Forgot your password?
typodupeerror
Open Source Software

Half of GitHub Code Unsafe To Use (If You Want Open Source) 218

Posted by timothy
from the but-they-said-to-download dept.
WebMink writes "GitHub is a great open source hosting site, right? Wrong. There's no requirement that projects on GitHub provide any copyright license, let alone an open source one, so roughly half the projects on GitHub are "all rights reserved" — meaning you could well be violating copyright if you make any use of the code in them. And GitHub management seem just fine with this state of affairs, saying picking a license is too hard for ordinary developers. But if you're not going to give anyone permission to use your code, why post it on GitHub in the first place?"
This discussion has been archived. No new comments can be posted.

Half of GitHub Code Unsafe To Use (If You Want Open Source)

Comments Filter:
  • Because (Score:5, Interesting)

    by OverlordQ (264228) on Saturday December 01, 2012 @01:41PM (#42155175) Journal

    Because it's a free place to store a git repo as a backup.

    • Re:Because (Score:5, Insightful)

      by Bieeanda (961632) on Saturday December 01, 2012 @01:50PM (#42155231)
      And it's probably one of the first places that comes to mind, shows up on a cursory search, or is suggested by someone in passing. Given that the site maintainers are fine with the state of things, the issue would seem to lie with the assumption that all code there is OSS licensed, rather than its use as a catch-all repository.
      • Re:Because (Score:5, Insightful)

        by Kergan (780543) on Saturday December 01, 2012 @05:52PM (#42156907)

        A developer who downloads code for use in his project, without checking the licence first, shouldn't be coding in the first place. Seriously...

    • Re:Because (Score:5, Insightful)

      by Anonymous Coward on Saturday December 01, 2012 @01:50PM (#42155233)

      this. i've only used github for my personal projects. not everyone cares about contributing to open source projects, or making their code available to others. and there's nothing wrong with that. not everyone should be expected to share their work.

      shocking and unbelievable, i know, but it's true.

      • One semester I used it for my homework. Lots of .tex and .m files. I could do a problem, commit. Push go to a completely separate computer, pull and continue working.

      • Re:Because (Score:4, Interesting)

        by cheesybagel (670288) on Saturday December 01, 2012 @04:25PM (#42156443)
        I only use GitHub for code I have written under non-commercial licenses. Mostly Linux ports of former commercial games. SourceForge won't host them. Icculus is a bit of a pain to convince to host your code. GitHub is one of the few choices available gratis.
    • Bitbucket (Score:3, Informative)

      by akeeneye (1788292)
      As is Bitbucket (bitbucket.org), with the added bonus that the private repos that you create there are free too.
      • by jez9999 (618189)

        And you can attach files to your issues in the issue tracker (amazingly you can't on Github).

    • Every question, answer, and comment on the StackExchange websites (StackOverflow, ServerFault, et. al.) is automatically licensed on something very akin to the GPL (the Creative Commons Share Alike License); if you use code from those sites, your entire application's source will legally have to be released.

      Just because no one is talking about that doesn't mean it isn't legit. Check it out: http://meta.stackoverflow.com/questions/25956/what-is-up-with-the-source-code-license-on-stack-overflow [stackoverflow.com]

      • by rasmusbr (2186518) on Saturday December 01, 2012 @03:36PM (#42156041)

        In order to have copyright you must first create a work. Most of the code examples that people post on those sites are so short and trivial that I doubt that very many of them (as published in isolation) would qualify as works in most jurisdictions. Even if you have a code example that is complex enough to qualify as a work you could still probably copy-paste a few lines from that work without breaching the copyright, especially if those lines are trivial or obvious or constitute best practice in the language.

    • Since the original author is essentially publishing the code it would seem that an individual downloader would have the right to use the code on a personal basis. This individual would merely not be allowed to redistribute or otherwise share the code.

      Of course if the individual wants to share the work with someone else they merely have to refer that person to the original author's github repository.

      So if someone creates a useful a utility program, decides to license it in a non-FOSS manner, the author
    • by Darinbob (1142669)

      Github is only a problem in the original article if you subscribe to a certain political viewpoint.

  • That (Score:4, Interesting)

    by M0j0_j0j0 (1250800) on Saturday December 01, 2012 @01:45PM (#42155197)

    Is only a problem in places where computer algorithms can be patented. and beside, anyone just grabbing code and pasting direct onto a product without audit or modification is asking for a nice backdoor.

    • by dshk (838175)
      In the EU computer algorithms cannot be patented (or at least such patents cannot be enforced), but copyright law applies, and I guess copyright law exists in almost all countries of the word.
  • Not a new problem (Score:4, Insightful)

    by MightyYar (622222) on Saturday December 01, 2012 @01:46PM (#42155209)

    This certainly isn't a new problem. If you work for a corporation, you aren't going to use code without a clear license. At least, I hope you aren't. If you need clarification about a license, you can often just contact the author. Just because the website is called "Github" doesn't mean you should treat the code any differently than code you find laying around anywhere else.

    • You won't be able to use this competitive advantage if your company has lawyers on staff. A small startup will use the advantage because they don't have a lawyer who can forget to explain estoppel to them.
  • Unsafe? (Score:4, Informative)

    by Anonymous Coward on Saturday December 01, 2012 @01:53PM (#42155255)

    Code having a license term, you use it under that license. Whats the problem. So you can't cut an paste it. Good. But as a example of an implementation its still very useful/educational.

    The license chosen isup to the author, get over it. This militant 'I want it all for free and without me having to do anything' is your problem, not the authors.

  • To "old" hands like me, GitHub is one of the last places reminiscent of the great liberties we had up to the end of the '90s. So what do we care ? Take code from GitHub, copy/paste, re-implement ideas you find there, possibly implemented badly.... C'mon, who gives a damn about copyright on GitHub ????
    • Lawyers. The EFF. The FSF. Anyone who makes a living on copyright.

    • by westlake (615356)

      Take code from GitHub, copy/paste, re-implement ideas you find there, possibly implemented badly.... C'mon, who gives a damn about copyright on GitHub ????

      The owners. The courts. Your employers. Your clients, among others.

  • Why? (Score:5, Insightful)

    by gcnaddict (841664) on Saturday December 01, 2012 @01:56PM (#42155283)

    But if you're not going to give anyone permission to use your code, why post it on GitHub in the first place?"

    Lets say I stumble across a fantastic utility, and the source is open for me to view. I'll dive through the code and make sure I'm comfortable with its functionality (i.e. it's not doing anything I don't want it to do) before grabbing the tool.

    I'm not using the code for my own projects. I'm just vetting the code. Plenty of developers throw code for small utilities up for exactly this reason, and the vast majority of the world is totally cool with it.

    • by Ksevio (865461)
      So basically it's for the original coders to show off their awesome coding skills
      • by gcnaddict (841664)
        ...no, it's for the original coder(s) to build trust among the people using the programs.
  • by Opportunist (166417) on Saturday December 01, 2012 @01:58PM (#42155301)

    C'mon, it ain't that hard.

    1. Post it on Github
    2. Make everyone think it's free to use.
    3. Sue everyone you can get your hands on who do.
    4. Profit

    • by Vasheron (1750022)

      C'mon, it ain't that hard.

      1. Post it on Github
      2. Make everyone think it's free to use.
      3. Sue everyone you can get your hands on who do.
      4. Profit

      You forgot the ???

    • 2. Make everyone think it's free to use.

      3. Sue everyone you can get your hands on who do.

      4. Get annoyed that a court finds the existence of an implied licence, or, in some nuanced cases, that the action is prevented under the principle of non-derogation from grant. Assuming the defendant can afford to argue.

      • 4. Get annoyed that a court finds the existence of an implied licence, or, in some nuanced cases, that the action is prevented under the principle of non-derogation from grant. Assuming the defendant can afford to argue

        Please. Come back to reality.

        When in the recent past have you seen a court rule on copyright with common sense?

        Seriously, put down the bong.

        • by Neil_Brown (1568845) on Saturday December 01, 2012 @02:30PM (#42155495) Homepage

          When in the recent past have you seen a court rule on copyright with common sense?

          I'm not sure that Usedsoft [europa.eu] applied common sense, but rather some convoluted reasoning, but the outcome seems sensible enough. Picking on rulings relevant here, I think the US court's decision in Wallace v. IBM [uscourts.gov] was common sense, as was the finding of the German court in Welte v. Skype [gnumonks.org].

          Perhaps look also at Griggs v. Evans [bailii.org] — a pragmatic decision on the facts, to my mind.

          Sure, there are some odd judgments, but there are some sensible, practical judges out there too.

          • Interesting links. Thanks... F.P.

            • Interesting links. Thanks.

              My pleasure. If you do read the Usedsoft decision, there's a good chance you'll find it pretty impenetrable, unless you are familiar with the computer programs directive — I prepared some slides [neilzone.co.uk] for a friend's talk on Usedsoft a couple of weeks back, which you might find helpful alongside the decision. (Listed as (c) to me (ironic, given the thread here) but, as far as I'm concerned, treat as CC0 [creativecommons.org].)

  • by Hentes (2461350) on Saturday December 01, 2012 @02:00PM (#42155311)

    The author seems to confuse open source with copyleft. Open source is not a legal thing. And a ban on redistribution of derivative works doesn't mean that it's useless. Knowing the source code of a piece of software is important if you want to use it for any security-sensitive work or if you want to implement some modifications of your own (which you don't intend to distribute). It's not unheard of even that a developer company only gives the source code to their paying costumers.

    • by icebraining (1313345) on Saturday December 01, 2012 @02:28PM (#42155483) Homepage

      Open Source, as defined by the Open Source Initiative, is most definitively a legal thing.

      a ban on redistribution of derivative works doesn't mean that it's useless. Knowing the source code of a piece of software is important if you want to use it for any security-sensitive work or if you want to implement some modifications of your own (which you don't intend to distribute). It's not unheard of even that a developer company only gives the source code to their paying costumers.

      This is why the author says it's dangerous.

      Unlicensed code ("All rights reserved") is not a ban on redistribution. It's a ban on any copying, including forking the code to your machine. You most definitively can't modify the code, even if you don't intend to distribute it.

    • by micheas (231635)

      ... or if you want to implement some modifications of your own (which you don't intend to distribute)

      IANAL, but I have been led to believe that code that is all rights reserved cannot be modified without consent of the author, unless it falls under the fair use exemption of copyright.

      The fact that your modifications could reduce the profitability of the copyright owners derivative works lead me to suspect that the courts would generally find that your changes are a copyright violation, even if they are no

  • by caseih (160668) on Saturday December 01, 2012 @02:01PM (#42155319)

    Whether you are working on proprietary code or open source code, you can't just paste code from the net into your project without a license, regardless of whether it's GPL, BSD, or some royalty-free use grant. Unless the code has an explicit license, or states explicitly that it is in the public domain, you simply cannot use it without express permission from the copyright holder, because no law grants you that right. Plain and simple. So if code in a git repo is "all rights reserved," the you can look, and even download it, but you cannot put it into your own code. So I don't see what the problem is here. License always matters, whether you're a FLOSS person or developing commercial software.

    So of course half of all git repos are unsafe to use. Why does this warrant some big sensationalist article? Kind of along the lines of articles claiming the GPL is a threat to proprietary software companies because it will "infect" them somehow magically. Folks, a little bit of understanding of copyright law will go a long ways I think. Open source, even copyleft, depends on copyright to keep it as such. We should all have a basic understanding of it.

    • You can take any code which you find and put it into your project, or even combine bits of code with incompatible licenses. What you can't do is distribute the result. Distribution is where copyright law kicks in.

      • You can take any code which you find and put it into your project, or even combine bits of code with incompatible licenses.

        Distribution might be where GNU GPL 2.0 kicks in, but copyright certainly kicks in to prevent you from just taking code and putting it into your own project, at least in Europe — the restriction on "copying," for example. (You might have a defence of fair use in the US, but that's an affirmative defense, not an absence of copyright.)

        Whether anyone would find out, or consider it worth suing for, is perhaps another matter, but copyright is not just limited to distribution.

        • It is true that the law grants the copyright owner the right to restrict the creation of copies, but It can be reasonably argued that by posting the code on GitHub you've implicitly given consent to the mere creation of a copy (as would automatically happen if you view the code or download it). For most practical purposes, the limitation on distribution is what matters.

      • by micheas (231635)

        Distribution is where copyright law kicks in.

        Like when you distribute the program from your drive to your RAM?

        Now if the program is all rights reserved, and your modified version that you distribute mocks the original author, you could claim the parody exception for copyright. (Would you be successful? I don't know about that question, ask an attorney.)

    • The repos on github aren't all-rights-reserved. By hosting your code on github, you agree to allow people to fork your code.
    • by mysidia (191772)

      because no law grants you that right.

      No no no... You have that right by default, unless the law denies it. You can repeat some code, natural right to free speech protected by the constitution.

      However, some restrictions may apply. One of those restrictions is, if someone else wrote the code, their work may be protected by copyright.

      If they register their copyright with the US copyright office, within a certain time period after having created the work, they could sue you for infringement.

      In

  • by dugjohnson (920519) on Saturday December 01, 2012 @02:09PM (#42155365) Homepage
    Github is a great place to store your repository. It is ALSO a great place to share code with people you want to work with who may or may not be really conversant with git.
    Github doesn't claim to provide a repository for open source software...just a place to store repositories which you (as an author) may or may not choose to attach a license to. But that doesn't remove the responsibility of the copier to determine what the license on that software may be. If I copy anything, I need to know if I have the right (copy right) to do that. The onus is and always has been on the copier. That said, the copyright owner is the one who will follow up with violations.
    Just because I choose to use github to store my repositories (and, in my case, I use and pay for private repositories for those things that I don't want to share) does not mean that I want everyone in the world to download and use my stuff. I'm an idiot if I am surprised when people DO use my stuff that I make publicly available, but without an explicit license allowing use of my code, it is protected in the US by copyright laws as soon as I write it...and IANAL.
    Github is just a great service for those of us who don't want to set up our own repository. They are not a guarantor of free software, nor a nanny to protect me.
    • Github doesn't claim to provide a repository for open source software

      Agreed, although it does claim to be a platform for "social coding," and that it is [github.com] "the best place to share code with friends, co-workers, classmates, and complete strangers," having been founded "to simplify sharing code."

      I am not reading the article as anything more than "if GitHub wants to promote sharing of code, make it easier for a developer to specify licensing terms" — and that seems imminently sensible to me.

    • by phantomfive (622387) on Saturday December 01, 2012 @02:38PM (#42155547) Journal

      Just because I choose to use github to store my repositories (and, in my case, I use and pay for private repositories for those things that I don't want to share) does not mean that I want everyone in the world to download and use my stuff.

      Just so you know, in the terms-and-services you clicked on when you signed up for github, you actually gave permission to everyone in the world to download, view, and fork your stuff. So if that's not what you want, you might reconsider your use of github (Note: this only applies to the free public repositories).

      • Agreed and I understood that (which is why I have some private repositories). It's the fork part that is "interesting" from a copyright standpoint. What does that really mean, legally (I know what it means technically)? I guess that's why the lawyers continue to do what they do.
        • What does that really mean, legally (I know what it means technically)?

          From a legal standpoint, of course it's a horribly unclear terms-of-service, so you are right when you say, "I guess that's why the lawyers continue to do what they do." However, I think the implicit meaning could be reasonably interpreted to mean, "if you put things here, you intend to share them."

          In general it's easier to pursue a copyright claim if you've made an active attempt to assert it, for example, submitting your work to the Library of Congress. So if you haven't specified a license, or made an

      • Just so you know, in the terms-and-services you clicked on when you signed up for github, you actually gave permission to everyone in the world to download, view, and fork your stuff.

        True. However the original copyright remains intact. Maybe you could add your copyright to code that you add. The original author doesn't seem to lose anything by forking. Well other than individuals may download and privately use, but not redistribute, the forked version rather than the original version.

        • Well other than individuals may download and privately use, but not redistribute, the forked version rather than the original version.

          It is unlikely that any court will interpret the terms of service to mean that you can fork it, but not allow others to fork a forked version. It's unlikely that any court would stop redistribution.

          You can try filing a lawsuit, and good luck to you. I'd like to see that one play out in court.

          • by perpenso (1613749)

            Well other than individuals may download and privately use, but not redistribute, the forked version rather than the original version.

            It is unlikely that any court will interpret the terms of service to mean that you can fork it, but not allow others to fork a forked version. It's unlikely that any court would stop redistribution.

            Who said anything about not allowing the fork to be forked? By redistribution I mean something *other* than the source being available on github as part of the original author's hierarchy. Such *other* methods of distribution remain subject to the authors' wishes.

            • Yes, but if you don't specify that your wishes are contrary, you will have trouble winning a court case based on non-specified wishes.
              • by perpenso (1613749)

                Yes, but if you don't specify that your wishes are contrary, you will have trouble winning a court case based on non-specified wishes.

                I'm sorry but I'm not following. Your wishes being contrary do not change the original author's wishes. The original author's wishes move to the fork with his code. There could only be contrary wishes in the code that you contribute. People would be free to re-use source from you contributions if your allow but the original code remains off limits wrt re-use.

                • The author's wishes don't matter. All that matters is what can be enforced in court (remember copyright is an artificial construct, the only way it matters is when the government enforces is through the courts).

                  The goal for the author should be to make his wishes known in a way that the courts will be willing to enforce the copyright. There are ways to do this, for example, you can submit your work to the library of congress.

                  Now, if you don't even include a license in your repository, and just throw it
  • by metrometro (1092237) on Saturday December 01, 2012 @02:20PM (#42155431)

    GitHub allows creators to determine what license to publish under. The license is disclosed to downloaders. Some of it is under an open license. Some of it isn't.

    "Is this code using a license compatible to my project?" is a pretty normal thing to ask before dropping something into your work.

    Personally, I like having access to look at source on closed projects - projects I wouldn't otherwise have access to. You can learn stuff even if you don't copy/paste working code.

  • by metrometro (1092237) on Saturday December 01, 2012 @02:24PM (#42155457)

    Half of Coffee Shop Unsafe to Drink (If You Want Decaf)

  • Terms of github (Score:5, Interesting)

    by phantomfive (622387) on Saturday December 01, 2012 @02:27PM (#42155475) Journal
    From the terms of service from github [github.com]:

    We claim no intellectual property rights over the material you provide to the Service. Your profile and materials uploaded remain yours. However, by setting your pages to be viewed publicly, you agree to allow others to view your Content. By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories.

    If you use source code found on github, it's going to be hard for the author to win a copyright lawsuit. This is a non-issue. They've basically allowed you to fork the code (with the implication that you're going to modify it). I don't see them in any way being able to recover punitive or even statutory damages.

    The real danger with github, as with all open source, is ensuring that the project's owner hasn't stolen proprietary code from somewhere else. Imagine if Linus had grabbed some files from Unix, then IBM would have been in a lot more difficulty during the SCO case. Fortunately the only things Linus copied were semicolons and braces.

    But if you use someone's code through an open source project, you can be liable, even if you got the code under the GPL or BSD license, because the project's owner didn't have the right to give you that code.

    • by PPH (736903)

      Yep. Good points.

      It sounds like the original poster comes from that school of thought that expects every hosting service or ISP to defend property rights on behalf of the owners. That's not GitHub or Megaupload's job. The world would be different if the RIAA had sued Postel and Reynolds for writing RFC 959 (FTP) for not incorporating DRM.

    • We claim no intellectual property rights over the material you provide to the Service. Your profile and materials uploaded remain yours. However, by setting your pages to be viewed publicly, you agree to allow others to view your Content. By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories.

      If you use source code found on github, it's going to be hard for the author to win a copyright lawsuit. This is a non-issue. They've basically allowed you to fork the code (with the implication that you're going to modify it). I don't see them in any way being able to recover punitive or even statutory damages.

      Forking doesn't remove copyright. All that seems to have been accomplished by forking is adding someone else's possibly copyrighted work to the original author's copyrighted work.

    • by Kjella (173770)

      If you use source code found on github, it's going to be hard for the author to win a copyright lawsuit. This is a non-issue. They've basically allowed you to fork the code (with the implication that you're going to modify it). I don't see them in any way being able to recover punitive or even statutory damages.

      So under what license do you have the code, if it doesn't have one? Are you're going to claim that this CYA sentence in the terms of service that GitHub have put there to avoid being sued for handing out "unlicensed" copies to people is the same as the author putting the code in the public domain? I think you'd get laughed out of court with that defense. For sure it protects GitHub distributing the code, it probably protects you cloning the repository but you for sure hasn't been granted any "exclusive righ

    • by nadaou (535365)

      Just because you publish and given away a copy of a work does not mean you have released any claim to copyright on it. This is not trademark law where protect it or lose it applies.

      Try reading some of the many fine primers available at the SFLC. http://www.softwarefreedom.org/ [softwarefreedom.org]

  • by flimflammer (956759) on Saturday December 01, 2012 @02:36PM (#42155527)

    I think so!

    The public repository option for uploading makes no mention that you need to supply the code with a copyleft/copyright free license, just that the code is publicly listed and browsable. Why are people assuming that everyone is supposed to?

    Are people confusing open source (publicly browsable source) from Open Source (the movement)?

  • by SwashbucklingCowboy (727629) on Saturday December 01, 2012 @02:39PM (#42155559)

    Lots of so called open source projects either don't provide a license or provide conflicting license information. For example, we recently looked at a project where the web site says it's MIT, but the code says it's public domain.

    • by dbc (135354)

      And some that you would expect to be clueful are surprisingly not, or are at least very sloppy. I recently was studying an example in the Pyside code base. Pyside, a major project, from Qt, owned by Digia, formerly owned by Nokia. People you would expect to be clueful. I looked quite diligently for license information. I found in a directory some levels up from the code I was studying a one sentence "licensed under GPLv2". Okaaaaaay....., how about since each example is a stand-alone program in a stan

  • "promiscuous sharing w/out a license leads to software transmitted diseases".

    Well, before you use the software, checkout the license ...
  • A lot of stuff on github is experimental, "quick and dirty" code. The amount of effort to, say, put GPL boilerplate in every file isn't large, but it isn't zero, either. So, *ask*. You send mail to me, volunteer to do this small job, I'll probably give you commit access to the repo.
  • I have a bunch of projects on github and I'm too lazy to license many of them. If anyone ever emailed me wanting to use them I'd throw up a BSD3 license. I bet a lot of projects on github are lazy or simply don't know how to license a project, but would be happy to give permission to use the code.
  • No, using GitHub is not dangerous. But reusing code from the Internet without investigating its licensing status is. Then again, the same goes for anything that you find online, and they teach kids at school these days what you can and can't re-use. Your ignorance will not protect you.
  • A private repo costs money. Hosting elsewhere costs more.

    Maybe saving on hosting outweighs the downside of their code being public.

  • so just make it default copyrighted or default bsd and have done with it.
  • by imp (7585) on Sunday December 02, 2012 @12:16AM (#42159039) Homepage

    The phrase "All Rights Reserved" is a totally meaningless phrase. It used to be required to retain certain rights in central american countries. It was created by the Buenos Ares convention, and once everybody in central and south america adopted the Berne convention, the phrase no longer had any recognized legal meaning.

    It has falsely been asserted that the phrase "All Rights Reserved" makes the Berkeley Copyright statement non-free. This is false because the copyright notices from the Berkeley Unix code base date to a time when the phrase had meaning.

    It's only use today is due to inertia.

    In short, this article is quite sensational in its ignorance.

If a thing's worth having, it's worth cheating for. -- W.C. Fields

Working...