nothing in any of the aforementioned statement or the license changes whatsoever on seeing "All Rights Reserved" in the codebase. NOTHING. Comply with the terms of the license and you are licensed in perpetuity- and it's still appropriate to say "All Rights Reserved" because it shows up in GPL-ed, BSD-ed, etc. stuff.
so just make it default copyrighted or default bsd and have done with it.
This is a joke. I am joking. Joke joke joke.
I'm pretty sure the majority of JavaScript are posted without a license.
If a project on Github doesn't mention its license, and you'd want to use that code, just ask the developer!
The phrase "All Rights Reserved" is a totally meaningless phrase. It used to be required to retain certain rights in central american countries. It was created by the Buenos Ares convention, and once everybody in central and south america adopted the Berne convention, the phrase no longer had any recognized legal meaning.
It has falsely been asserted that the phrase "All Rights Reserved" makes the Berkeley Copyright statement non-free. This is false because the copyright notices from the Berkeley Unix code base date to a time when the phrase had meaning.
It's only use today is due to inertia.
In short, this article is quite sensational in its ignorance.
Consider a cookbook. You do not own the copyright to that chocolate chip cookie recipe on page 42. Nor do you have a license to publish your own cookbook that includes the recipe, modified or not.
You are however allowed to bake the recipe. You're also allowed to modify the recipe for your own use. The cookbook author does not need to grant you a special license for this; it's implied.
Baking cookies or compiling programs, the same principle applies.
Makes sense, supposed your coding style is rather... /** BUY CHEAP PENIS REPLICA */ ...marketing-oriented.
Oh, the beautiful gloss of greality!
I don't see the problem, unless github has made some pledge to only host code that conforms to certain license principles.
Even if there was a requirement that all code must be OSS, there is the possibility that a potential non-personal user cannot use the code. For example, it could be that he wants to link together pieces of software with conflicting licenses, or perhaps more probable that the license require more than what he can put up with. For example, not everyone was always comfortable with GPLv3. Not everyone is comfortable with GPL due to the copyleft requirements.
To take code into your project without even checking the license would be extremely ignorant. Regarding personal use, if somebody put their own code on github, they are hardly in a very good position to sue people for personal use. Also, I don't think it's very likely scenario; I doubt that you will ever see Microsoft post the Windows 8 source code on github and then start suing people for piracy.
If you're going to use a BSD-like licence, it isn't a long step to go public domain instead. Many people (including me in the past) probably don't want to deal with the legal stuff at all, and just want to share the code. It's more difficult for the users of the code, but that's not my problem. Amateurs can use the code privately (there's an implied licence, not in the law but by convention, that when you click some link you have the right to view it).
"But if you're not going to give anyone permission to use your code, why post it on GitHub in the first place?"
You can use someone else's code in two perfectly legal ways in this scenario. First, you could copy it and alter it to the point it no longer bears enough resemblance to the original to cause any trouble, even though it still works great. Second, you could simply study it and learn how it works and then start from scratch yourself.
By analogy, this would be like like Green Day copying Chicago copying Led Zeppelin.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
From TFA:
"A casual survey of the projects on GitHub by a specialized analyst revealed that as many as half include no easily identifiable copyright licensing information."
Non-scientific survey by an anonymous person (are you serious?) says "as many as half" of all GitHub projects lacking "easily identifiable copyright licensing information", which, according to some anonymous legal opinion (WTF?), means "half of projects" are "all rights reserved", which is then turned into the headline of this piece, "Half og GitHub code unsafe to use" (because half of projects equals half of code, right?).