14

Imagine, I published a page on the web. It contains some javascript code, which uses open source library. Is it in general considered redistribution?

On one hand, it's a redistribution. You put code on the web, and it's distributed to the user's browser.

On the other hand it's not. You don't distribute code out of your server, and usually the client part is meaningless without the server part, so downloading can be considered a part of process of using this software.

Do you think if this is redistribution or not?

Improve this question
5
  • 2
    If a user can see the javascript with "view source" I suppose it's redistribution.
    – Glenn Randers-Pehrson
    Jun 19, 2016 at 1:50
  • @GlennRanders-Pehrson I agree with you. Better be safe in such cases. However, I see a large number of web apps which use open source libraries/web sites which don't enforce open source attribution. Sometimes, they are produced by large companies which have good lawyers, and it seems that they use the second reasoning which I would like to know more about.
    – Konstantin Solomatov
    Jun 19, 2016 at 4:20
  • You wrote: "However, I see a large number of web apps which use open source libraries/web sites which don't enforce open source attribution." --> this is a common mistake but this is plain wrong. Why would it be that license of poor JavaScript code would matter less than the license of mighty C/C++ code?
    – Philippe Ombredanne
    Jun 19, 2016 at 11:30
  • @GlennRanders-Pehrson seeing has nothing to do with redistribution IMHO. Whether the code can be seen or not does not matter. Think of a binary for instance that embeds a statically linked utility library. No user would ever "see" that. It is still redistributed nonetheless.
    – Philippe Ombredanne
    Jun 19, 2016 at 11:40
  • @PhilippeOmbredanne I use "view source" to do more than "see" code. Usually I'm looking at embedded data URLs, but it's the same idea. 1) view source 2) save source 3) edit, extract, or whatever. Or, use some other method of downloading the HTML source (e.g., wget), then extract the JavaScript.
    – Glenn Randers-Pehrson
    Jun 19, 2016 at 11:49

2 Answers 2

Reset to default
10

Every lawyer I consulted with always gave me the same answer: JavaScript in web page is code redistributed to whoever loads this page in their browser.

So yes, this is unambiguously redistribution.

And to answer the underlying question that you did you ask: yes, you have to comply with any specific FLOSS licensing requirements for this piece of JavaScript code, mainly attribution and code redistribution if the license requires it.

And to continue answering more unasked underlying questions, if the JS code is minified and the license requires corresponding source code redistribution, you would also need to make the un-minified version of that code available for redistribution. Think of minified JS much in the same way as a compiled binary.

For reference, you can check this post about a BSD-licensed JavaScript used without proper attribution in a web page and a detailed technical analysis of the case.

As an aside, this create some interesting and funny challenges when it comes to licensing requirements... Say you use a GPL-licensed bit of JavaScript code that is 100 lines and about 1KB of code. You would technically need to include the text of the GPL to be in full compliance which may be ~ 40KB... or 40 times bigger than the code itself.

Now practically, the GPL text would need to be available but it does not have to be available inside the JavaScript or the pages embedding that JS: it can be provided separately much the same way that a GNU Bash executable does not contain the GPL text but only a reference to it and the text is provided separately.

Improve this answer
4
  • I completely agree with you on why it's redistribution. It's logical but I see a large number of companies, including very large companies who can afford top lawyers violating it. I am very interested in their reasoning behind such behavior.
    – Konstantin Solomatov
    Jun 19, 2016 at 20:41
  • I doubt that there is any reasoning and there may not even be awareness: in which case there would be no behaviour. This is most likely ignorance or oversight or incompetence from the developers with regards to what they should do when reusing JS code rather than malice. The best you can do is to gently educate.
    – Philippe Ombredanne
    Jun 20, 2016 at 6:02
  • Why do you have to make the minified version available if browsers can un-minify it? developer.mozilla.org/en-US/docs/Tools/Debugger/How_to/…
    – opticyclic
    Sep 8, 2016 at 19:30
  • 1
    @opticyclic in most cases, the minification is akin to a compilation and the pretty-printed version of a minified JS will NOT be the preferred source code form to make a modification, but something as obscure as compiled C code. So if the JS code in question is using some copyleft license with corresponding source code redistribution requirements, the minified version is unlikely to ever be enough. Only thr original unminified version would be.
    – Philippe Ombredanne
    Sep 9, 2016 at 9:46
2

It seems to me that you are asking an ambiguous question.

Option 1: You have copied and pasted JS code from some library onto your page. Clearly, here, you are redistributing.

Option 2: you are loading a library of JavaScript from someone's CDN, and calling it. Now, the legal question becomes more complex. Essentially, is your page a derived work of the JavaScript library? The sort of logic that says that, for example, Drupal plugins are derived works of Drupal would say 'yes'. Other logic might say no.

Improve this answer
4
  • Good point but the question is about JavaScript in a page. Now if the JS is pulled from a CDN, I would tend to say that it does not matter either: the provider of the web page is still the one triggering the redistribution regardless of where it comes physically from? Otherwise you could pull all of your JS in a CDN and that would allow you to bypass any license requirements?
    – Philippe Ombredanne
    Jun 19, 2016 at 20:30
  • I found the writing of the question questionable in this regard, but maybe I'm just over-reading it. On the other matter, I'm only casting a bit of doubt. I'm not equipped to claim that you are wrong. I could claim that when Google puts a library on their CDN, google is redistributing it, but i'm far from sure that I'm right.
    – bmargulies
    Jun 19, 2016 at 23:57
  • "when Google puts a library on their CDN, google is redistributing it" --> I would tend to agree with this, though you could also claim that the web page that includes the JS (and the provider of that web page) are the ones redistributing it effectively (through Google but stiil) as the JS would not have landed in the browser otherwise on its own.
    – Philippe Ombredanne
    Sep 9, 2016 at 9:56
  • Hence why I tend to think that where the JS comes from does not matter to the end user of my web page: what matters is that I provided the top level page and I am now the redistributor and that I carry the compliance responsibility, not the CDN that I am using.
    – Philippe Ombredanne
    Sep 9, 2016 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.