Getting Forked by Microsoft

It's also very possible they had been working on it already and wanted to compare notes, I certainly would if I were working on something internal and found a similar project, but I agree, ask them for a consultation fee. I don't see why they wouldn't pay it.

Both projects also share in license, so I have less of an issue with it personally. They're both MIT licensed.

Not just a megacorp. Anyone for a commercial purpose

Probably expectation of some monetary gain. At the very least getting hired to keep working on the same thing. I do not blame him at all for this. Though when things didn't work out, all he thought he could realistically do is start accepting donations.

I think that worldview leads to a much poorer world.

Normal people aren't constantly engaging in a fight for survival in every aspect of their lives, and I don't think it's a good thing to ask them to. We should expect the people we deal with to be acting in good faith. I think it would be bad actually if I had to consider if you're going to make money off of my idea when talking to you.

Asking everybody to be constantly vigilant of possible exploitation by megacorps puts an undue burden on individuals. We should have strong and durable protections against those megacorps in other ways.

What I'm saying is that this sort of copying should be criminal (not just illegal, but criminal) and Microsoft, the legal entity, should be held accountable and fined. I acknowledge that this isn't currently possible with our legal framework, but we should work to make it possible.

Because they're hoping not to antagonize the megacorp (too quickly). If a megacorp has you in their sights, especially in a country like the US where court battles are prohibitively expensive, pushing the envelope will just draw ire and aggression from that megacorp. A normal person has no negotiating leverage in front of MS especially when it comes to open source.

It's like negotiating with the mafia, you might get something out of it but if you cross the line you'll end up face down in a ditch and authorities will look the other way. Megacorps have stolen, copied, reverse engineered, replicated, etc. things since forever and it always worked out for them.

In this case MS didn't need any help. They could very well take everything and face no real repercussions (this is the reality when the majority is uneducated, and their elected representatives are greedy and spineless). So playing along gives some chance to get something positive out of it.

Do you think this stops the fork? It’s not like they can’t read the code.

You are mistaken. The license explicitly allows it subject to the terms of the license:

> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Microsoft didn't follow these terms. They copied "substantial portions of the Software" and didn't include the notice.

Generally a court likes for a plaintiff to try to resolve a dispute before suing. The author should contact the Peerd team at Microsoft and point out that they seem to have overlooked their obligations under the license. Only if they refuse to do anything would it be worth considering a lawsuit.

MIT License.

Note that in this case Microsoft has not been following the license, as they removed the copyright notice

    Copyright (c) 2024 The Spegel Authors

> The above copyright notice [...] shall be included in all copies or substantial portions of the Software.

Ignoring that Microsoft isn't following the MIT licensing requirements, this is my same approach with using the MIT license. I create open source software for the benefit of everyone, for profit or not for profit. The only thing I do wish in return is acknowledgement. That's why in this case, I'd reach out to Microsoft to fix that issue, and nothing more.

In the present case of Spegel, it wasn't in accordance with the license, because the fork removed the attribution.

Because the “payment” that you get for its permissive use is the attribution (which can be personal gratification or it can professionally boost your profile/opportunities). MSFT robbed them of that.

Yeah, as far as I can gather the only thing MS did wrong here is not explicitly crediting the project they forked the code from, and I don't get the impression the author would find adding that one sentence to the docs to be adequate redress. I don't get why you would take personal offense at a big company forking your code so they can mold it to their purposes - the license allows that. Now whether that's the right way for a "friend of the OSS community" to behave is a different question entirely, but anyone who ever bought that horseshit from them has had their head in the sand.

Right, dual license is the way in such cases.

Give downstream how much they are willing to give upstream.

At this point I'd include some of the code as binary blobs and "pay me for the source!". In addition to GPL!

In this case, there's an open source maintainer who was fine with a MIT license, and even helping onboard people from a big tech firm, only to realize that even attribution was too much to ask.

Since the terms of the license were violated, there's not much to learn about which license was chosen. The only lesson to learn is that big tech will steal everything that isn't nailed to the ground, and then some.

Maybe many MIT license users want a big company to take in their projects.

Big companies have resources to mimic it anyway, right? If they really want some tech, they can reproduce it.

Having a good idea flourish, whether it is in Microsoft's hands, manifested within Clojure, or in any other fruitful form, is good enough.

There is no license for a raw idea anyway. For the essence of it. Seeing it used means success, it means "you were right".

The secret counsel of idea honor keepers will eventually figure it out and make some kind of repairs.

(A)GPLv3 does not prevent their projects from being used.

That's the point!

GPL family of licenses would've made a difference in this aspect for libraries (because afair if you link to GPL code, you must be GPL). But for an app? You can use it, fork it, modify it... Just make sure you make your changes available under the same license. Seems very fair to me.

I am not a lawyer, but I imagine a lawyer would find it alright if they just restore the missing notice. I do not imagine there is much else that can be done here since he cannot really claim to have been significantly damaged by the absence of a single line, but these matters are best discussed with attorneys.

It is a fairly standard practice in at least some open source communities to add copyright notices to files that people have changed significantly, although there is no well defined minimum threshold for how much permits them to add a copyright notice. Thus, someone else can come along, fork the project, add copyright notices to all of the files and then give the impression that they wrote them, since there is no attribution aside from the one LICENSE file that you wrote. The git history might show the truth, but if they copy the files into a fresh git repository, that metadata will be lost. Projects take files from one another all the time, so there is no guarantee that they will preserve your commit history and then anyone curious who wrote the code needs to do digital archaeology.

That said, file level copyright notices are not perfect (since only the VCS shows who added what lines and that might not be preserved), but it is better than nothing and it is something that is guaranteed to persist as long as people are abiding by licenses. If they are not, that is copyright infringement and the copyright holder can do things like send cease and desist notices in response to the copyright notices being removed.

Also, I must emphasize that I am not a lawyer, but one might argue that it was not willful infringement if someone removed a copyright notice from 1 file by claiming it had been a mistake. However, if they remove it from all files, then nobody is going to believe it was not willful.

It's not required, but it's generally safer to put a notice saying who owns the copyright and what license the file is released under at the top of each file. Some licenses like MIT, the BSD licenses, Zlib, etc are short enough that you can include the full license text in the notice, and others like GPL provide sample copyright header text to include. Here's an example of this from a random file in the SDL source code: https://github.com/libsdl-org/SDL/blob/main/src/video/SDL_bl...

Obviously Microsoft is still committing copyright infringement and in the wrong here. However, if the author had copyright notices in each file and then Microsoft stripped them out or changed the copyright information, it would make it harder for them to brush it off with "oops, we forgot to commit the correct LICENSE file" like I'm sure they'll do here.

Sufficient but a good idea to put copyright in all files.

Technically if there's no license found then it should be considered automatically copyrighted, with no permissions to copy. So leaving copyright license out actually makes it less open source.

I would say: absolutely no (ianal). But I've had stand up arguments with colleagues in the recent past that I was unable to win. They wouldn't even ask the legal team for an opinion. But it's nice to see some evidence here that I was correct.

He had a top level license file that presumably applies to all files. He would not be the first to do that and will not be the last.

That said, if Microsoft had forked before the LICENSE was added or stated somewhere, they were reusing all-rights-reserved code, which is definitely copyright infringement. Again, I am not a lawyer.

> If they forked from before the author had a license, it’s worse. MS had no right to use it.

You are right, provided he did not have a notice saying it was MIT licensed elsewhere.

> I’ve contributed to plenty of project that don’t have the per-file copyrights. It’s a choice not a mistake.

I would consider it to be both a choice and a mistake. The two are not mutually exclusive. There is no evidence in the fork that he is the copyright holder of the original code and it looks like Microsoft is. Part of that is Microsoft’s fault, but part of that is the original author’s fault for not including per file copyright notices, such that Microsoft could add theirs and be the sole one listed in every file.

I would not be surprised if Microsoft’s legal department doing a scan of public repositories for stolen code mistook him for infringing on “their code” given that they have no information that he authored it rather than their employee. It sounds absurd, but it has happened. I know for a fact the sg3 utils author added copyright notices to his code examples because he was getting contacted by companies, whose engineers incorporated his code into their projects without attribution, that thought he had stolen their code:

https://github.com/doug-gilbert/sg3_utils

I know that because he told me by email in 2013.

The OSS philosophy was conceived to help end users, not for-profit corporations. Then for-profit corporations co-opted the "Open Source"(tm) label to ensure they could benefit from all this free labor. You and many others are falling for it, and doing their work for them by scolding OSS developers for "going against the OSS philosophy".

So screw this corporate "OSS philosophy", and stop telling people what they "should" do. Those licenses exist and people can use them and this is what happens. We can and should also make different licenses which protect our interests as developers and we don't need corporate shills invoking some philosophical argument to discourage us.

"It was never about the money part"

That seems to be the point being debated now. When a megacorp forks an OSS project and cuts out the author, how does that encourage developers? How does that encourage OSS?

And for that matter, perhaps less ideological but practical, how does that encourage small startups who want to be as open as possible while wanting to be able to scratch out a living working on something they care about?

You suggest staying closed source, rather than tweaking an open-source license to limit corporate forks, for the purpose of protecting OSS philosophy. It strikes me as odd.

Very good point. Trying to think this through.

I think community source should be accessible and usable outside the community. A community license should have a provision for paid use by corporations. If Microsoft wants to use it that is fine - if they pay.

But if Microsoft wants to fork things, to me that is predatory. If I can't fork windows, why should they be able to fork community software? If they argue that people should pay for their products, it just seems fair to me that they should not get community products for free.

I guess the concept is playing by the same rules?

Yes! Another vote for CC-BY-NC-SA! I release my code under this license as well, even snippets I post on my (tiny) blog.

I think this is what a lot of people would use if it were more known about. I feel like a lot of people do not actually read what a license provides and just default to MIT because it is widely used.

As someone commented above, commercial use is an issue. Creative commons is good, but the non-commercial clause prevents it being useful in this case. It seems to be that the crucial issue here is the duplication of the project by forking.

I am unclear of where the boundaries could and should be, but in essence we want money to flow into community source projects. Corporations and commercial entities can and should pay a fair amount. If they don't want to pay, they should not be able to profit from the work of the community.

So only hobbyist software? NC applies to use as well as contribution.

> Does it matter what license you use if they actively ignore the terms in the license you did chose?

If they're breaking the license, go talk to a lawyer. You might start by approaching the SFLC [1] (although I haven't heard much from them recently).

[1] https://softwarefreedom.org/

MS has internal tools that scan dependencies etc and flag them against legal team if anything is fishy. License choice matters quite a bit, they will not risk litigation.

If you worked at a megacorp you’d know they care a whole lot about not allowing GPL code anywhere near their propertiary repos; this is usually enforced by IT security (NOT engineering) with dedicated scanners, confirmed matches are at least highest priority bugs.

Is this really true? Whats the point of even licensing our repo then?

MIT doesn't need attribution. Original BSD does, but revised and most widespread BSDs do not.

GPL/AGPL would prevented this somehow, requiring proper attribution via mandatory source code release, and allowing to track project origins. This would make it harder to label it as a "a Microsoft Product from Ground Up", and prevent Sherlocking the original application to a greater degree.

As a result, this would probably forced Microsoft to develop a new one from scratch, because they're allergic to GPL, because if they have breached GPL, they would be forced to comply, since GPL is court tested already.

So, write Free Software. Not Open Source. Esp. for your personal projects.

If the author has ethical concerns with companies using their work there's a simple way to make that explicit and unambigious – the license. No one can read their mind otherwise.

Mostly no, but I read the overall piece as a complaint that they got a fork when they were hoping to get a collaborator.

Right. So they should just add a copy of that line somewhere in the repository, saying "some parts of this project come from this licence"?

What would be the goal of this? I ask because I think the nice thing about the current system is that the goals are well represented/easy to sum up and defendable.

What would be the goal of a license between AGPL and SSPL on the spectrum? Seems like such a license would at the very least be non-free? (which is perfectly ok)

What's wrong with CLA? I've contributed to project with CLA. Have been using them and then wanted a feature and the project accepted my patch. Ther are still many people contributing to project with CLA.

And just to be really clear -- it's not actually a solution to cloud providers not reusing the code for profit (which I assume is the context you're implying, could be wrong here), because AGPL is free software, so people are free to reuse your code for commercial purposes. AGPL at least prevents making private improvements to open source networked code without contributing back.

I think in this situation it might have convinced Microsoft to contribute rather than fork... But then again, it's Microsoft. Also, they're well under their right to fork and keep the changes as long as the license stays the same, etc.

I think another important point might be that "free software" aims to protect the users of free software, not necessarily the profit-maximizing (I mean to use that phrase neutrally) ability of software developers.

The problem is that it scares away also others. Personally I avoid such projects for any purpose, they simply don't exist for me.

I also don't understand the cloud hosting argument, when we had a great whole era of Apache/PHP/MySQL stack based on exactly this idea of commercial hosting.

The extra baggage in AGPL is what makes it work for the purposes that OP wants it. LGPL takes the GPL a step towards MIT, where AGPL takes it the opposite direction.

It’s classified as free AFAIK, could you expand/lay down some points?

The FSF considers AGPL Free Software (of course).

The OSI considered AGPL, Open Source.

Debian considers AGPL to be compatible with Debian Free Software License Guidelines.

FreeBSD considers AGPL acceptable in its ports.

So when you say AGPL is non free, could you clarify exactly what you mean?

I wonder if there exists any system in place that this could backfire rapidly if this could be proved on some level. Unfortunately, world needs examples and consequences before anything changes. If this worked for this particular engineer, others will follow and will attempt the same. It will become a norm in big corps.

>chore: change to MIT license

What does "chore" mean in this context? Is the license just leftover from some MS open source template? If so there is perhaps some leeway, and the author maybe just didn't realize he needed to use the original MIT license file including the notices and not just a template one grabbed from the internet.

Any other explanation for such a "relicensing" would be extremely worrisome.