Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login
Releasing my tools under the MIT License was probably a mistake (2023) (donatstudios.com) similar stories update story
115 points by marbu | karma 1385 | avg karma 5.0 2024-02-17 21:06:37 | hide | past | favorite | 128 comments



view as:

I can relate. After some years I first switched to the Apache 2 license, later for some code AGPLv3. My stuff is mostly garbage and some software debt but who knows ;)

Now I start leaning towards: if one doesn’t want others to use it, don’t release it.


> they don't credit me as the author or provide any sort of link back

But this is simply not true. MIT requires keeping the copyright notice intact, which would be a credit. People that aren’t going to follow this requirement weren’t going to follow the GPL or whatever alternative you pick either, so either sue them or don’t worry about which one you picked exactly.


Agreed. His problem isn't the license. His problem is thinking a text file is going to stop a bad actor.

The text file isn't to stop the bad actor, it's to let you send DMCA requests to their host/search engines.

But he's not doing that. He's changing his text file.

He is doing that. Or to be pedantic, he has, and would if he relicensed.

> It's pretty easy to figure out someone's hosting service and put in a DMCA request. I've had to do it in the past for some stolen data that was posted online, and it's fast and effective. I'd of course try to contact them first as well, but when that failed I'd have quick recourse.

The same question was posed in the comments on his article.


He covers this in a couple places in the post. There is no requirement under MIT to redistribute the source for any changes you make or anything you build with it.

If they redistribute the source then yes, but that’s not the concern in the post.


Including a comment in the JavaScript file is broadly considered good enough to satisfy this requirement of the MIT license, even though most people won't ever see it.

GPLv3, on the other hand, is much more explicit about saying that the copyright notice must appear in the actual user interface of the application.


tldr; OP felt that releasing libraries under MIT License benefited the community, but releasing apps was a mistake because other sites bested them in the SEO game. That probably caused a Bing blackout, and certainly meant losing in SEO to crapware-filled sites.

I'm thinking the optimal course would be a GPL release + trademarking the software name so that there could be more control about attribution and what sites get to use the name?


Yes. The (A)GPL is there for a good reason (in part, this one - ensuring one's work and other's work on it remains free and open source and commercial freeloaders can't get a free ride), and trademark law ensures you retain control of your software's brand. MIT and BSD... well, look where they come from - they're not designed with those purposes in mind. If you care about an aspect of a licensing solution, use a license designed and fit for purpose - just as you'd use a library designed and fit for purpose.

AGPL does not stop that kind of use at all, though. As long as you stick to making the application have a quine functionality on all channels, it doesn't matter if the link is 0.01% of text on page compared to SEO spam.

But owning the trademark gives you some control over how the mark is used.

The statement "(A)GPL" probably should've been written "GPL/AGPL"... apologies for the miscommunication.

> Most irksome of all, in a fair number of cases they sit centrally on pages covered in ads and SEO keywords. My tools are being associated with a genuinely bad user experience.

For the record, any license that does not allow users to do that would NOT be a free software license.


I hate that people think they can control the definitions of "free" and "open" . I don't care about these biased propaganda definitions. If you want to promote your definition use a branded trademarkable name, don't try to steal our shared use of common words.

It's useful when words mean things. That goes double when the words are used for marketing. Like, yeah in theory it's odd for the OSI to define "Open Source", but in practice it turns out the only people who seem to object to this are people who really want the social capital from calling their stuff open source while actually screwing over the users.

I think there are plenty of arguments for non-OSI approved licences and I don't think "screwing over their users" is even remotely close to why people choose them.

It's perfectly acceptable to use whatever license you want, but then don't call it "open source."

You should stop using the generic term open source if what you really mean is Open Source Initiative? OSI Certified™ license.

Likewise, you should stop using the term open source if what you really mean is source available [0], especially with usage restrictions.

[0] https://en.wikipedia.org/wiki/Source-available_software


I myself rarely use the term "open source" but this does not stop others from (mis)using it. The mere fact that a term is generic does not mean that it is meaningless. If someone is genuinely unaware or confused about what the rest of the world thinks "open source" means, then I am happy to educate them. But if they are deliberately exploiting mis-use of the term to hide nefarious intent, then they can go to hell.

“Free” means something. If you want to stop people distributing your software through a site that has ads, then it’s not “free.”

“Open source” means something too. The control people have is in using shared definitions.

Language is malleable, so if enough people use a word incorrectly it changes the definition. But those people get to be called wrong for years until enough people misuse it to make it right.


You're redefining big-F "Free" software as defined by the GPL, which aims to give users freedom to change their software - and is indifferent to; at best, restricts at the worst, the rights of intermediate software developers who inject themselves between Free software and users by choosing to redistribute or allow their software to be infected by the GPL bits.

IMO, MIT & BSD give downstream developers more rights and are indifferent to end-users. GPL gives users more rights, and indifferent to downstream developers.


You have one definition, of "free" but its not the only reasonable one.

Is MIT not free because it requires attribution? Is no code free because it cannot be used in ways that break the law?

Just because there are some restrictions does not make it completely unfree, and its fair for people to want to use what is the most natural word to refer to thing that are free enough for them. "OSI-approved" works if you want to be precise but one org does not have the right to dictate the use of a word as common as "open".


I don’t think I’ve said my definition of “free,” but restricting who can distribute my software seems pretty non-free to me.

I don’t think there’s a true, single definition, but I think maybe the closest to that would be https://en.wikipedia.org/wiki/The_Free_Software_Definition


There is no valid freedom to abuse. It's like complaining that you're not free to enslave. It's not a valid argument.

Most licenses, even permissive ones, do require attribution of some sort, which in theory should move the SEO to the original.

The problem is that:

1. BSD-4-clause included an advertising clause and that was considered burdensome (similarly, GFDL-with-invariant-clauses is forbidden by e.g. Debian), so the attribution only has to remain somewhere.

2. Embedded-in-an-archive links probably don't count much for SEO. Some aspects of GPL and/or AGPL can help in some circumstances ("appropriate legal notices"), but automated AGPL requirement satisfaction in the presence of forks can actually be pretty tricky to implement even among good actors.

3. even though it's illegal, stripping of license headers remains very common


Scammers gonna scam, whatever license you use - but, that said, this is the exact use case that the AGPL license is made for.

> Many of them have made minor or major modifications to the tools, and next to none provide the source to those modifications.

> I am considering relicensing my tools under some sort of Attribution-ShareAlike license similar to the BY-SA the content on this site is licensed under.

Wouldn't the LGPL be well-suited to this?



Yes, and in some cases the GPL and AGPL.

> I want you to use things I've written. On top of that I don't believe it's my place to force you to then open source things you have written that expand upon my source code.

I'm a big proponent of the GPL and the AGPL, but no they don't sound like good solutions to the author's problems. It might solve the attribution issue but it's going to go counter to the author's other goals.


That's why I suggested LGPL, which allows the software to be used by closed-source or proprietary software, but any changes to the LGPL-ed library must be made available under the same license.

Except that the author then goes on to say how much they would prefer the derivative works to be open source, so it seems like they do want it but have been convinced they shouldn't. AGPL and an offer that other licenses would be available on request seems perfectly suitable.

The author doesn't say they prefer derivative works (e.g. works using a library) to be open source, only that they want modifications to the library to be open source

The attribution required by GPL/LGPL is fairly weak and in practice doesn't prevent the kind of "exploitation" discussed here. Ultimately if you don't market your work you will get steamrolled by people who do; I'm not sure this can or should be fixed.

I'm not going to go looking for them, but the impression I get of the sort of copycatters described is that they really won't care what the licence is, if the source is available they'll be there anyway - the blog post will just be complaining that it's against the terms of the licence (and probably not pursuing legal action) instead.

I don't think it really matters. These things will exist, anyone who matters will realise they're not legit. They won't make significant sales (without significant added value) it won't detract from your reputation; etc.


If they were actually violating the license, it'd be pretty easy and cheap to send DMCA takedowns to search engines, wouldn't it? (And possibly also whoever's hosting the copycat pages.)

It looks they are not violating anything though.

That's why he is regretting the use of the MIT license. He wonders, now, if having chosen a less permissive license would have given him grounds to shut them down, because they would be in violation.

Hang on - permissive licenses still require attribution. If they're not doing that, then he can absolutely DCMA them.

(I think; IANAL)


Not on the rendered web site, only in source code

I get your point, but i guess it’s sadder to see people complying with the license terms in an assholish manner than see people completely breaching the terms of the license.

But I suppose I'm saying I don't think they have that arseholish manner - they are simply replicating it because it is available.

I.e. if you don't like it the solution is not AGPL or source available but no reuse allowrd or whatever, it's closed source.


Exactly. If you don't agree with the OSS terms, don't license your code with an OSS license. OSS is not the default answer because there's no default answer. You have to think about what you want to achieve and license accordingly. Even then, there will be bad actors who don't care about you suing them, that will happen with any license (OSS or not).

It pains me to say this because I started in a proprietary software world early in my career and I hate it for 99% of the use cases but... proprietary licenses do have a place.


The author spells out that they absolutely don't want it closed source. They do want the common requirements of copyleft licences, so it seems that the solution is one of those.

The author also thinks the people they're upset about are jerks, even though they fully acknowledge they have the right to be. They're fairly clear about that. And even if they continued to be jerks, the author would be happier if the license they had chosen required them to be slightly less jerkish.


I know, what I mean is that I think if you want it to be source available at all (not even 'Open Source' necessarily) you have to accept that this is going to happen.

(Or at least could, and the more it sounds like a small helper lib / WordPress plugin type thing the more likely. As much as some dislike it, this is a big selling point of GitHub and its stars etc. OP's things sound like something I'd find on Sourceforge, and not really be able to work out if it was original or not.)


In fact, they already don't care. MIT requires attribution, and the author mentions in the article that "With noted exception, they don't credit me as the author or provide any sort of link back."

MIT doesn't require public attribution on the user's website. Here's what it requires:

> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

If you leave the MIT license anywhere in your server alongside the licensed code, with no public access, you are complying.


IANAL, but that doesn't sound right. A "copy" would be internet visible code repository. If it doesn't contain the LICENSE file (assuming that's what OP has) it's in violation of that rule in my opinion.

Your rationale makes sense if the software is distributed. Providing an output (observe that an output is not the software) through the internet is not considered distribution of the software.

The license doesn't require anyone to provide a copy of the license and attribution along with the output, only when the software is distributed.


Yeah that's my point, they're doing it because they can (literally can, as in the source is available) not because the licence allows them to.

Discussed (a bit) at the time:

Releasing my tools under the MIT License was probably a mistake - https://news.ycombinator.com/item?id=37111145 - Aug 2023 (7 comments)


So, what does the author actually wants from the licence?

Is it ok that other people take the code, modify it but don't open the modifications? If not, then GPL or AGPL. If you want that they can still build sth around it, but otherwise not modifying your library, then LGPL.

Or is this ok, but the main issue is no attribution to the original source? BSD licence maybe? Or Apache? Or what else?


> If you want that they can still build sth around it, but otherwise not modifying your library, then LGPL.

They can modify the library under LGPL, they just have to redistribute the source for those modifications under LGPL also


I basically have two modes for releasing code: All rights reserved, or public domain / CC0. My reasons are pragmatic. The latter improves the former by letting future me shamelessly plagiarize past me with zero responsibilities to point it out to anyone.

The specific problem the author mentions likely would not be solved by a more restrictive license. SEO squatters take whatever they want, and I doubt it would be worth it to sue them for breaking license terms.

While I agree that this isn't a licensing issue, it presents a malware threat for regular users - especially of the more popular software. If you care about the safety of the users, it may be well worth knocking the squatters off search results using DMCA. (In this particular case, I believe that attribution is required by the license).

In the long term, we need ways to make genuine sources more discoverable and verifiable.


First, you wanted people to use your tools and you gave them away for free under the MIT license.

Now you’re complaining that people are using your tools.

You can’t have your cake and eat it too.


Author here, and I agree. In the post I'm just lamenting my past choices. I gave people leeway and they used it. That is my failing, not theirs.

Genuine question: Relicensing to a more restrictive one would not stop them from copying it, right? And even if they do - would you considering pursuing legal actions against them?

It’s actually relatively easy as an individual to submit a DMCA to their hosting service.

That’s a pretty quick and effective route, and one I have done once before to get some non-public personal data that got leaked in a service hack removed from a blog.


>I am considering relicensing my tools under some sort of Attribution-ShareAlike license similar to the BY-SA the content on this site is licensed under.

Please don't use CC licenses for code, it's not what they are designed for and the CC actively discourages it[0]. Consider using the AGPL[1] or similar instead.

[0] https://creativecommons.org/faq/#can-i-apply-a-creative-comm...

[1] https://www.gnu.org/licenses/why-affero-gpl.html


AGPL wouldn't prevent any of the abuses he describes, though.

It's not an abuse. This is by design. It's one thing many don't get about Open Source. The goal is to not discriminate against any kind of use.

If you want to discriminate users by how they use it, then you don't want open source.


Its not illegal, but it is abuse

If you consider this an abuse, you're not in favor of the spirit of open source to avoid discrimination.

You think uses should be discriminated between acceptable and abusive.

It's OK to think that way, but it's not an open source way of thinking.


The original goal of Free Software, and the part I vibe with, is that you should have full freedom and control of the software you run.

The people taking someone else's tool and rehosting it with better SEO and more ads steals revenue from the original author and makes them less likely to make more open source stuff. It's greedy and hurts the community. I get why people would want non-OSI licences that allow everything but that.

As for whether its Abuse, idk, I don't want to lay out a precise definition and have a semantics argument. But its definitely not a cool thing to do


> A number of them even have the gall to post links advertising them in the comments of my own tools.

That and the search engine mayhem are abusive behaviour, even if not abuse of the license.

It's being a dick, deliberately.


Your thoughts regarding open source are borderline irrational when places like Amazon will copy and paste your repository and start making billions off of it.

What's the problem with that? If I didn't want others to use my code or make money with it, I wouldn't have gone open source in the first place.

I'd rather use an AWS service with an open source core than a closed-source service. Migrating away from AWS in the former case is arguably easier than in the latter.

And this is because of the open principle.


> If I didn't want others to use my code or make money with it, I wouldn't have gone open source in the first place

> I'd rather use an AWS service with an open source core than a closed-source service.

I guess it’s just a problem with the people who work in software engineering. You won’t use anything closed source, but also don’t care if other engineer’s valuable open-source tools are hijacked by companies with billions in resources.

Basically, you want to have your cake and eat it too.


Or just like MPL too :-)

Not sure they can change the license at all?

The author doesn’t own copyright for the code changes they accepted over the years.

But kudos to the author for acknowledging they picked up a dumb license. Sad not to see the GPL or AGPL considered though.


You can take MIT software and add additional restrictions to it, which is the main difference between MIT and GPL in the first place

The author is sharing second thoughts about using the MIT license and yes, bad actors are going to break bad, but the point of licensing is to control re-use within the (enforceable) legal framework of copyright. Reciprocal licenses (thanks Lawrence Rosen[1] for that term less charged than copyleft or viral) cede less control, and provide more footholds for enforcement. Remember that GPL has (sometimes) worked as intended in adversarial commericial settings [2,3].

[1] https://www.oreilly.com/library/view/open-source-licensing/0...

[2] https://www.tp-link.com/us/support/gpl-code/

[3] https://www.zdnet.com/article/software-freedom-conservancy-w...


To be honest I prefer copyleft or viral over reciprocal. Reciprocal licensing is traditionally an arrangement where a given license is interchangeable with another license.

For example, drivers licenses are often reciprocal between states. I've worked for firms which has reciprocal licensing agreements with some of their manufacturers. Copyleft is neither.


The big place that permissive licenses are promoted is in the giant tech companies. This is not a coincidence; it benefits them. That does not mean it benefits us.

With smaller companies we see a lot of *GPL with additional commercial licensing options ... which (assuming the main product is not a library with a non-LGPL license) often is actually still easy to comply with (especially if you only use somebody's prebuilt binaries) if you actually bother, no matter how much the hate train complains.

For individuals it varies a lot by ideology rather than deep thought, but permissive-license-regret is common.


I think regret is common. I don't think it's particularly novel to permissive licensing. Besides, most projects never reach any sort of popularity to draw a contributor count greater than 1, and relicensing at that scale is tremendously easy -- you just do it.

I'm also not sure what your on about with regards to big companies vs small companies. Do you mean companies which produce open source software? Or companies consuming it?

Generally, most software companies open source exactly nothing. Many companies open source software which they have found useful but is not designed to be used for a profit center. In my experience, only companies trying to directly license software adopt GPL or AGPL. Almost all companies which produce software under GPL or AGPL dual license with a commercial paid option that comes with no strings attached. Personally I find this disingenuous.

The reason giant tech companies promote permissive licenses is because they don't care about those things -- they're already giant and have secured whatever edge they need -- and because they can be a useful recruiting tool. Plus sometimes you need to ship SDKs and integrations and permissive is the only real way to go generally.

Anyways I've licensed and contributed to permissive licenses software. I could not care less what happens to it. That's the point. I understood the consequences of my actions as I made them.

Software that I want to make money with? I don't open source that at all, at least not until I've abandoned it.


> Almost all companies which produce software under GPL or AGPL dual license with a commercial paid option that comes with no strings attached. Personally I find this disingenuous.

There was at least for a time a trend (or at least noted by some) of using AGPL with copyright assignment[1] as a trojan horse to force customers into commercial licensing once due diligence came in.

[1] I consider copyright attribution to be the big sin in this, not AGPL, even though I'm against AGPL on other grounds. I understand why FSF uses (used?) it, but it opens a way for exploitation of people's work in unequal ways.


Copyright attribution is necessary to avoid tombstoning the project. Imagine you have something using AGPL, and some high profile court cases change the landscape of copyright, resulting in the arrival of new, next generation licenses. For example, let's assume AGPL is defeated in court.

It is effectively impossible to adopt a different license without either:

- getting consent from all authors/copyright holders.

- removing all the contributions of any outstanding authors/copyright holders who don't/can't provide consent.

Your options are pretty bad here.

Furthermore, not having a CLA even for very permissibly licensed projects can be a poison pill for any sort of M&A, even if the project would never need to make use of it. Not using a CLA muddies the IP portfolio of the company, and many investors will spook easily at the scent of IP issues regardless of whether or not they really matter.

Unless you feel like fucking around and finding out (I don't) you get copyright assignment.

Anyways, you can always fork.


Copyright assignment is also why Oracle could close back Solaris, including 3rd party code.

Any form of copyright assignment that isn't "here, fuck me over if you want" will be similarly fraught with peril because majority of the world considers copyright assignment to be same category of contract as AGPL/GPL/etc.


Author here. This was a frustrated rant after discovering these people serving my circle generator and frankly moreso my .htaccess rewrite generator on sites plastered with ads get more traffic than I do. It's honestly a little childish. I'd take the whole post with a grain of salt.

I used to to have a little cottage industry that helped me pay the bills of people finding my rewrite generator, not knowing what they're doing, and reaching out for help with their htaccess files. It's been a couple years now since anyone has reached out. On realizing that, I started looking into it.

Part of that decline is clearly Apache becoming less relevant, but the other part (I think anyway) is that I've fallen way down the SEO ranks, frustratingly behind people hosting my own tools.

Like I said, it's a rant. Think of it as such.

Everything is still MIT and by all likelihood going to stay that way.


Thanks for chiming in. Before I delved into Linux, I spent a lot of time with the BSDs. Because of the more permissive license used by the BSDs, I learned that the work put into these projects is for the benefit of mankind. Whether that's an individual, small project, or a greedy corporation, everyone and all get to benefit and, yes, you've seen the negative side of that.

@author You should consider your (likely) emotional and (definitely) ideological reaction to AGPL / GPL-style licensing and be pragmatic about which license you use for what.

I always work from first principals, and have written code which includes proprietary, public domain, and various forms of copyleft. They all have their place.

The licensing discussions become... religious in nature. It should really a pragmatic question of what kinds of ecosystem and behaviors you want.

The choice is and isn't about freedom. Most people are constrained by capitalist free markets (or other organizational mechanisms). If I'm competing and I keep your code open and a competitor makes theirs proprietary, they have an advantage. Ergo, in many domains, you see people forced to engage in obnoxious behavior as you're seeing to be competitive. Everyone can WANT to keep things open (or any other good behavior) but NOT be able to do it.

Something like the GPL can force everyone to do what they wanted to do, if their freedom wasn't taken away by the invisible hand of the market. Ditto for many regulations. Things which seem constraining can be liberating once you put a market system around it.


Except neither GPL, nor AGPL, would do anything about the case described. And that's even with AGPL violating freedom 0 through its tangled text.

Did you even read the case described? From the article:

"Many of them have made minor or major modifications to the tools, and next to none provide the source to those modifications"

"I wanted to promote community contributions, not to have them monetized by other people who don't even provide the source to their modifications"

If you did, I don't think you understood it any better than the AGPL (or freedom zero). AGPL text is not tangled. It's a very-well written text, if that's the license scope you want.

The case described is the exact purpose of these license.

Footnote: I've released two major tools 95% under the AGPL (with a few minor components under more libertarian licenses). It was the right tool for that job.


Yeah, I've read the text.

And it's trivial to be compliant with AGPL in this case without any effective change to the behaviour or problems caused. Yes, there would be source code link somewhere, but it can take 0.01% of the SEO spam and be still compliant.


There are plenty of examples of BSD-licensed code authors being burnt like this (including original ones from Berkeley, which were an impetus for the creation of the GPL; there were proprietary Unix systems built on top of volunteer-written code competing with the original systems).

Can you point me to any concrete examples of authors of AGPL-licensed code being burnt like this?

Circumventing the AGPL is trivial only on paper. It's hard in any human organization. In practice, parasites usually keep a long distance from the AGPL for reasons which will make sense to you if you sketch out what circumvention means in practice, what it means for org design, and the ROI there (not to mention the social signalling; not all parties are malicious).


AGPL does cause issues in various places, yes. But not in this specific case.

Quickly checking through license text (AGPLv3 as published on FSF website), following steps would have been enough:

1. Ability to view legal notice (does not have to be full, just reasonably visible)

2. A link that opens source of the code

3. AGPLv3 header in source code with notice of who and when modified it

Note that there's no need to explicitly advertise/attribute the creators in any more visible way. AGPLv3 also does not impact code that isn't derivative like all the SEO spam one's blackened heart puts on the site, especially when combined with modern "tag manager".

And we're explicitly talking about pathological cases from the start. To paraphrase oliwarner in this thread[1], we're dealing with people who are deliberately acting dickish.

I'll bypass discussion of BSD-licensed authors being burnt like that, because the legal situation was way more complex (before the GPL came on the scene) regarding a lot of BSD code (shortlist: 1) being derivative of other code 2) in at least one case being explicitly paid-for work with explicit "to be reused freely" conditions on the grant)

[1] https://news.ycombinator.com/item?id=39415042


.... which would address the author's issue of not having access to the source code.

But you messed up since you proposed a technical solution, where this is an organizational problem. Let me walk you through the more complex issue. The other website follows your steps and is in the clear. However:

* The interactive is more deeply integrated into their web page, whether originally, or through a developer five years later not noticing the AGPL special case.

* OP asks for source code to the full work. The full work is their entire web site in this case.

* The full work happens to include a JavaScript library and a font program which were licensed from a proprietary vendor.

The other website has two options: (1) Negotiate to release the their source code, and worse, their vendor's source code under the AGPL (2) Pay damages.

To avoid this, beyond the steps listed, the other website needs to implement processes and controls to prevent issues like this one. That is where the $$$$$ comes in. Processes are expensive to maintain, much more so than any software.

In general, AGPL code is very safe to use in commercial settings for well-compartmentalized major systems. If I have an AGPL office suite used by my organization, or ed-tech software, that's easy. Used it in a corner like this one, it requires a lot of controls and compliance, which make it prohibitively expensive. AGPL has a few more catches like this. This is why most major organizations tend to require legal review prior to any use of AGPL code.

AGPL tends to be good for several purposes:

1) Establishing open ecosystems. If I do work in civics or education, this can be very important there. If I am making a voting system, for example, I want to guarantee anyone can inspect the system at any level.

2) Dual-licensed systems. Open ecosystem is free. Proprietary pays.

3) Major pieces of well-isolated code, like the aforementioned office suite example, where I don't want freeloaders, and where there isn't an expectation that I will have my code used as a library or piecewise in another system.

4) Places where the goal is more transparency than reuse.

There are a few others too.


Practical question - though IANAL - if they're not providing attribution, then aren't they out of compliance even with the MIT license, in which case you could hit them with a DMCA take down?

Attribution and retaining a copyright notice are two separate things.

If they are modifying the frontend so it’s their own code, no copy left license would work because no copyright would be triggered. Output of the tool wouldn’t be covered.

> In some cases, they are even beating me in search results for my own tools.

Correct me if im wrong but the license does not give them the right to name. Author should still be able to request them to change the name?


It's interesting: generally speaking OSS licenses concern copyright for the code, but not trademarks for the name of the project. Licensing Project Foobar under an OSS license should not really be seen as granting permission to use the name "Project Foobar".

But I just realized that the MIT license is worded in such a way that one could draw that inference, and it might stand up in court.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

One could probably make a compelling argument that "you have the right to deal in this Software without restriction" and "you have the right to sell this software" as including the right to sell it under the same name.

If one is going to use the MIT license (or anything else that doesn't call out the copyright/trademark distinction) it would probably be good to include a supplemental notice that reads something like "The MIT license here does not confer any rights to use the name 'Project Foobar'. You must distribute any copies or derivative works under a different name or we will sue you into oblivion for trademark infringement" (or something roughly along those lines).


Or use Fooweasel in the source code and Foobar™ in the binaries.

I do not think so. First of all, the license is clear that it is a “copyright license”. In my view, that calls out the distinction from trademark by exclusion. It would not be a reasonable interpretation to assume a trademark license unless trademark is explicitly mentioned and even less so when the license is explicitly described as a “copyright” license. The license defines “The Software” and, again, I see no reason to infer trademark as being part of that definition.

The license also requires you to include attribution and to declare the copyright of the licensor. So, while you have access to the software, ownership has clearly not transferred. You have a copyright license ( that has to be declared ). Nothing more.


> I do not think so. First of all, the license is clear that it is a “copyright license”

No it doesn't. That's why you can use an MIT-licensed codebase that doesn't have an explicit patent grant and not worry about patent enforcement—it doesn't narrowly constrain itself to copyright.


Wouldn't that fall under trademark and not copyright law?

I thought the MIT license required attribution, but on rereading the requirement is pretty weak: You're only required to keep the original copyright notice.

About 15 years ago I sold a car I owned. Its fair market value was $5,000, but to get that I'd have to wash it, put an ad on Craigslist, deal with the scammers who want to pay with fake money orders, meet with potential buyers, let them test-drive it, etc., and I didn't have the time or patience to do all that. So instead I sold it to a coworker at a low price, maybe $4,000. I sent an email to the company's water-cooler list and included a photo of the car. Within probably 15 minutes someone replied saying the car would be perfect for his mom. By the end of the day, I had received a personal check, signed over the title, etc., and I thought that was the end of it.

A few days later another coworker emailed me with a screenshot of a Craigslist ad for a car like mine. In fact, it actually was for my car! The first coworker listed it for something like $5,250, and by the time Coworker #2 pinged him, he'd already sold it for that price. Coworker #1 didn't even take a new picture -- he just reposted the one I'd taken!

At first I felt exploited. Here I was, being nice to my coworkers and offering a discounted car. And I later confirmed that the guy who bought it actually did lie about intending it for his mom, which made the whole thing seem even more unsavory. But I calmed down after a few minutes. I remembered that my plan was to sell it to a coworker rather than deal with the scumbags on Craigslist, and I was willing to take a big discount for that. "Being nice to my coworkers" was just the story that I told myself to justify my priorities. I got exactly what I wanted out of the original deal: an easy way to get rid of a car I didn't need anymore. And unlike me, someone else was willing to put in the effort to flip the car and extract that last $1,000 or so of value. My instant emotional reaction was to feel vaguely cheated, or that the guy I sold it to was a sleaze. But he didn't actually hurt me. I got what I wanted, and so did he.

In the case of this software tool, I'd ask the article author whether, in retrospect, he wishes that he'd kept the tool rights and gone down the SEO rabbit hole to monetize it for himself. Let's say further than he was successful, obtaining $X/month in ad revenue. Would he feel better in that case? I'd guess not; for most values of $X, he'd conclude it wasn't worth his time. But what happens once he concedes that he's not going to put in the effort? Does he still not open-source it solely to prevent anyone from monetizing it? That's the key question. Would he feel better knowing that he prevented someone else from benefiting?

When we give gifts, we hope the recipient will use it in the way we would have. Use the tool to create awesome ovals. Drive your family around in the car. It's hard when the recipient instead uses it "the wrong way." SEO the tool. Flip the car. But that's always a risk when truly giving a gift with no strings attached.


> My instant emotional reaction was to feel vaguely cheated, or that the guy I sold it to was a sleaze.

Were you cheated? Probably not. But the guy was definitely on a sleaziness spectrum.


I mean, I wouldn't do it, just because I don't want to deal with everything. But everyone got exactly what they wanted. I see no sleaze.

Lying to a co-worker about why you are buying the car doesn't strike you as sleazy? Is there a degree of misrepresentation where you'd agree, or do you feel that lying can never be sleazy?

Oh yeah, that. Forgot about that. Yeah, that part is sleazy.

the reseller could have been honest:

"why don't you post it on craigslist?"

"don't want to deal with the scum there."

"mind if i buy it off you and then post it?"

"go ahead, and good luck."


Exactly. Maybe the top-level poster says something like "Oh if you're going to clean it and re-sell it for a profit, I'd rather hold out to see if another coworker actually needs the car, because I also like the warm fuzzy feeling of knowing it's helping them.

"Oh, well what if I told you the $500-1000 I think I can get from taking that work off your hands and re-selling it would really help me out"

"That makes sense. Sold"

See how easy this is without the sleaziness of lying?


In retrospect I view that part as an example of "don't hate the player, hate the game." In negotiated deals like this, it's not unusual to represent yourself as the right choice even if the terms you're offering aren't the best. See homebuyer offer letters for a particularly nauseating example. Who knows or really cares whether those parts of the deal are honest?

Maybe the car truly would have been great for his mom.


[dead]

i've been in similar situation..

just keep going. ignore them. They will disappear sooner or later.. while you will keep showing up. That IS what matters.

IMO


My advice: split your work into two camps, the types of projects you would be happy if everybody used and benefited from (even without crediting you), and the types of projects that you would not be happy seeing others republish without your name. Choose a permissive license like MIT for the former, and keep the latter closed source.

In my case[1], although I have several hundred MIT repos, I have many others that I feel an emotional connection to and do not share publicly.

[1] https://github.com/mattdesl


As someone who prefers the MIT license, I honestly couldn't give a shit if you're using it to make billions by kicking children.

Simply don't shy away from copyleft licenses. MIT has its uses, but GPL is there for you too.

Better than the GPL poison pill

Closed source would fix this.

GPL would not (CC licenses is not appropriate to code)

Please ~ MIT or Close Source projects. Don't GPL, GPL is for assholes and the antithesis of free code.

They could try creating a strong brand and using copyright and trademarks.

But the author says the post was just a needed rant - https://news.ycombinator.com/item?id=39414296


Change the license?

Well, with any license releasing code for useful tools will result in unlimited 'borrowings'. In most cases enforcement against small player is difficult. And impossible if it becomes popular in darknet/underground. My recommendation to the author: forget about it. You can add more watermarks in the code, or stop coding at all blaming a.. bad people, someone specifically, the laws, etc. if it make you feel better. As for me if I give something away I don't expect my axx to be kissed. Still can add it to my resume.

You are not alone here. For the past 15 years, I've been trying to figure out how this works and what license to apply to the new programming language. It seems like a strange waste of time, as with AI coming, it will be easy to bypass licenses and clone your code legally, and managers are already discussing this. I think this is the reason for the decline in the software startup market.

Either give code away or don't. Don't demand contributions or be a control freak about their use because it's wasted energy and uncool.

Is there a license that only requires mentioning? Like exactly CC-BY but for code?

I'm in a similar position as the post. I make scripts and tools that I want to share online for anyone to use. I would like to allow everyone unrestricted access to it, but only if there is a mention and a link to the original page in a user-visible place.

You want to use the tool? Go on, but mention me as the author. You want to modify the tool privately for your own purposes and use it on your company? Go on, but mention me as the original author. You want to take the tool, include ads, and sell it? Go on, but mention me as the author.

This is due to past experiences with people taking my scripts and just reuploading saying they made it. I only want to be credited as the original author, that's it (and for the third example, the ad-filled copy, my idea is that if you get money from my work that's...ok, but only if you let people know where you got it to (so they can decide if they prefer the free original or yours).

MIT only requires to keep the license file, but from my understanding it's just a file that users may not even see. GPL (and AGPL) requires you to share your modifications, which is a restriction I don't really care.

CC-BY is the closest to it (in fact I think is exactly what I'm asking for) but for some reason it is not advised to be used on code...


Just use BSD license then? Isn’t that the most permissive of all?

So is this the new way to hack personal cellphones? I have nothing at all to do with technology but The Open Source Software License has been on my personal cellphones for about 5 years. It started with a person I knew cyber stalking me by controlling my phone. Settings of that phone showed there was another device with more access to my account than I did my phone was used once in awhile. Google maps showed his contact name and that he knew my beginning specific location ETA to my next specific location etc. he blocked important contacts and emails. It just got worse as he got better at it by using the MIT Open Source Software. He got into my MGH Patient Gateway and changed my medical records and not to make me look good he did it to hurt me and make me look legitimately paranoid/ crazy/ drug addict etc. I thought he was a friend and had no idea until about a year ago what was actually happening and because it was during Pandemic my Doctors/ Surgeons don't realize my records were changed . How can I stop this?

Legal | privacy